Cloudflare errors can look like WordPress failures even when WordPress is not the system causing the problem. The useful first question is not “Which plugin should I disable?” but “Which layer generated the error?” Cloudflare can stop a request at DNS, routing, security, Workers, Snippets, TLS, or the connection to your origin server before WordPress gets a chance to run.
This guide is a diagnostic map rather than a list of generic fixes. It explains how to identify the error family, what the code usually means, which system to inspect first, and when changing WordPress itself is unlikely to help.
Quick diagnosis
- Record the exact code and Cloudflare Ray ID. Do not troubleshoot from a screenshot that hides the code.
- Check whether Cloudflare generated the error. Cloudflare-generated responses can include diagnostic fields or headers such as
cf-error-typeandcf-error-origin. - Match the code to the layer. DNS, access control, Workers, Snippets, TLS, and origin connectivity require different fixes.
- Change the responsible layer first. Reinstalling WordPress will not fix a Cloudflare DNS record that points to the wrong IP or a Worker that throws an exception.
1xxx errors are not normal HTTP status codes
Cloudflare’s 1xxx codes are Cloudflare-specific error identifiers. They are commonly shown in the error response body, while normal HTTP status codes such as 403, 429, 502, 504, 521, 522, 523, 524, 525, 526, and 530 are returned as HTTP status responses. That distinction matters because the code tells you which Cloudflare subsystem to investigate.
DNS and routing errors
| Code | Meaning / first place to check |
|---|---|
| 1000 | DNS points to a prohibited IP. Check Cloudflare DNS records and make sure an A record is not pointing to a Cloudflare proxy IP or creating a proxy loop. |
| 1001 | DNS resolution error. Check the requested hostname and any CNAME target. |
| 1002 | Cloudflare may report a prohibited or restricted IP condition. Verify the origin target and the exact Cloudflare error text. |
| 1003 | Direct access to a Cloudflare IP is not allowed. Use the hostname rather than browsing to the shared proxy IP. |
| 1004 | Host is not configured to serve web traffic. Check the hostname, zone state, DNS, and Cloudflare configuration. |
| 1014 | CNAME cross-user restriction. Check whether a CNAME points to a hostname managed in another Cloudflare account. |
| 1016 | Origin DNS error. Check whether the origin hostname or CNAME target resolves. |
| 1018 | Cloudflare could not find the host. Confirm the zone and hostname are correctly configured. |
| 1033 | Cloudflare Tunnel / Argo Tunnel connectivity problem. Check that a healthy connector is running and serving the hostname. |
| 1034 | Edge IP restricted. Review the DNS or Cloudflare network configuration instead of WordPress plugins. |
WordPress check: If the request never reaches the origin, WordPress core, themes, and plugins cannot be the first cause. Confirm DNS and Cloudflare routing before changing WordPress.
Access, security, and rate-limit errors
| Code | Meaning / first place to check |
|---|---|
| 1005 | ASN-related access restriction. Inspect Cloudflare access/security rules. |
| 1006 / 1007 / 1008 / 1106 | IP address banned. Check the visitor IP and Cloudflare security configuration. |
| 1009 | Country or region blocked. Review geographic access rules. |
| 1010 | Browser signature blocked. Check browser-integrity or related security controls. |
| 1011 | Hotlinking denied. Review Hotlink Protection and the request referrer. |
| 1012 | Access denied. Use the exact error page and security event details to identify the rule. |
| 1015 | Rate limited. Stop repeated retries and inspect the rate-limit rule, traffic source, and any Retry-After guidance. |
| 1020 | Access denied by a Cloudflare firewall/security rule. Check Security Events for the matching Ray ID. |
| 1025 / 1027 | Usage or rate-limit conditions. Verify the product and account context shown in the Cloudflare message. |
| 1026 | Legal restriction category. This is not normally fixed by changing WordPress. |
Rewrite, header, TLS, and configuration errors
Cloudflare also uses 1xxx codes for request rewrites, headers, TLS, and configuration. These are especially easy to misdiagnose because WordPress may be perfectly healthy at the origin.
- 1035–1037: request rewrite problems. Current Cloudflare documentation identifies 1035 as an invalid request rewrite / URI-path problem, 1036 as a maximum-length rewrite problem, and 1037 as a rewrite expression that could not be evaluated.
- 1040–1041: request-header modification problems. Check Transform Rules and the exact header being changed.
- 1044: TLS-related category. Inspect the client/edge TLS conditions described by the error response.
- 1045: unsupported feature or protocol category.
- 1043 / 1047 / 1049: configuration-related categories in Cloudflare’s structured error taxonomy. Use the exact response text because the required action depends on context.
- 1050: Cloudflare Access Default-Deny can block a hostname that lacks a matching Access application. Check Zero Trust → Access settings and the hostname’s application/policy.
Workers errors
Workers errors happen in Cloudflare’s edge-compute layer. If a Worker fails before forwarding the request, WordPress may never receive the request.
| Code | First check |
|---|---|
| 1042 | Worker-to-Worker / fetch routing context. Inspect Worker routes and fetch logic. |
| 1100 | Worker error category. Use Worker logs and the exact Cloudflare message. |
| 1101 | Worker threw an unhandled exception. Check Worker logs for the exception and stack trace. |
| 1102 | Worker exceeded a resource limit such as CPU or memory. |
| 1103 / 1105 | Worker-category codes can be context-sensitive in Cloudflare documentation. Use the exact product and error message before assuming the fix. |
Important: Some numeric Cloudflare codes can appear in more than one product context. For example, Cloudflare’s domain-add troubleshooting documentation also uses certain codes such as 1105 for zone restrictions. The full message and the Cloudflare product you are using are therefore more reliable than the number alone.
Snippets errors: 1201–1206
Cloudflare documents the Snippets errors separately from ordinary WordPress and origin-server problems.
| Code | Meaning |
|---|---|
| 1201 | A Snippet tried to continue to the origin more than once, such as calling fetch(request) multiple times. |
| 1202 | The Snippet exceeded the subrequest limit. |
| 1203 | The Snippet exceeded the CPU-time limit. |
| 1204 | The Snippet exceeded the memory limit. |
| 1205 | Snippet deployment is still propagating. This is normally temporary. |
| 1206 | The Snippet threw an unhandled JavaScript exception. |
Error 1200 is different from Snippets 1201–1206
Cloudflare Error 1200 is a cache connection limit. It indicates too many requests are queued at Cloudflare’s edge waiting for the origin server. The first checks are origin capacity, connection handling, and cache-hit rate. It is not the same family as the Snippets execution errors 1201–1206.
Cloudflare 5xx origin errors that WordPress owners commonly see
| Code | What it usually points to |
|---|---|
| 521 | Cloudflare cannot establish a working connection to the origin web server. |
| 522 | Connection to the origin timed out. |
| 523 | The origin is unreachable, often because of routing or an incorrect origin IP. |
| 524 | Cloudflare connected to the origin but the origin did not return a response in time. |
| 525 | SSL handshake between Cloudflare and the origin failed. |
| 526 | Cloudflare could not validate the origin SSL certificate in a strict TLS configuration. |
| 530 | A Cloudflare-branded 530 response may accompany an underlying Cloudflare configuration or origin-DNS condition. Read the error page details rather than treating 530 as one universal cause. |
How to prove whether the error is Cloudflare or WordPress
- Capture the failing request. Use browser Developer Tools → Network, or a command-line request if you are comfortable with it.
- Read the response body and headers. Cloudflare-generated errors can expose a Cloudflare Ray ID and diagnostic information.
- Look for
cf-error-typeandcf-error-origin. These headers can identify the error category and which Cloudflare system generated it. - Check Cloudflare Security Events or Worker logs when relevant. A matching Ray ID or timestamp can save a lot of guessing.
- Check the origin only after the edge layer is ruled out. If Cloudflare can reach the origin and the problem is a PHP, database, or WordPress fatal error, then move into WordPress troubleshooting.
What not to do
- Do not reinstall WordPress to fix a DNS record that points to the wrong IP.
- Do not disable every security rule because one legitimate request was blocked; identify the matching rule and create the narrowest safe change.
- Do not keep refreshing a rate-limited endpoint. Respect Retry-After guidance when present.
- Do not assume every 1xxx number has one universal meaning outside its Cloudflare product context. Read the full message.
- Do not change DNS, Workers, SSL mode, and WordPress plugins at the same time. Change one layer, test, then continue.
A practical troubleshooting order
- Record the exact code, message, URL, time, and Ray ID.
- Check Cloudflare’s current documentation for that exact code or product.
- Classify the problem: DNS/routing, security/access, TLS, rewrite/configuration, Worker, Snippet, or origin connectivity.
- Inspect the matching Cloudflare dashboard area.
- Test whether the origin server itself is reachable when appropriate.
- Only then troubleshoot WordPress core, plugins, themes, PHP, database, or hosting resources.
Official references
- Cloudflare: 1xxx errors
- Cloudflare: structured error responses and error categories
- Cloudflare: Snippets errors 1201–1206
- Cloudflare: Error 1200 cache connection limit
- Cloudflare: troubleshooting domains that cannot be added
Bottom line: A Cloudflare-branded error on a WordPress site should be diagnosed by layer. The code, full Cloudflare message, Ray ID, and error category are more useful than a generic checklist. Fix the Cloudflare subsystem that generated the error first; change WordPress only when the evidence points to the origin application.