The short answer
One of the things websites weigh up when deciding whether to trust a visitor is the public IP address: the address the outside world sees for your home, which every site you visit can read. If that address has been linked with automated traffic (bots, scrapers or malware), a site may ask you to prove you're human, keep asking, or turn you away.
That address isn't always yours alone. A VPN, a school or office network and some providers' shared-address set-ups, known as carrier-grade NAT (CGNAT), put many people behind one address, so someone else's behaviour can land on you. Something on your own network, such as an infected laptop or an automated tool on a home PC, can cause it too. Your browser matters as well: security checks run in it, and settings or extensions can get in their way.
Work through the steps below in order, from solving the check once to contacting the website owner or your provider. Only the website owner can change its own security rules.
What these warnings actually are
Google's 'unusual traffic' page. Google Search Help says you may see 'Our systems have detected unusual traffic from your computer network' when a network you use, including a VPN, seems to be sending automated traffic to Google Search. The page usually shows a reCAPTCHA, Google's free service for protecting sites from spam and abuse. Solving it makes the message go away.
Cloudflare challenges. Cloudflare is a security service that website owners can put in front of their sites, and its 'challenges' are checks that a visitor is a real person rather than a bot. Cloudflare's documentation says most visitors pass automatically, through checks the browser runs in the background, and the rest only need a small action such as ticking a box or pressing a button. It also says it doesn't use picture puzzles or distorted text. So if you're being asked to pick out pictures, that check isn't Cloudflare's.
Outright blocks. Cloudflare's error 1020, 'Access denied', means a security rule the website owner has set blocked your request. It isn't a test you can pass; it needs the site owner to change the rule.
None of these is your broadband provider blocking a site. A provider's filter looks different. Sky, for example, says a site blocked by its Broadband Shield may show a message saying it's been blocked by Sky Broadband Shield, but on a secure (https) site or app you'll just see a blank page or the page may time out. Sky also says Shield doesn't work on a mobile data connection. Providers also block some sites under High Court orders, which Sky says cover sites found to be infringing copyright. Our guide to a website blocked on your broadband covers those, and the same goes for blocks you set up on purpose, such as blocking gambling sites at home.
Why your home connection gets flagged
Google's message is about the network you're on, not about you personally. Google lists four reasons its message can keep coming back, with its own suggested fix for each:
What Google says may be happening | What Google suggests |
|---|---|
You, or another device on your network, has malware | Detect and remove the malware |
Others on the same network, such as a school or business, are sending automated searches | Contact the network administrator |
Others using the same VPN (or IPv6 tunnel service) are sending automated searches | Uninstall the VPN, or contact the VPN provider |
Others using the same internet provider are sending automated searches | Contact your internet provider about the error |
Google counts as automated traffic anything sent by robots, computer programs, automated services and search scrapers, and that includes software that checks how a website ranks on Google. A rank checker running on a home PC can trigger it on its own.
Cloudflare's checks look at more than the address. Its documentation says the browser runs checks on client-side signals, and that some devices and browsers can present a Private Access Token which spares them certain challenges. Which checks a site uses depends on what its owner has switched on: its own firewall rules, rules for particular IP addresses, rate limits (caps on how many requests one address can make in a short time), bot-fighting modes, DDoS protection and an 'Under Attack' mode. Some of these are tied to the address and some aren't, so one site may challenge you every visit while others never do.
Shared addresses: one address, many households
ISPreview, the UK broadband news site, says most providers give home connections a dynamic IP address that isn't shared with other subscribers at the same time. But IPv4, the older address system most of the internet still relies on, ran out of spare addresses long ago, so some providers use CGNAT to share one public address between many customers. As Cloudflare puts it, CGNAT is set up by the provider rather than chosen by you, and people usually don't know they're behind it. VPN users at least know they've switched one on.
The trouble is that many security tools assume one address means one user. Cloudflare's researchers wrote in October 2025 that a single IPv4 address may now stand for hundreds or even thousands of users because of CGNAT, VPNs and proxies, so blocking or throttling the address because of one person's misbehaviour also catches everyone else behind it. The internet's standards body, the IETF, flagged this in 2011 (RFC 6269): a site seeing too many requests from one address may demand a CAPTCHA, and on a shared address one person's failed logins can lock others out.
Cloudflare has measured the effect. Across the addresses it studied, bots made up a similar share of traffic on shared and unshared addresses (a median of 4.8% against 4.7%), yet CGNAT addresses were rate-limited three times as often, which Cloudflare puts down to legitimate traffic from many people tripping websites' bot and firewall rules. That figure is worldwide; we found no UK data on how often households on shared addresses see CAPTCHAs. The same Cloudflare post quotes a 2015 Ofcom report: if a shared IPv4 address is blocked or blacklisted as a source of spam, "the impact on a CGNAT would be greater, potentially affecting an entire subscriber base".
Which providers share addresses? ISPreview says it's less of a problem with bigger, established providers, most of which hold plenty of spare IPv4 addresses. We only name a provider where its own pages say so: toob, for example, says on its static IP page that it offers broadband using CG-NAT as standard, and sells a static IP, a fixed address that it says isn't shared publicly, doesn't change and bypasses its CG-NAT set-up (see toob broadband deals). CGNAT has an upside too: Cloudflare notes that the translated addresses can't be reached directly from the internet, which protects home devices that might be vulnerable. How to check whether you're behind it, and what a static IP or IPv6 involves, is in our guide to CGNAT, static IP and IPv6.
VPNs, tunnels and the VPN you forgot about
A VPN (virtual private network) sends your traffic through another company's server, so websites see that server's address, shared with everyone else using it. Google says others on the same VPN can trigger its unusual-traffic page, and that some VPNs and IPv6 tunnel services get all their traffic blocked, because Google can't tell the abusive traffic from the rest.
Cloudflare adds two wrinkles. Some networks, including certain VPNs, can't supply a Private Access Token, a behind-the-scenes signal that can spare a visitor some challenges, so those visitors get a standard challenge instead. And a challenge issued to one IP address but solved from another doesn't count, which can cause a loop: if the address a site sees changes between showing you a check and you solving it, expect to be asked again.
Check for a VPN you didn't knowingly switch on. Netflix warns that a VPN can arrive bundled with antivirus software and be switched on without you realising, and the fast.com check in our VPN guide shows in a minute whether your connection looks as if it's elsewhere. Our guides to using a VPN on home broadband and why sites think your broadband is elsewhere go further.
Something on your own network or browser
Malware. Google lists it first, and Cloudflare also suggests a scan. Spamhaus, an organisation that publishes IP blocklists, puts the addresses of hijacked devices on its Exploits Blocklist (XBL). It says the infected device is usually a computer or phone behind the router, and sometimes the router itself. Its advice for a listed home address is to secure and update the router, keep operating systems patched, check browser toolbars, extensions and plug-ins for anything you don't recognise, look out for 'free' VPNs or other heavily monetised apps, and consider calling your provider. It adds that an address is listed again if the problem isn't fixed.
The browser. Cloudflare says challenge loops (a check that keeps coming back) happen in very specific cases where it detects strong bot signals, and lists these causes: an unstable connection, browser settings or extensions blocking its scripts, an unsupported browser, JavaScript switched off, and detection errors. It also says it can't support extensions that change your browser's User-Agent (the label your browser sends to identify itself) or features such as Canvas and WebGL, and that antivirus or firewall software can sometimes block the files a challenge needs.
Step-by-step: fixing it at home
Retry the site after each step, so you know which one fixed it.
- Solve the check once, properly. Tick the box or finish the challenge. With reCAPTCHA, if a puzzle is too hard, press reload for another; audio challenges are available and it works with major screen readers. Google says the verification expires after a while.
- Update the browser and turn on JavaScript and cookies. Cloudflare says you need both for any of its challenges, and that all major browsers except Internet Explorer are supported. reCAPTCHA supports the two most recent major versions of Chrome, Firefox, Safari and the Chromium-based Microsoft Edge on computers, and Chrome, Safari and the Android browser on mobiles.
- Switch off VPNs and proxies. That includes a VPN inside your antivirus suite, a browser extension and any VPN set up on the router.
- Rule out the browser. Try a private (incognito) window, then disable extensions, starting with ad blockers, then try another browser or device. Check your antivirus or firewall isn't blocking the challenge.
- Try another network. Cloudflare suggests a mobile hotspot. If the site works on mobile data but not on your Wi-Fi, the clue points to your home connection's address or something on your home network. If it fails on that device everywhere, look at the device.
- Check every device for malware. The National Cyber Security Centre (NCSC) says an antivirus scan is the easiest way to confirm an infection on a PC or laptop. Warning signs include slowness, unexpected restarts, unknown pop-ups and contacts getting odd emails from you. Phones and tablets usually can't be cleaned the same way; the NCSC says a factory reset is the safest fix. Update the router's software too. If your provider has already warned you, follow our guide on what to do when your provider says a device is infected.
- Stop automated tools. Rank checkers, scrapers and scripts that send searches automatically count as automated traffic to Google. Google says that once the automated searches stop, you should be able to search normally.
- Contact the right people. If one website still blocks you, go to its owner. If several sites challenge you on every device at home, talk to your provider. Both are covered below.
If the site is slow as well as suspicious of you, it's worth checking your line on our broadband speed test; our guide to why one website is slow on your broadband covers problems that affect a single site.
Reading the clues
A quick way to read the pattern, based on Google's and Cloudflare's guidance. Treat it as a rule of thumb, not a diagnosis.
What you see | Where to look first |
|---|---|
Google's unusual-traffic page once, gone after the reCAPTCHA | Nothing more, unless it comes back |
It comes back daily with no VPN on | Malware or an automated tool at home, then an address shared with others |
A Cloudflare check loops in one browser but not another | That browser's settings and extensions |
Checks loop on every device at home but not on a mobile hotspot | Your home network and its address |
Error 1020, 'Access denied' | The website owner's rules |
Asking the website owner to let you in
Cloudflare is clear that its employees can't remove a challenge; only the website owner can change the settings that show it. It suggests asking the owner to allow your IP address. If a challenge keeps looping after you've tried the steps above, Cloudflare says to contact the website administrator with the error code and Ray ID (a reference that lets the owner find your request), or to use Submit Feedback if the check offers it. For error 1020, it says to send the owner a screenshot; the owner can then search its security log by Ray ID or by your IP address, see which rule blocked you and change it.
If a reCAPTCHA checkbox never appears at all, Google says some sites have set reCAPTCHA up incorrectly, and the fix is to contact the site's webmaster.
In a short message to the site's support team, include:
- the page address and the date and time it happened;
- a screenshot showing the error code and Ray ID, if there is one;
- whether it happens on other devices and on mobile data;
- what you've already tried (VPN off, updated browser, extensions off).
One caution: most home addresses are dynamic and can change, so an allowance tied to your current address may stop working later.
What to ask your broadband provider
Google tells internet providers, VPN providers and network administrators to find and block the sources of automated traffic on their networks, and says to contact your provider when other customers of the same provider are the cause. Spamhaus also says calling your provider may help if your address is listed. Your provider can't change a website's rules, but it can look at the address.
When you contact them, have ready the sites involved, the exact wording of the messages, the dates and times, what you've already tried, and the IP address the outside world sees (Netflix's help pages say fast.com shows it next to Client). Then ask:
- Is my connection on a shared (CGNAT) address, or does my router get its own public IPv4 address?
- Is IPv6 available on my package, and is it switched on? ISPreview says IPv6 support reduces the downsides of CGNAT.
- Can I have a dedicated or static IP address, and on what terms?
- Has my connection been flagged for unusual traffic, or is my address on a blocklist such as Spamhaus's?
Be realistic: none of the sources we checked says a static IP or IPv6 will stop websites challenging you; each site still sets its own rules. A static address isn't shared with other customers, but nothing we found says it starts with a clean record: Google tells network operators buying blocks of addresses to check first that they have no existing blocks.
Be wary of anyone who contacts you about this: the NCSC warns that an unexpected call saying your device is infected is a common scam. Contact your provider through its own app, website or the number on your bill, and see our guide to broadband scam calls and emails for how to spot and report them.
Could switching provider help?
Sometimes. If the tests point to a shared address and challenges get in the way of sites you rely on, a provider that gives your router its own public address, or offers IPv6 or a static IP, may be worth a look. It's not a guaranteed cure: websites decide their own rules, and only their owners can change them.
Before you sign, check the provider's help and add-on pages for 'CGNAT', 'static IP', 'public IP' or 'IPv6', and ask in writing (web chat or email) so you have the answer on record. Our broadband providers page links to the provider pages on this site. Once you've a shortlist of providers whose answers suit you, compare deals at your postcode: our partner's comparison shows live deals, not providers' IP address policies, and you order with the provider you choose. We don't switch you ourselves.
Website challenges and blocks FAQs
Why does Google keep saying it has detected unusual traffic from my network?
Google shows it when a network you use, including a VPN, seems to be sending automated traffic. If it keeps returning, Google lists four causes: malware on a device on your network, others on the same network (such as a school or business), others on the same VPN or IPv6 tunnel, and others on the same internet provider. Solve the reCAPTCHA, switch off any VPN, scan your devices, then contact your provider.
Is my broadband provider blocking the website, or is the website blocking me?
Look at what the block looks like. A provider's filter is set on its network: Sky, for example, says its Broadband Shield may show a blocked message, shows a blank page or times out on secure (https) sites, and doesn't work on mobile data. A tick-box human check, Google's unusual-traffic page or Cloudflare's error 1020 comes from the website or its security service, which weighs your IP address and your browser. Those need the steps in this guide or the website owner, not a change to your filter settings.
Can my broadband provider remove a Cloudflare challenge?
No. Cloudflare says even its own employees can't remove a challenge: only the website owner can change the settings that show it. Your provider can only help with your address, for example by telling you whether it's shared. If a challenge keeps looping, contact the website's administrator with the error code and Ray ID shown on the page.
Can a VPN cause endless CAPTCHAs?
Yes. A VPN gives you its server's address, shared with other users, and Google says others on the same VPN can trigger its unusual-traffic page; some VPNs get all their traffic blocked. Cloudflare suggests switching VPNs off to test. Check your antivirus suite too: Netflix notes some include a VPN that might be on.
What does Cloudflare error 1020 'Access denied' mean?
Cloudflare says error 1020 means a security rule set by the website owner blocked your request. It isn't a puzzle you can solve or something your broadband provider controls. Send the website owner a screenshot of the error: Cloudflare says the owner can search its security log by the Ray ID or your IP address, find the rule that blocked you and update it.
