cloudflare · ngayerie · May 14, 2025 · May 13, 2025 · May 13, 2025
@@ -0,0 +1,25 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1000
+source: null
+---
+
+## Error 1000: DNS points to prohibited IP
+
+This error indicates that a Cloudflare DNS record points to a prohibited IP, blocking access to the requested domain.
+
+### Common causes
+
+Cloudflare halted the request for one of the following reasons:
+
+- An A record within your Cloudflare DNS app points to a [Cloudflare IP address](https://www.cloudflare.com/ips/), or a Load Balancer Origin points to a proxied record.
+- Your Cloudflare DNS A or CNAME record references another reverse proxy (such as an nginx web server that uses the proxy_pass function) that then proxies the request to Cloudflare a second time.
+- The request `X-Forwarded-For` header is longer than 100 characters.
+- The request includes two `X-Forwarded-For` headers.
+- The request includes a `CF-Connecting-IP` header.
+- A Server Name Indication (SNI) issue or mismatch at the origin.
+
+### Resolution
+
+- If an A record within your Cloudflare DNS app points to a [Cloudflare IP address](https://www.cloudflare.com/ips/), update the IP address to your origin web server IP address. Reach out to your hosting provider if you need help obtaining the origin IP address.
+- There is a reverse-proxy at your origin that sends the request back through the Cloudflare proxy. Instead of using a reverse-proxy, contact your hosting provider or site administrator to configure an HTTP redirect at your origin.
@@ -0,0 +1,25 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1001
+source: null
+---
+
+## Error 1001: DNS resolution error
+
+This error indicates a DNS resolution failure preventing access to the requested domain.
+
+### Common causes
+
+- A web request was sent to a Cloudflare IP address for a non-existent Cloudflare domain.
+- An external domain that is not on using Cloudflare has a CNAME record to a domain active on Cloudflare
+- The target of the DNS CNAME record does not resolve.
+- A CNAME record in your Cloudflare DNS app requires resolution via a DNS provider that is currently offline.
+- [Always Online](/cache/how-to/always-online/) is enabled for a [Custom Hostname (Cloudflare for SaaS)](/cloudflare-for-platforms/cloudflare-for-saas/) domain.
+
+### Resolution
+
+A non-Cloudflare domain cannot CNAME to a Cloudflare domain, unless the non-Cloudflare domain is added to a Cloudflare account.
+
+Attempting to directly access DNS records used for [Cloudflare CNAME setups](/dns/zone-setups/partial-setup) also causes error 1001. For example, `www.example.com.cdn.cloudflare.net`.
+
+Disable [Always Online](/cache/how-to/always-online/#enable-always-online), if using [Custom Hostname (Cloudflare for SaaS)](/cloudflare-for-platforms/cloudflare-for-saas/) domain.
@@ -0,0 +1,47 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1002 
+source: null
+---
+
+## Error 1002: DNS points to Prohibited IP
+
+This error indicates that a Cloudflare DNS record points to a prohibited IP, preventing proper domain resolution.
+
+### Common causes
+
+- A DNS record in your Cloudflare DNS app points to one of [Cloudflare's IP addresses](https://www.cloudflare.com/ips/).
+- An incorrect target is specified for a CNAME record in your Cloudflare DNS app.
+- Your domain is not on Cloudflare but has a CNAME that refers to a Cloudflare domain.
+
+### Resolution
+
+Update your Cloudflare A or CNAME record to point to your origin IP address instead of a Cloudflare IP address:
+
+1. Contact your hosting provider to confirm your origin IP address or CNAME record target.
+2. Log in to your Cloudflare account.
+3. Select the domain that generates error 1002.
+4. Select the **DNS** app.
+5. Click **Value** for the A record to update.
+6. Update the A record.
+
+To ensure your origin web server does not proxy its own requests through Cloudflare, configure your origin webserver to resolve your Cloudflare domain to:
+
+- The internal NAT'd IP address, or
+- The public IP address of the origin web server.
+
+## Error 1002: Restricted
+
+This error indicates that the domain resolves to a restricted or disallowed IP address.
+
+### Common cause
+
+The Cloudflare domain resolves to a local or disallowed IP address or an IP address not associated with the domain.
+
+### Resolution
+
+If you own the website:
+
+1. Confirm your origin web server IP addresses with your hosting provider,
+2. Log in to your Cloudflare account, and
+3. Update the A records in the Cloudflare DNS app to the IP address confirmed by your hosting provider.
@@ -0,0 +1,17 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1003
+source: null
+---
+
+## Error 1003 Access Denied: Direct IP Access Not Allowed
+
+This error indicates that direct access to a Cloudflare IP address is not allowed.
+
+### Common cause
+
+A client or browser directly accesses a [Cloudflare IP address](https://www.cloudflare.com/ips).
+
+### Resolution
+
+Browse to the website domain name in your URL instead of the Cloudflare IP address.
@@ -0,0 +1,19 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1004
+source: null
+---
+
+## Error 1004: Host Not Configured to Serve Web Traffic
+
+This error indicates that the host is not configured to serve web traffic.
+
+### Common causes
+
+- Cloudflare staff disabled proxying for the domain due to abuse or terms of service violations.
+- DNS changes have not yet propagated or the site owner's DNS A records point to [Cloudflare IP addresses](https://www.cloudflare.com/ips).
+
+### Resolution
+
+If the issue persists beyond five minutes, [contact Cloudflare Support](/support/contacting-cloudflare-support/).
+
@@ -0,0 +1,28 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1005
+source: null
+---
+
+## Errors 1005 Access Denied: Autonomous System Number (ASN) banned
+
+This error indicates that access to the website is denied due to the banning of the Autonomous System Number (ASN).
+
+### Common causes
+
+The owner of the website (for example, `example.com`) has banned the autonomous system number (ASN) from accessing the website.
+
+### Resolution
+
+If you are not the website owner, provide the website owner with a screenshot of the 1005 error message you received.
+
+If you are the website owner:
+
+1. Retrieve a screenshot of the `1005` error from your customer
+2. Search the [**Security Events log**](/waf/analytics/security-events/) (available at **Security** > **Events**) for the **RayID**, or client IP Address from the visitor's 1005 error message.
+
+:::note
+Convert the UTC timestamp of the `1005` error to your local timezone when searching in the **Security Events log**.
+:::
+
+3. Assess the cause of the block and ensure the ASN is allowed under the [IP Access Rules](/waf/tools/ip-access-rules/) security feature.
@@ -0,0 +1,22 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1006, 1007, 1008 or 1106
+source: null
+---
+
+## Errors 1006, 1007, 1008 or 1106 Access Denied: Your IP address has been banned
+
+This error indicates that access is denied because your IP address has been banned.
+
+### Common causes
+
+A Cloudflare customer blocked traffic from your client or browser.
+
+:::note
+
+Error 1006 also occurs in the Cloudflare **Workers** app under the **Preview** tab when a customer uses **[Zone Lockdown](/waf/tools/zone-lockdown/)** or any other Cloudflare security feature to block the Google Cloud Platform IPs that the **Preview** tab relies upon.
+:::
+
+### Resolution
+
+Request the website owner to investigate their Cloudflare security settings or allow your client IP address. Since the website owner blocked your request, Cloudflare support cannot override a customer's security settings.
@@ -0,0 +1,18 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1009
+source: null
+---
+
+## Errors 1009 Access Denied: Country or region banned
+
+This error indicates that access to the website is denied from your country or region.
+
+### Common causes
+
+The owner of the website (for example, `example.com`) has banned the country or region your IP address from accessing the website.
+
+### Resolution
+
+Ensure your IP address is allowed under the [IP Access Rules](/waf/tools/ip-access-rules/) security feature.
+
@@ -0,0 +1,21 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1010
+source: null
+---
+
+## Error 1010: The owner of this website has banned your access based on your browser's signature
+
+This error indicates that access to the website is denied based on your browser's signature.
+
+### Common cause
+
+A website owner blocked your request based on your client's web browser.
+
+### Resolution
+
+Notify the website owner of the blocking. If you cannot determine how to contact the website owner, lookup contact information for the domain via the [Whois database](https://lookup.icann.org/). Site owners disable **Browser** **Integrity Check** via the **Settings** tab of the **Security** app.
+
+:::note
+Since the website owner performed the blocking, Cloudflare support cannot override a customer's security settings.
+:::
@@ -0,0 +1,21 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1011
+source: null
+---
+
+## Error 1011: Access Denied (Hotlinking Denied)
+
+This error indicates that access to the resource is denied due to hotlinking protection.
+
+### Common cause
+
+A request is made for a resource that uses [Cloudflare hotlink protection](/waf/tools/scrape-shield/hotlink-protection/).
+
+### Resolution
+
+Notify the website owner of the blocking. If you cannot determine how to contact the website owner, lookup contact information for the domain via the [Whois database](https://lookup.icann.org/). **Hotlink Protection** is managed via the Cloudflare **Scrape Shield** app.
+
+:::note
+Since the website owner performed the blocking, Cloudflare support cannot override a customer's security settings.
+:::
@@ -0,0 +1,21 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1012
+source: null
+---
+
+## Error 1012: Access Denied
+
+This error indicates that access to the website is denied.
+
+### Common cause
+
+A website owner forbids access based on malicious activity detected from the visitor's computer or network (ip_address). The most likely cause is a virus or malware infection on the visitor's computer.
+
+### Resolution
+
+Update your antivirus software and run a full system scan. Cloudflare can not override the security settings the site owner has set for the domain. To request website access, contact the site owner to allow your IP address. If you cannot determine how to contact the website owner, lookup contact information for the domain via the [Whois database](https://lookup.icann.org/).
+
+:::note
+Since the website owner performed the blocking, Cloudflare support cannot override a customer's security settings.
+:::
@@ -0,0 +1,28 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1013
+source: null
+---
+
+import { GlossaryTooltip } from "~/components";
+
+## Error 1013: HTTP hostname and TLS SNI hostname mismatch
+
+This error indicates a mismatch between the HTTP hostname and the TLS SNI hostname.
+
+### Common cause
+
+The hostname sent by the client or browser via <GlossaryTooltip term="Server Name Indication (SNI)">Server Name Indication (SNI)</GlossaryTooltip> does not match the request host header.
+
+### Resolution
+
+Error `1013` is commonly caused by the following:
+
+- Your local browser setting the incorrect SNI host header, or
+- A network proxying SSL traffic caused a mismatch between SNI and the Host header of the request.
+
+Test for an SNI mismatch via an online tool, such as [SSL Shopper](https://www.sslshopper.com/ssl-checker.html).
+
+Provide Cloudflare Support the following information:
+
+- A [HAR file](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/) captured while duplicating the error.
@@ -0,0 +1,24 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1014
+source: null
+---
+
+## Error 1014: CNAME Cross-User Banned
+
+This error indicates that a CNAME record between domains in different Cloudflare accounts is prohibited.
+
+### Common cause
+
+By default, Cloudflare prohibits a DNS CNAME record between domains in different Cloudflare accounts. CNAME records are permitted within a domain ([`www.example.com`](http://www.example.com) CNAME to `api.example.com`) and across zones within the same user account ([`www.example.com`](http://www.example.com) CNAME to [`www.example.net`](http://www.example.net)) or using our [Cloudflare for SaaS](https://www.cloudflare.com/saas/) solution.
+
+Another common cause is connecting a custom domain to an R2 bucket, where the domain is an active zone with the [zone hold](/fundamentals/setup/account/account-security/zone-holds/) feature enabled.
+
+:::caution
+[Cloudflare Apps](https://www.cloudflare.com/apps/) are not currently supported by [Cloudflare for SaaS](/cloudflare-for-platforms/cloudflare-for-saas/), therefore any app using a domain configured on our SaaS solution may produce 1014 errors.
+:::
+
+### Resolution
+
+- To allow CNAME record resolution to a domain in a different Cloudflare account, the domain owner of the CNAME target must use [Cloudflare for SaaS](/cloudflare-for-platforms/cloudflare-for-saas/).
+- To allow connecting to a R2 bucket with a custom domain, disable the [zone hold](/fundamentals/setup/account/account-security/zone-holds/) feature on the custom domain target zone to resolve the 1014 error.
@@ -0,0 +1,27 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1015
+source: null
+---
+
+## Error 1015: You are being rate limited
+
+This error indicates that you are being rate limited by the website.
+
+### Common cause
+
+The site owner implemented [Rate Limiting](/waf/reference/legacy/old-rate-limiting/) that affects your visitor traffic.
+
+:::note
+_Unable to purge_ is another `1015` error code relating to [Cloudflare cache purge](/cache/how-to/purge-cache). Retry the cache purge and contact [Cloudflare support](/support/contacting-cloudflare-support/) if errors persist.
+:::
+
+### Resolution
+
+- If you are a site visitor, contact the site owner to request exclusion of your IP from rate limiting.
+- If you are the site owner, review [Cloudflare Rate Limiting thresholds](/waf/reference/legacy/old-rate-limiting/) and adjust your Rate Limiting configuration.
+- If your Rate Limiting blocks requests in a short time period (for example, one second) try increasing the time period to 10 seconds.
+
+:::note
+If you expect a new Cloudflare Worker to exceed rate limits, refer to the [Workers documentation](/workers platform/limits) for guidance.
+:::
@@ -0,0 +1,28 @@
+---
+pcx_content_type: troubleshooting
+title: Error 1016
+source: null
+---
+
+## Error 1016: Origin DNS error
+
+This error indicates that Cloudflare cannot resolve the origin web server's IP address.
+
+### Common cause
+
+Common causes for error `1016` are:
+
+- A missing DNS A record that mentions origin IP address.
+- A CNAME record in the Cloudflare DNS points to an unresolvable external domain.
+- The origin hostnames (CNAMEs) in your Cloudflare [Load Balancer](/load-balancing/) default, region, and fallback pools are unresolvable. Use a fallback pool configured with an origin IP as a backup in case all other pools are unavailable.
+- When creating a Spectrum app with a CNAME origin, you need first to create a CNAME on the Cloudflare DNS side that points to the origin. Please see [Spectrum CNAME origins](/spectrum/get-started/#create-a-spectrum-application-using-a-cname-record) for more details.
+- There is no DNS record for the hostname in the Cloudflare for SaaS target zone.
+- There is no DNS record for the hostname in the target [Partial (CNAME) setup zone](/dns/zone-setups/partial-setup/) of a Workers subrequest ([Fetch API](/workers/runtime-apis/fetch/)).
+
+### Resolution
+
+To resolve error `1016`:
+
+1. Verify your Cloudflare DNS settings include an A record that points to a valid IP address that resolves via a [DNS lookup tool](https://dnschecker.org/).
+2. For a CNAME record pointing to a different domain, ensure that the target domain resolves via a [DNS lookup tool](https://dnschecker.org/).
+3. For a Workers subrequest to a Partial (CNAME) setup zone, ensure that the hostname exists on the Cloudflare zone (and not only at the authoritative DNS)