Sorry, You Have Been Blocked

What the block page tells you

Cloudflare sorts its visitor-facing pages by cause. Its reference of error page types describes the WAF block page as the page visitors see when a Web Application Firewall rule blocks them, sent with status 403. Blocks from IP Access rules use numbered “Access denied” pages instead, such as 1006 for a banned IP address and 1005 for a banned network (ASN). Cloudflare’s error 1020 page adds that WAF custom and managed rules return the block page rather than 1020, which now comes from other features that block without a custom response, such as API Shield. So the wording on the screen already narrows the cause to the site’s firewall rules.

Owners can replace the default page. Cloudflare’s custom rules guide lets a rule with the Block action return its own HTML, text, JSON or XML with any 4xx status, 403 by default, on Pro plans and above. If you see a branded message with no Ray ID, the site wrote it, and the advice below still applies.

The page often also says the action you performed triggered the security solution and that submitting certain words, a SQL command or malformed data can cause it. That is a hint that a rule inspecting request content matched, not proof that you did anything wrong.

Reading the Ray ID

Every request through Cloudflare carries a Ray ID, and the block page prints it at the bottom. The site owner can use it to find the matching event and see which rule acted. Cloudflare notes that a Ray ID can repeat, so send the time and hostname with it.

Timing matters. Cloudflare’s Security Events documentation says events are kept for 31 days on all plans and that busy sites may see sampled data, so not every event appears in the list. A report sent the same day is far easier to match than one sent a month later.

A report that an owner can act on:

Page: https://example.com/contact
Time: 2026-10-30 09:42 UTC
Message: Sorry, you have been blocked
Ray ID: copied from the bottom of the page
What I did: submitted the contact form with a code snippet in it
Browser: name and version

This is an illustrative format. Send your public IP privately if the owner asks for it.

What usually triggers it

Most blocks fall into a few groups. Cloudflare’s managed rules protect against common attack techniques, and its OWASP-based ruleset adds a score for each rule that matches a request, acting when the total crosses a threshold. Cloudflare itself notes that large request bodies give the rules more to match, which can push an ordinary request over the line.

Getting access back

As a visitor. Reload once. If the block came after submitting a form, retry without the unusual content, such as code, markup or very long text. Try a clean browser profile with extensions off, then another network you are allowed to use; if one of these works, tell the owner what differed. Then contact the site through another channel with the Ray ID and time. Cloudflare does not handle visitor appeals for a customer’s rules.

As the site owner. Search Security Events for the time and client IP, open the event and note the rule and its action. Narrow the fix to the verified case: an exception for one path, one parameter or one managed rule, rather than turning the WAF off. Keep in mind that some Cloudflare features sit outside custom rules. Its Bot Fight Mode documentation says that feature cannot be skipped with WAF custom rules; only an IP Access rule that matches first prevents it from acting.

If you see other codes. Rate limiting shows error 1015 and challenge loops show a repeating check rather than a block page. The deeper Cloudflare troubleshooting guide covers 1020, 1015 and challenge loops, and IP-ban diagnosis helps when the block is not Cloudflare’s.

For proxy and automation users

A rule on network or reputation treats every user of an address alike. If you arrive from a VPN exit, a hosting range or a busy shared address, test once from a different connection to see whether the rule is network-based. If it is, the owner’s rule is the policy; respect it, or ask for access.

For permitted automation, the reliable route is the site’s API or an allowlist agreed with the owner. Through mobile proxies, the exit is a carrier address used by one customer at a time on Coronium lines, but a rule that blocks your client type, your request content or your request rate will block it just the same. Slow down, keep each session on one address, and stop when you see the block instead of retrying. Changing the address to keep going after a deliberate block works against the owner’s intent and usually ends in a broader rule.

Frequently asked questions