403 ERROR The request could not be satisfied. Request blocked.
CloudFront refused to serve the request
Seen in AWS CloudFront, AWS WAF
CloudFront itself rejected the request before it reached the origin.
Common causes
- An AWS WAF web ACL rule on the distribution blocked the request.
- Geographic restrictions block the viewer's country.
- The hostname is not listed in the distribution's alternate domain names (CNAMEs).
- The cache behaviour does not allow the HTTP method (e.g. POST when only GET and HEAD are allowed).
How to fix it
- Check AWS WAF sampled requests or logs for the rule that matched.
- Review the distribution's geographic restriction settings.
- Add the hostname to the alternate domain names with a matching certificate.
- Allow the needed methods in the cache behaviour.
Got a different message? Paste it into the error explainer.
Related errors
- 408 Request Timeout · The client took too long to send its request
- 413 Request Entity Too Large · The request body is bigger than the server allows
- 431 Request Header Fields Too Large · The request headers are too big
- 400 Bad Request: Request Header Or Cookie Too Large · nginx rejected oversized headers or cookies
- 499 Client Closed Request · The client gave up before nginx answered
- Error 524: A timeout occurred · Your origin took longer than 100 seconds to respond
- Error 530 · Cloudflare could not reach the origin; see the 1xxx error on the page
- Error 1003: Direct IP access not allowed · A Cloudflare IP was requested without a hostname
- Error 1010: The owner of this website has banned your access based on your browser's signature · Your browser looks like a bot to the site's security settings
- Error 1015: You are being rate limited · You sent too many requests to a Cloudflare site
- Error 1020: Access denied · A Cloudflare firewall rule blocked your request
- Error 1033: Argo Tunnel error · The Cloudflare Tunnel for this hostname is not connected