Cloudflare blocks your access: how to review WAF rules

When a visitor (or your own connection) receives a Cloudflare block page, the Ray ID shown at the bottom of the page lets you find the event that blocked the request in the dashboard. This article’s procedure applies when the event identifies a WAF rule, a rate limiting rule, or a custom rule. If it identifies another Cloudflare feature (such as Security Level, DDoS Protection, Browser Integrity Check, or Validation Checks), you need to change that specific setting instead of a rule. This article shows you how to do that step by step.

What the Ray ID is and where to find it

Cloudflare assigns a Ray ID to every request that passes through its network. When a rule blocks a request, the Ray ID appears on the block page, usually at the bottom, next to text similar to "Sorry, you have been blocked".

Ask the blocked visitor to copy the Ray ID (or send you a screenshot) before closing the page. This identifier is the key to finding the event in your dashboard.

Search for the event by Ray ID

Once you have the Ray ID, go to the Cloudflare dashboard and filter the security events to see which rule caused the block.

1. Go to dash.cloudflare.com and select the affected site.

2. Go to Analytics and open the Events tab (the security events section).

3. Click Add filter.

4. In the first field, select Ray ID; in the second, select equals; then paste the copied Ray ID into the third field.

5. Click Apply.

The filtered event shows the rule name, the group it belongs to (Managed rules, Custom rules, or Rate limiting), the action taken (for example, Block or Managed Challenge), and the request details that triggered it: source IP, path, and user agent.

Review the context before changing anything

Confirm the cause before changing a rule: rules can generate false positives, and disabling one entirely can remove protection for other visitors. Review the event’s source IP, requested path, and user agent to decide whether the block is legitimate or a false positive.

If the blocked connection comes from a trusted IP or a trusted workflow, a specific exception is usually preferable to disabling the rule globally.

Resolve the block

Rules are managed under Security rules in the Cloudflare dashboard. Depending on the situation, you have three options:

• Disable the rule: Turn off the entire rule when you’re sure it’s generating false positives. This option has the greatest impact because it removes that protection for all traffic.

• Create an exception: Keep the rule active but skip it for a specific IP, path, or user agent. In Security rules, create a rule with the Skip action and specify in the conditions which requests should be skipped.

• Change the action: Replace Block with a less restrictive action, such as Managed Challenge or Log, so the request is monitored or challenged instead of blocked.

Record what you changed and why, so security changes aren’t forgotten.

If the block doesn’t come from Cloudflare

A 403 error alone doesn’t identify Cloudflare as the source. Before changing any rules, verify that the block page is Cloudflare’s (with its Ray ID at the bottom). If it isn’t, the block may come from another layer:

• The server firewall (ModSecurity or Imunify), which is managed from cPanel or the server, not Cloudflare. See ModSecurity 500 error.

• A DNS error such as ERROR 1000, which is resolved by correcting the DNS records, not by disabling a WAF rule.

• Hosting resource exhaustion, with errors such as 503 or 508.

If you can’t reproduce the block, ask the visitor for the Ray ID, the approximate date and time, the affected URL, and the source IP.

How long events are retained

Security events aren’t kept forever, so it’s best to investigate promptly. They’re retained for up to 24 hours on Free and Pro plans, up to 3 days on Business, and up to 30 days on Enterprise. If the filter doesn’t return the expected event, narrow the time range because the data may be sampled.