Cloudflare error 1006 reports an IP-related access denial. Identify the failed request and ask the website owner to review its security decision. The owner’s usual connection working does not verify the affected visitor’s access. A Worker Preview failure also needs its own request-source context.
Guide reviewed: October 8, 2026. Interface labels may vary by version, account and device.
Trace the blocked IP decision to the original request
| Context | Evidence | Next step |
|---|---|---|
| Visitor blocked | URL, screenshot, time and Ray ID if shown | Private report to the site owner |
| Owner investigating | Actual security decision and address context | Compare the rule with intended access |
| Shared or changing network | Failed request’s observed address | Review the access arrangement instead of assuming identity |
| Worker Preview only | Preview context and relevant policy | Have the Worker maintainer review its testing source |
A visitor’s report should identify the failed request
Keep the page address, error screenshot, and approximate time. If the screen includes a Ray ID, include it in a private report to the website owner. Describe the ordinary action you were attempting when access was denied.
For example, a customer may be able to read an earlier page but encounter the message when opening the account section. That detail helps the owner review the request’s path and configuration instead of assuming the whole site is unavailable.
The owner may need your public IP address to match the request. Share it privately when requested, rather than posting it with personal information in a public comment. Do not include passwords or session cookies.
Cloudflare cannot override a site’s chosen security settings for a visitor. The access request therefore belongs with the site owner or the administrator responsible for its policy.
The owner needs to establish why the address was blocked
Keep request and person distinct. Note which request was denied, which policy made that decision, and what normal workflow was expected. A shared address can represent multiple users. Review the evidence before deciding whether the match is intentional or needs adjustment.
Review the applicable Cloudflare security configuration and available request evidence. Identify the rule or decision associated with the reported address before changing anything. A blocked visitor’s explanation is useful context, but it is not a replacement for reviewing the actual match.
An IP address is a network identifier, not a complete description of the person using it. Keep that distinction in mind when investigating shared connections or a change of network. A legitimate visitor can report a problem while the site’s administrator still needs to understand the relevant traffic.
Compare the rule’s purpose with the failed workflow. If a broad condition was introduced during troubleshooting, check whether it affects more requests than intended. If the block remains part of an intentional policy, explain that decision through the site’s support channel.
Apply an exception only to a reviewed situation
Cloudflare’s support guidance describes asking the owner to investigate its security settings or allow the client IP where appropriate. Before making an allowance, the administrator should consider its scope, duration, and interaction with other controls.
A narrow adjustment supported by the request evidence is easier to maintain than disabling the site’s protections globally. Keep the original configuration and the reason for the change so that a later review can understand it.
If the address is not stable or the workflow uses a managed integration, discuss a supported access arrangement with the maintainer. Repeatedly adding whatever address happens to appear in a new report can turn a temporary workaround into a confusing policy.
Check a Worker preview separately
Cloudflare documents a special 1006 case in the Workers Preview tab: Zone Lockdown or another security feature can block the Google Cloud Platform IPs used by that preview. A preview failure therefore needs its own context and should not automatically be treated as every public visitor being blocked.
For that case, give the Worker maintainer the preview context, relevant security policy, and failure time. The administrator should review the supported testing arrangement before changing access controls. An ordinary browser test and a Worker preview exercise different request sources.
Verify the original access path after the review
Use the originally affected client and environment, record the test time, and verify the complete action. If access returned only for the owner’s connection, the visitor’s reported issue is still unverified. Compare any reviewed exception with its intended scope.
Retest the address and client environment that originally failed. Confirm the intended content or workflow, and keep the test time with the report. A successful visit from the owner’s usual connection does not verify an exception for the affected address.
If a form or order was involved, confirm the earlier submission status before repeating an important action. Use harmless test data where needed. Restored access does not reveal what happened to an earlier request.
Record the final decision, the evidence behind it, and any exception’s intended scope. This makes the next access review more consistent and helps prevent a temporary fix from remaining indefinitely without a clear purpose.
Reference: Cloudflare IP-ban error documentation.
Keep the final access decision reviewable
Record the policy, evidence, expected workflow and reason for the outcome. Include a review point for temporary adjustments. If the failure involved an earlier form or order, confirm its status before repeating it. A restored page does not establish the outcome of the earlier submission.