Cloudflare, on a firewall rule the site owner wrote.
Cloudflare error 1020 — Access denied
A WAF rule matched and blocked you outright. Unlike 1015 this is not a counter that resets — it is a rule that says requests like yours are not welcome.
A proxy fixes part of this. Residential IPs clear the ASN-based and country-based variants immediately. The bot-score variant is about your client, not your address, and will follow you across every pool.
Why it happens
The rule blocks your country, your ASN, or datacenter ranges as a class.
A managed rule matched your User-Agent, your header order, or a missing header a real browser always sends.
A bot-score threshold, which fires on TLS fingerprint rather than anything you can see in your own code.
How to fix it
- Change what the rule matches on. If it is the ASN, a residential IP moves you out of the matched range entirely.
- Send a complete browser header set in the right order — order is itself a signal.
- If the score is driven by TLS, no header change helps; you need a client whose handshake matches its User-Agent.
FAQ
What does 1020 mean?›
A WAF rule matched and blocked you outright. Unlike 1015 this is not a counter that resets — it is a rule that says requests like yours are not welcome. Cloudflare, on a firewall rule the site owner wrote.
Why am I getting 1020?›
The rule blocks your country, your ASN, or datacenter ranges as a class. A managed rule matched your User-Agent, your header order, or a missing header a real browser always sends. A bot-score threshold, which fires on TLS fingerprint rather than anything you can see in your own code.
How do I fix 1020?›
Change what the rule matches on. If it is the ASN, a residential IP moves you out of the matched range entirely. Send a complete browser header set in the right order — order is itself a signal. If the score is driven by TLS, no header change helps; you need a client whose handshake matches its User-Agent.
Will a proxy fix 1020?›
Residential IPs clear the ASN-based and country-based variants immediately. The bot-score variant is about your client, not your address, and will follow you across every pool.
Going deeper
Other errors
Stop getting 1020
Residential IPs across 199 countries, from $7.35/GB — no commitment, no monthly plan.
Get residential IPs →