Sucuri Website Firewall
CDN and WAF
Also known as: Sucuri, CloudProxy
A cloud firewall common in front of small and mid-sized sites, whose block page names the block reason and carries a support ID for allowlisting.
Sucuri's firewall, historically called CloudProxy, sits in front of a large number of smaller sites, particularly WordPress. Its behaviour is simpler than the enterprise products: mostly address and reputation based, with a clearly branded block page rather than a challenge economy.
Its distinguishing quality is honesty. The block page states that access is denied by the Sucuri Website Firewall, gives a reason, and prints a support ID, which makes it one of the easiest products to diagnose and to appeal.
It blocks broadly on address reputation, so shared address space and VPN endpoints are caught frequently, and the traffic being blocked is often entirely legitimate.
How to identify it
- A block page headed Access Denied with the wording Sucuri Website Firewall.
- An X-Sucuri-ID response header, present on allowed traffic too.
- X-Sucuri-Cache on cached responses.
- A Block reason line and a Your support ID is value in the block body.
Headers
- X-Sucuri-ID: Identifies the Sucuri edge node that handled the request. Appears on normal traffic, so it marks presence rather than a verdict.
- X-Sucuri-Cache: Cache status from the Sucuri edge.
Status codes
403 Access Denied
Blocked. Observed behaviour.
The firewall refused the request and printed the reason and a support ID.
What triggers it
- The address appears on a reputation list, often because of history unrelated to the current user.
- A VPN, proxy, or hosting-provider address range that the firewall treats as risky by default.
- A geographic block, or a signature match on the request.
How to confirm it
- Sucuri Website Firewall in the body, with a Block reason and a support ID.
- X-Sucuri-ID on the response.
What to do about it
- Quote the support ID to the site owner. The Sucuri block page exists to be screenshotted and forwarded, and the owner can add an allowlist entry directly.
- If you reached the site through a VPN or shared egress, that is the most likely single cause and the quickest thing to test.
HTTP/2 403 server: Sucuri/Cloudproxy x-sucuri-id: 17800000000000abcdef content-type: text/html <title>Sucuri WebSite Firewall - Access Denied</title> <h1>Access Denied - Sucuri Website Firewall</h1> <p>Block reason: Your IP address is listed in our blacklist and blocked...</p> <p>Your support ID is: 1234567890123456789</p>
If you run a site behind it
- The default reputation lists are broad. If your audience includes VPN users, remote workers, or anyone on carrier-grade NAT, review your block log before assuming the blocks are all hostile.
- The support ID workflow works well. Make sure whoever answers your contact form knows what to do with one.
If your traffic is being caught by it
- This is one of the few products that tells you exactly why you were blocked, so read the page rather than guessing.
- Blocks are overwhelmingly about the address, not the request.