Cloudflare “Sorry, You Have Been Blocked” (1020, 1015, 1010): How to Fix It

A customer emails a screenshot: a white page with the Cloudflare logo and the heading Sorry, you have been blocked, or a page that says Access denied with Error code 1020. Or you are blocked yourself, from your own site, perhaps only from wp-admin. Other versions say Error 1015: You are being rate limited, Error 1010: The owner of this website has banned your access based on your browser’s signature, or Error 1006 Access denied: Your IP address has been banned.

All of these come from Cloudflare, and all of them say the same thing underneath: a security setting in your Cloudflare account matched the request and stopped it before it reached your server. Your hosting and WordPress are fine. Cloudflare says plainly that its support team cannot override a customer’s security settings, so the fix is in your dashboard. This guide is for the site owner or the person who manages the Cloudflare account. It shows you how to find the exact rule from the Ray ID on the screenshot, decide whether the block was right, and change the rule without switching your protection off. If instead you see a 52x error, Cloudflare could not reach your server, and our Cloudflare 52x guide applies.

What is happening

When your domain is proxied through Cloudflare (the orange cloud next to the DNS record), every request passes through Cloudflare’s security features before it is forwarded to your server. Each feature can block, challenge or allow. The page the visitor sees depends on which feature acted:

What the visitor sees	HTTP status	What blocked it	Where to look
Sorry, you have been blocked (no 1xxx number)	403	A WAF custom rule or WAF managed rule with a Block action. Cloudflare documents that these return its standard WAF block page, not a 1020 error.	Security Events, then the rule named in the event
Error 1020: Access denied	403	Another security feature with a Block action and no custom response (Cloudflare gives API Shield schema and JWT validation as examples)	Security Events
Error 1015: You are being rate limited	429	A rate limiting rule	Security Events, then rate limiting rules
Error 1010: banned based on your browser’s signature	403	Browser Integrity Check, which blocks requests with missing or abnormal browser headers	Security Settings
Errors 1006, 1007, 1008 or 1106: Your IP address has been banned	403	A block on the visitor’s IP address, usually an IP Access rule	IP Access rules and custom rules
Error 1009: Country or region banned	403	A rule blocking the visitor’s country	Custom rules or IP Access rules
Error 1005: ASN banned	403	A rule blocking the visitor’s network (their ISP, VPN provider or cloud host)	IP Access rules
Error 1012: Access denied	403	Malicious activity detected from the visitor’s computer or network	Usually the visitor’s side: Cloudflare suggests a malware scan
A challenge: a checkbox, a short wait, or Verify you are human	403 until solved	A Managed Challenge from a custom rule, Bot Fight Mode, Under Attack mode, or a high security level	Security Events, Security Settings

One warning about that last row. A real Cloudflare challenge never asks a visitor to press keys, open a Run box, paste a command or download anything. If your site shows a “verify you are human” box with instructions like that, your site has been hacked: go to our guide on fake CAPTCHA pages on hacked sites right away.

Before you start

• Access: a login to the Cloudflare account that holds the domain, with permission to edit security settings. If you do not know who has it, our who hosts this site tool confirms the site is on Cloudflare, and the account owner is usually whoever set up DNS.
• From the visitor: a screenshot of the full error page, including the Ray ID printed near the bottom, and their public IP address if the page shows it. Ask for the date and time and their time zone too.
• Dashboard labels: Cloudflare reorganizes its dashboard regularly. The labels below match Cloudflare’s documentation at the time of writing. If yours differ, use the search box in the dashboard.
• Change one thing at a time, and write down what you changed and why. Cloudflare’s audit log records changes, but your own note saves time later.

Step 1: Find the event in Security Events

1. In the Cloudflare dashboard, open the domain, then go to Security > Analytics and choose the Events tab. This is Security Events, the list of requests Cloudflare’s security features acted on.
2. Click Add filter, choose Ray ID (or IP), choose equals, paste the value from the screenshot without quotes, and apply.
3. Set the time range to cover when the block happened. Ray IDs and error pages use UTC; convert to your own time zone when you read the list.
4. Expand the event in Sampled logs. It shows the action (Block, Managed Challenge and so on), the service that acted (for example custom rules, managed rules, rate limiting rules, Bot Fight Mode or Browser Integrity Check), the rule name or ID, the path requested, the user agent and the country.

Things to know: on the Free plan the page shows sampled logs only, and Cloudflare samples busy periods, so a single request may not be listed. Narrow the time window to reduce sampling. Events are kept for up to the last 31 days on every plan. An allowed request matched by an IP Access rule does not appear here at all, by design.

If you cannot find the Ray ID, filter by the visitor’s IP address or by the path they were visiting, such as /wp-login.php, /wp-admin/admin-ajax.php or /checkout/.

Step 2: Decide whether the block was right

Before you change anything, look at what was blocked:

• A real visitor on a normal page (a customer on the shop, a client on the contact form): a false positive. Narrow the rule (Step 3).
• You or your staff in wp-admin: usually a login protection rule, a rate limit or a country rule catching your own address. Allow your address carefully (Step 4).
• A service the site depends on: payment webhooks, an uptime monitor, Jetpack, a backup service, a search console crawler, or WordPress talking to itself. Skip the specific feature for that path or service (Step 5).
• A scanner hammering /wp-login.php or /xmlrpc.php from a country where you have no customers: the rule is doing its job. Leave it alone and tell the visitor nothing, because it was not a visitor.

Step 3: Fix a WAF custom rule or managed rule false positive

If the event names a custom rule, go to the security rules page (Security > Security rules in current documentation), open that rule and read its expression. Common mistakes:

• A country block that also catches customers who travel, or who use a VPN.
• A rule matching /wp-admin that also matches /wp-admin/admin-ajax.php, which many front-end features (filters, carts, forms) call for ordinary visitors.
• A rule using contains on a path fragment that appears in real URLs, such as blocking anything containing admin.
• A user agent rule that blocks real browsers, apps or a payment provider.

Narrow the expression, or change the action from Block to Managed Challenge, which lets a human through after a check while still stopping most automated traffic. A typical safe login rule challenges or blocks the login page for everyone except your own address:

(http.request.uri.path eq "/wp-login.php" and not ip.src in {203.0.113.10})

What it means: match requests whose path is exactly /wp-login.php and whose source address is not 203.0.113.10. Replace that address with your own public IP (our site down only for me guide shows how to find it). Warning: most home and mobile connections change address from time to time. If yours does, use Managed Challenge rather than Block so you can still get in, or use your security plugin’s login protection instead.

If the event names a managed rule (the Cloudflare Managed Ruleset or the OWASP Core Ruleset), the rule is reacting to something in the request body or URL that looks like an attack, often a page builder saving a large layout, a form with code in it, or a long query string. Do not turn the whole ruleset off. Create an exception for that rule ID on the specific path, for example the builder’s save URL in wp-admin, using the exceptions option on the managed rules page.

Step 4: Unblock your own IP address (1006, 1007, 1008, 1005, 1009)

The IP ban errors usually come from an IP Access rule. Look in the IP Access rules list (Cloudflare documents it as one of the WAF tools) for your address, your network’s ASN or your country, with a Block or Challenge action. Delete or edit the entry.

To make sure your office is never blocked, you can add an IP Access rule that allows your fixed public address. Understand what that does first: Cloudflare documents that allowing an IP or ASN bypasses custom rules, rate limiting rules and WAF managed rules for that address. That is fine for a fixed office address you control. It is a bad idea for a mobile network or a shared VPN, where thousands of strangers share the same address. Country blocking with IP Access rules is an Enterprise feature; on other plans, country blocks live in custom rules, and Cloudflare recommends custom rules for IP and country blocking generally.

Step 5: Let WordPress and its services through without switching protection off

Use a custom rule with the Skip action. A skip rule lets matching requests bypass chosen features, such as rate limiting rules, managed rules or Super Bot Fight Mode, while everything else stays protected. Create it from the security rules page with Create rule, choose Skip under the action, and check only the features that were blocking. Typical candidates on a WordPress site:

What breaks	Symptom	What to skip, and for which requests
Payment gateway webhooks	Orders stay in Pending payment even though the customer paid	The webhook path only, for example the gateway’s wc-api URL or REST route. See orders stuck in pending payment
Block editor and REST API	“Updating failed. The response is not a valid JSON response.”	Requests to /wp-json/ from logged-in editors. See the invalid JSON guide
WordPress loopback requests	Site Health reports a failed loopback request; scheduled tasks stop running	Requests from your own server’s IP. See loopback and REST API errors
Uptime monitors and backup services	Monitor alerts that the site is down when it is not	The service’s published IP ranges or user agent
Admin AJAX	Filters, carts, live search or forms stop working for visitors	/wp-admin/admin-ajax.php, if a rule meant for wp-admin caught it

Keep skip rules as narrow as possible: one path, one service, one feature. A skip rule that matches everything is the same as having no protection.

Step 6: Fix Bot Fight Mode, Browser Integrity Check and rate limits

Bot Fight Mode

Bot Fight Mode is Cloudflare’s free bot feature. When it challenges legitimate tools, you have fewer options than with other features: Cloudflare documents that Bot Fight Mode cannot be skipped or bypassed with custom rules or Page Rules, because it runs outside the rules engine. It does not trigger if an IP Access rule matches the request first. If it keeps blocking something you need, the choices are an IP Access allow rule for that service’s addresses, turning Bot Fight Mode off (Security > Settings, filter by Bot traffic), or upgrading to Super Bot Fight Mode on a paid plan, which supports skip rules and has an Optimize for WordPress option that lets your site’s own loopback requests through. Requests it challenges are labeled Bot Fight Mode in the service field of Security Events.

Browser Integrity Check (error 1010)

Browser Integrity Check is on by default. It blocks requests with missing or unusual browser headers, which also catches some legitimate scripts, apps and monitoring tools. To turn it off for the whole site, go to Security > Settings and switch off Browser integrity check. To turn it off only for certain paths, Cloudflare suggests a skip rule or a configuration rule instead, which is the better choice.

Rate limiting (error 1015)

Open the rate limiting rule named in the event and compare its threshold with real use. A rule that allows only a few requests in a very short period catches normal visitors, because one page view loads many files and an office of ten people shares one IP address. Cloudflare’s own advice, if a rule blocks requests in a short period such as one second, is to try a longer period such as ten seconds. Consider counting only the paths you want to protect, such as /wp-login.php, rather than every request.

Under Attack mode and security level

If every visitor gets a challenge, check whether Under Attack Mode was switched on in the domain overview’s quick actions and never switched off. Cloudflare describes it as a last resort during an attack. It affects analytics and can block WordPress loopback requests. Switch it off once the attack has passed, as explained in our guide on traffic floods and DDoS attacks.

Step 7: Test and tell the visitor

1. Ask the visitor to try again in a private window. A cf_clearance cookie from an earlier challenge can linger, and Cloudflare’s default challenge passage is 30 minutes.
2. Watch Security Events for the same IP or path over the next hour to confirm no new blocks appear.
3. Reply to the visitor with a short apology and confirmation. You do not need to explain your security setup.

Prevent the next false positive

• Review Security Events weekly for blocks on real pages (checkout, contact, account pages), not just login and xmlrpc.
• Give every custom rule a clear name that says what it is for, so the event tells you its purpose.
• Start new rules with Managed Challenge rather than Block, and switch to Block once Security Events shows they only catch what you intended.
• Keep a short list of the IP addresses your business really uses, and update rules when your office connection changes.

If none of that worked

If Security Events shows nothing for the Ray ID, check that the visitor’s screenshot really came from your domain and from Cloudflare. A block page from your host’s firewall, a security plugin such as Wordfence, or a company network looks different and usually names its own product: see our 403 Forbidden guide. If you are on a paid plan and still cannot find the cause, open a ticket with Cloudflare from the dashboard and include the Ray ID, the time in UTC and the URL. For a quick reference to Cloudflare’s settings and how each affects WordPress, see the Cloudflare settings cheat sheet. To protect login pages without Cloudflare rules, see stopping brute force attacks, and to reduce bot load at the server, see bots causing high CPU.