Cloudflare error 1020: find the rule blocking valid visitors

Cloudflare error 1020 indicates that a security rule denied the request. Start with the blocked request's Ray ID, URL, and time so you can find the matching event and rule.

Cloudflare's troubleshooting instructions recommend searching Security Events by Ray ID or client IP. Match the timestamp and timezone when comparing the error with the event log.

Find out who is blocked

Record whether the error affects all visitors or only a particular country, network, path, or type of request. Include whether the visitor was logged in and when the problem began.

A site that works from your laptop can still block a customer, crawler, or monitoring service. The successful request and failed request may match different rules.

Read the matched rule

Check the event's action and rule expression. Look for conditions broader than intended, such as a country or network restriction, a bot-score condition, or an admin-path rule that also matches a public URL.

Compare the rule with recent changes. Do not assume every access failure comes from the same rule, or that clearing the page cache will change a security decision.

Make the smallest useful change

Narrow the condition that caught valid traffic. Check what else the revised rule would allow before deploying it. A blanket bypass can hide the original problem while removing protection from unrelated requests.

For a crawler incident, verify the crawler's identity. A request with a Googlebot user-agent header does not originate from Google's network and cannot test an IP-based rule by itself.

Retest the failed request

Use the same URL and request conditions that failed before. Then test a normal public visit and the protected traffic the rule is meant to handle.

Confirm the allowed request reaches the correct page, with the expected status and content. Keep the Ray IDs with your incident notes so a later recurrence can be traced to an actual request.