"Sorry, you have been blocked" is Cloudflare's block page. The site you opened runs behind Cloudflare, and a security rule written by the site owner matched your request, so Cloudflare refused it. Only the owner can lift the block. To get back in, remove whatever matched (the text you submitted, your VPN, your network) or email the owner the Ray ID.
What does "Sorry, you have been blocked" mean?
The page means a site's security rule matched your request and Cloudflare carried out the owner's chosen action: Block. On a live block page we checked in October 2026, the browser tab read "Attention Required! | Cloudflare", the response was HTTP 403, and the page said:
- "You are unable to access" followed by the site name.
- "The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data."
- A footer with "Cloudflare Ray ID", a "Your IP: Click to reveal" link, and "Performance & security by Cloudflare".
Cloudflare's rules actions reference defines Block as "Matching requests are denied access to the site". Most security features return a 403 with that action. Rate limiting rules return a 429. Paid plans can customize the page, so some sites show their own design over the same block.
Cloudflare is not judging you as a person, and it has no appeal form for visitors. The owner wrote the rule that matched, and only the owner can change it.
How is the block page different from "Verify you are human" and Error 1020?
Cloudflare shows three pages that look alike. They lead to different next steps.
| Sorry, you have been blocked | Verify you are human | Error 1020 Access denied | |
|---|---|---|---|
| What it is | A rule matched and the action was Block | A challenge the site asks you to pass | A firewall rule denied access |
| Can you clear it yourself? | Only by changing what matched | Usually, by passing the check | Only by changing what matched |
| What the owner needs | Ray ID and what you were doing | Nothing, unless the check loops | A screenshot of the 1020 page |
A challenge is something you can pass. If the checkbox keeps coming back, see the Verify you are human loop. Error 1020 works the same way as the block page but looks different. Cloudflare's 1020 documentation says it means "access to the website is denied by a Cloudflare firewall rule" and tells visitors to "provide the website owner with a screenshot of the 1020 error message".
Why was I blocked by Cloudflare?
You were blocked because something about your request matched a rule the owner configured. Test the likely causes in the order below. Each test is cheaper than the next.
-
What you just submitted. If the block appeared right after you sent a form, search, comment or upload, the content is the first suspect. Web application firewall rules match SQL fragments, script tags, certain words, and malformed data such as pasted code or odd characters. Go back, retry the same action with plain text, and see whether the page loads.
-
Your VPN or proxy. VPN exit IPs are shared by many strangers, and some of them misbehave. OpenAI's help article on this exact error names VPN usage and an IP from a high-risk location as causes. Click "Your IP: Click to reveal" on the block page. If the address shown is not your home connection, your VPN or proxy is still routing the traffic.
-
A datacenter or hosting network. Owners can block whole networks. Cloudflare IP Access rules match by "IP address, range, country, or ASN", and hosting providers' ASNs are a common target. Office networks, cloud desktops and some corporate gateways exit from ranges that look like hosting. Check how your current IP reads:
What does your IP reveal right now?
To see whether the same address sits on spam or abuse lists, run it through the IP Blacklist Checker.
-
Your country. The same IP Access rules can block a whole country. If you are travelling, or your VPN exits abroad, the site may simply not accept traffic from where you appear to be.
-
Request rate. Rapid reloads, many open tabs, or an extension that prefetches pages can trip a rate limiting rule. A 429 instead of a 403 points to rate limiting. Stop for a while and retry once. Cloudflare does not publish a fixed block length, because the owner sets it.
-
Automation. Scripts, headless browsers and bots get matched by rules that target non-browser traffic. If that is you, skip to the last section.
How do I get back in as a visitor?
Work through these steps in order:
- Retry without the text you submitted. Strip code, special characters and pasted content, then send it again.
- Turn off the VPN or proxy, and disable any browser extension that routes traffic. Reload the page.
- Run the two-network test. Open the same URL on mobile data with Wi-Fi off. If the page loads on mobile data but not on your usual connection, the rule most likely matched your IP or network. If it fails on both, the cause is more likely your request or your browser, or a country rule that covers both networks.
- Email the site owner. Include the Ray ID, the time, and what you were doing when the page appeared, which is exactly what the block page asks for.
Mobile data often clears an IP-based block. Carrier IPs sit behind carrier-grade NAT and are shared with that carrier's ordinary subscribers, so sites block them less readily than a datacenter range. A mobile IP still gets no exemption: a rule that matches your submission or your country will block you on any network.
Clearing cookies or switching browsers does not change your IP address. Those steps rarely help when the rule matched your network.
What should the site owner do with the Ray ID?
The owner should search the Ray ID in the domain's Security Events log. Cloudflare describes a Ray ID as "an identifier given to every request that goes through Cloudflare". The matching event shows which rule fired, and usually what it matched on, such as the IP, ASN, country or path. From there the owner can narrow the rule, add an allow rule for a known visitor, or change the action from Block to a challenge so real users can get through.
If you are the owner and blocked yourself
Open the event for your own Ray ID before you disable anything. A rule that matches your office ASN or a form field will also match your customers.
What if you hit the block from a scraper or script?
A block page in your crawler logs means the site's rules recognised your traffic pattern, usually by IP type, request rate or browser signals. Slow down, send one request per page you actually need, honour the site's terms, and ask the owner for access if the data is central to your work. For how Cloudflare's challenge layer scores automated browsers, read how Turnstile evaluates automated traffic. For choosing an exit network for legitimate collection of public data, see mobile proxies for web scraping.
Why is my browser blocked on one site but not others?
The block is tied to one site's security rules. Each site behind Cloudflare writes its own, so a VPN exit, country or form input that one owner blocks can be fine everywhere else.
How do I unblock my browser from Cloudflare?
Your browser is not blocked as such. A request matched a rule. Retry without the text you submitted, turn off any VPN or proxy, or try another network such as mobile data. If none of that works, email the site owner the Ray ID.
Can Cloudflare unblock me?
No. Cloudflare has no appeal form for visitors. The site owner wrote the rule, and only the owner can change it by looking up your Ray ID in their Security Events log.
How long does a Cloudflare block last?
The owner decides. A rate limiting rule blocks for a period the owner sets, so it clears when that period passes, and OpenAI's help center suggests waiting out a temporary block. Rules on an IP, ASN or country stay in place until the owner changes them.
Does the block page mean my account is banned?
Not necessarily. The block happens at Cloudflare, before the site processes your login, so it concerns the request, not the account. An account ban on the site itself shows a different message.
See how your IP reads before you blame the site
VoidMob: mobile proxies on real 4G/5G devices, non-VoIP SMS verification and eSIM. Every exit sits on a consumer carrier connection behind CGNAT.