Cloudflare blocks your access: how to review WAF rules

When a visitor (or your own connection) receives a Cloudflare block page, the Ray ID shown at the bottom of that page lets you locate the event that blocked the request in the dashboard. The procedure in this article applies when that event identifies a WAF rule, rate limiting rule, or custom rule; if it identifies another Cloudflare feature (such as Security Level, DDoS Protection, Browser Integrity Check, or Validation Checks), you must modify that specific setting instead of a rule. This article shows you how to do so step by step.

What the Ray ID is and where to find it

Cloudflare assigns a Ray ID to every request that passes through its network. When a rule blocks the request, the Ray ID appears on the block page, usually at the bottom, next to text similar to "Sorry, you have been blocked".

Ask the blocked visitor to copy that Ray ID (or send you a screenshot) before closing the page. This identifier is the key to finding the event in your dashboard.

Search for the event by Ray ID

With the Ray ID available, go to the Cloudflare dashboard and filter the security events to see which rule caused the block.

1. Go to dash.cloudflare.com and select the affected site.

2. Go to Analytics and open the Events tab (the security events section).

3. Click Add filter.

4. In the first field, select Ray ID; in the second, select equals; then paste the copied Ray ID into the third field.

5. Click Apply.

The filtered event shows the rule name, the group it belongs to (Managed rules, Custom rules, or Rate limiting), the action applied (for example, Block or Managed Challenge), and the request data that triggered it: source IP, path, and user agent.

Review the context before changing anything

Confirm the cause before modifying a rule: rules can generate false positives, and disabling one completely can remove protection for other visitors. Review the event's source IP, requested path, and user agent to determine whether the block is legitimate or a false positive.

If the blocked connection comes from a trusted IP or workflow, a specific exception is usually preferable to disabling the rule globally.

Resolve the block

Rules are managed under Security rules in the Cloudflare dashboard. You have three options depending on the situation:

• Disable the rule: turn off the entire rule when you are sure it generates false positives. This is the highest-impact option because it removes that protection for all traffic.

• Create an exception: keep the rule active but skip it for a specific IP, path, or user agent. In Security rules, create a rule with the Skip action and define in the conditions which requests should be skipped.

• Change the action: replace Block with a less restrictive action such as Managed Challenge or Log, so that the request is monitored or challenged instead of blocked.

Record what you changed and why so that security changes are not forgotten.

If the block does not come from Cloudflare

A 403 error alone does not identify Cloudflare as the source. Before changing any rules, verify that the block page is a Cloudflare page (with its Ray ID at the bottom). If it is not, the block may come from another layer:

• The server firewall (ModSecurity or Imunify), which is managed from cPanel or the server, not from Cloudflare. See ModSecurity 500 Error.

• A DNS error such as ERROR 1000, which is resolved by correcting the DNS records rather than disabling a WAF rule.

• A hosting resource overload, with errors such as 503 or 508.

If you cannot reproduce the block, ask the visitor for the Ray ID, the approximate date and time, the affected URL, and the source IP.

How long events are retained

Security events are not stored forever, so it is best to investigate promptly. On Free and Pro plans, they are retained for up to 24 hours; on Business, up to 3 days; and on Enterprise, up to 30 days. If the filter does not return the expected event, narrow the time window because the data may be sampled.