Identify and disable Cloudflare WAF rules blocking your connection

When a visitor (or your own connection) receives a Cloudflare blocking page, the Ray ID shown at the bottom of that page lets you locate the event that blocked the request in the dashboard. The procedure in this article applies when the event identifies a WAF rule, a rate-limiting rule, or a custom rule. If it identifies another Cloudflare feature, such as Security Level, DDoS Protection, Browser Integrity Check, or Validation Checks, you should modify that specific setting instead of a rule. This article shows you how to do that step by step.

What is the Ray ID and where to find it

Cloudflare assigns a Ray ID to every request that passes through its network. When a rule blocks the request, the Ray ID appears on the blocking page, usually at the bottom, next to text similar to "Sorry, you have been blocked".

Ask the blocked visitor to copy that Ray ID (or send you a screenshot) before closing the page. This identifier is the key to finding the event in your dashboard.

Search for the event by Ray ID

With the Ray ID at hand, go to the Cloudflare dashboard and filter the security events to see which rule caused the block.

1. Go to dash.cloudflare.com and select the affected site.

2. Go to Analytics and open the Events tab (the security events section).

3. Click Add filter.

4. In the first field, select Ray ID; in the second, select equals; then paste the copied Ray ID into the third field.

5. Click Apply.

The filtered event shows you the rule name, the group it belongs to (Managed rules, Custom rules, or Rate limiting), the action applied (for example, Block or Managed Challenge), and the request data that triggered it: source IP, path, and user agent.

Review the context before changing anything

Confirm the cause before modifying a rule: rules can generate false positives, and disabling one entirely can remove protection for other visitors. Review the event's source IP, requested path, and user agent to determine whether the block is legitimate or a false positive.

If the blocked connection comes from a trusted IP or traffic flow, a specific exception is usually preferable to disabling the rule globally.

Resolve the block

Rules are managed under Security rules in the Cloudflare dashboard. You have three alternatives depending on the situation:

• Disable the rule: turn off the entire rule when you are sure it is generating false positives. This is the highest-impact option because it removes that protection for all traffic.

• Create an exception: keep the rule active but skip it for a specific IP, path, or user agent. In Security rules, create a rule with the Skip action and define in the conditions which requests should be skipped.

• Change the action: replace Block with a less restrictive action such as Managed Challenge or Log, so that the request is monitored or challenged instead of blocked.

Record what you changed and why, so that security changes are not forgotten.

If the block does not come from Cloudflare

A 403 error does not by itself identify Cloudflare as the source. Before changing any rules, verify that the blocking page is Cloudflare's page, with its Ray ID at the bottom. If it is not, the block may come from another layer:

• The server firewall (ModSecurity or Imunify), which is managed from cPanel or the server, not from Cloudflare. See ModSecurity 500 error.

• A DNS error such as ERROR 1000, which is resolved by correcting the DNS records rather than disabling a WAF rule.

• Hosting resource exhaustion, with errors such as 503 or 508.

If you cannot reproduce the block, ask the visitor for the Ray ID, the approximate date and time, the affected URL, and the source IP.

How long events are retained

Security events are not stored forever, so it is best to investigate promptly. On the Free and Pro plans, they are retained for up to 24 hours; on Business, up to 3 days; and on Enterprise, up to 30 days. If the filter does not return the expected event, narrow the time window because the data may be sampled.