Cloudflare Error 1020: Access denied

A 1020 is short and final. There is nothing to click and nothing that clears by itself: the request matched a block.

Reloading will not help: a 1020 is a decision, not a test. Something in your request matched a block that the owner of the site set up. It can be the address or network you came from, your country, the browser or an extension that changed the request, or the page you asked for.

• Turn off the VPN or proxy, or switch between Wi-Fi and mobile data, and open the page again.
• Use a normal window of an up-to-date browser with extensions paused.
• Open the site from its home page rather than from a saved link or a form you had left open.
• If the error stays, take a screenshot of it with the Ray ID and send it to the site's support. This is Cloudflare's own advice: the owner can look the Ray ID up and see which rule blocked you.

For a script, a 1020 says the request itself was refused by a rule. No challenge was offered, so there is nothing for a browser to solve, and the same request gets the same answer.

• The address: a rule that blocks hosting networks or whole countries refuses the request whatever the client is.
• The client: a request that does not look like the browser it names, in its headers or in what it asks for, can match a block.
• The call: on API routes, features such as schema validation and JWT validation refuse calls that lack the shape or the token the API expects. Only a valid call changes that.
• The path: admin, login and internal routes are often closed to everyone outside a list. Those stay closed.

The whole picture of the system is in the guide: How to Bypass Cloudflare When Scraping.

When the refusal is about where the request came from or what sent it, a different request gets a different answer. Send the URL to the REST endpoint: it leaves from a residential or mobile IP in the country you choose, with a browser-grade client, and a refused attempt is retried on a fresh exit.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

Set country to a country the site serves. If the answer still comes back with blocked: true and blockClass: "access_denied", the rule is about the page or the call itself, and no exit changes it.

What the answer tells you

In the canary of 11 November 2026, all 9 calls to Cloudflare-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.