Cloudflare Error 1006, 1007, 1008: Access Denied - your IP has been banned

What’s actually happening

You get a Cloudflare "Access denied" page with 1006, 1007, or 1008 in the corner instead of the site. It's an outright block — not a CAPTCHA, not a five-second "checking your browser" spinner. The three codes look identical except for the wording and number, but they come from different firewall mechanisms. The ban is tied to your IP (or the country your IP geolocates to), so the same site may load fine from a phone on cellular or a different network.

Common causes

• 1006: the site owner added your specific IP to an IP Access Rule with action Block (a direct, manual or automated IP ban)
• 1007: your IP geolocates to a country the owner blocked with a country/region rule — common for sanctions, licensing, or abuse-heavy regions
• 1008: your request matched a custom WAF/firewall access rule — an IP range (ASN/CIDR), a referer, or a User-Agent the owner chose to ban
• A shared/CGNAT or VPN exit IP that a previous user got banned for, now affecting you
• Automated blocking from the owner's security tooling after it flagged your IP for abuse, scanning, or repeated bad requests

How to fix it

1. Read which of the three codes you got — it tells you the mechanism1006 = your exact IP is banned. 1007 = your country is banned. 1008 = a custom rule (IP range, referer, or UA) caught you. You can't change the fix until you know which one, because only the site owner can lift any of them.
2. If you're a visitor, change your apparent IP/locationFor 1007, connect through a VPN endpoint in an allowed country. For 1006/1008, switch networks (cellular instead of Wi-Fi) or drop the VPN/proxy whose shared IP got banned. Confirm your IP first at a site like ifconfig.me so you know what Cloudflare sees.
3. If you're the legitimate visitor, contact the site owner with your IPOnly the owner can unblock you. Find their support email or a non-Cloudflare contact, give them your public IP and the exact error code, and ask them to remove the rule. There is no Cloudflare-side appeal for a customer's own firewall.
4. If you own the site, find and edit the ruleCloudflare dashboard, Security, WAF, then Tools / IP Access Rules for 1006 and 1008, and the country rule under custom rules for 1007. Search for the visitor's IP or country, then change Block to Allow or delete the rule. Changes take effect within seconds.
5. Rule out the other Cloudflare codes1015 is rate limiting (too many requests, usually temporary), 1020 is a firewall Access Rule / Managed Rule block, and 1010 is a browser-signature ban. If you see those instead, you're in the wrong playbook.