Cloudflare Error 1012: Access Denied

What the error means

According to the Cloudflare documentation, error 1012 means access to the site is denied: the site owner blocks it because of malicious activity detected from the visitor's computer or network. Cloudflare names a virus or malware on the device as the most likely cause.

Through a proxy, the “network” for the site is the proxy's exit IP. The pool is shared, so the activity that triggered the rule may have been linked to the address before you.

As with other 10xx errors, Cloudflare does not override the site owner's security settings. Only the owner can open access.

Causes

• Malware on your device. It can send requests without your knowledge, and the site sees them together with yours.
• Suspicious activity from the exit IP. The rule may have been triggered for the address by requests made from it earlier.
• An overly aggressive program. Many parallel requests to a site can look like an attack to its protection.
• A browser extension with unwanted behavior. Some extensions make background requests to sites.

How to fix it

1. Update your antivirus and run a full system scan: this is the first step Cloudflare recommends.
2. Check your browser extensions and turn off those you did not install or do not use.
3. Reduce the number of threads and the request rate to this site.
4. Check which address the site sees: My IP.
5. If you need access, write to the site owner with the Ray ID from the error text. You can find the owner's contacts through the domain's Whois.

How to check that it works

After checking your device, open the site in a regular browser. If the error remains while other sites work through the same proxy, the decision is up to the site owner. If access is restored, do not immediately return to the previous rate and number of threads: the rule may be triggered again.

Two-minute diagnosis

First paste the line into the proxy checker. If the proxy works there, the cause is in your app or its settings. If not, test the line from a terminal:

curl -v -x "http://USERNAME:PASSWORD@gw.prokso.com:823" https://api.ipify.org

• A < HTTP/1.1 407 line right after CONNECT means the proxy answered. The name after the code, for example NO_USER, points to the cause.
• The proxy answered CONNECT with 200 and then another code arrived - the proxy works, and that answer came from the website.
• No answer at all, only a timeout - the connection never reached the proxy: check the host, port and network.