This error indicates that a Cloudflare security feature configured by the website owner blocked the request. Cloudflare returns it with an HTTP 403 status code.
A security rule with a Block action matched the request, and the rule has no custom response configured. For example, API Shield schema validation and JWT validation can block requests with a 1020 error.
Requests blocked by WAF custom rules or WAF managed rules do not get a 1020 error. These requests get the WAF block response instead. For details, refer to Different error page for blocked requests.
If you are not the website owner, provide the website owner with a screenshot of the 1020 error message you received.
If you are the website owner:
-
Retrieve a screenshot of the 1020 error from your customer.
-
Search the Security Events log (available at Security > Analytics, in the Events tab) for the Ray ID or client IP address from the visitor's 1020 error message. The event shows which security feature and rule blocked the request.
Go to Analytics ↗ -
Assess the cause of the block and update the configuration of the security feature or rule that blocked the request.
To customize the 1020 error page that visitors receive, refer to the custom error rule example for 1020 errors.