Geonode logo
Website blocks

How to Fix Akamai Access Denied With a Reference Number

Learn whether your connection or a site rule set it off, and what to send the site's team.

Updated

Get residential proxiesCheck your proxy

TL;DR

Access Denied with a Reference # means an Akamai server delivering the website refused your request under security rules the site's owner controls. Turn off any VPN or proxy and reload once; if the block stays, send the full reference number to the site's support team.

What Akamai Access Denied looks like

Browsers show the page with its reference line. Scripts get Akamai's default status, 403, unless the owner picked another code.

WhereWhat you see
Page heading, verbatim from the sample in Microsoft KB 4492050Access Denied
Page text, verbatim from the same Microsoft sampleYou don't have permission to access http://www.microsoft.com on this server.
Reference line, verbatim from the same Microsoft sampleReference #18.85c5d617.1549635923.277a7a1
Reference line in Akamai's Translate Error String exampleReference #9.6f64d440.1318965461.2f2b078
curl with --fail (local 403 test)curl: (22) The requested URL returned error: 403
Python urllib (local 403 test)urllib.error.HTTPError: HTTP Error 403: Forbidden
Node.js fetch, status and statusText (local 403 test)403 Forbidden

Why this happens

The site's security rules on Akamai turned your request away before it reached the site.

Owners write those rules around IP addresses, countries, paths and cookies; Microsoft adds that its Akamai-hosted sites block addresses that connect too often. On a VPN or office network, many people share one address.

Diagnose your Akamai Access Denied first

Each check points at this browser, your network or a rule on the site.

  • Open the page in a private window or another browser on the same Wi-Fi; if it is refused there too, the rule matches your address.

  • Look for a line starting Reference #; if present, Akamai's edge answered, not the site's own web server.

  • Open What is my IP; if it shows a country you are not in, a VPN or proxy exit is likely in the path.

  • Open the site's home page; if only one section is refused, a rule covers that path rather than your whole connection.

  • At work or school, ask IT whether a tool polls the site; if one does, its frequent connections can set off the block.

Solutions ranked by effectiveness

Visitors need the first two cards; the third is for the team that runs the site.

  1. Most common fix

    Turn off the VPN or proxy

    Applies when a VPN app, proxy extension or system proxy sits between you and the site. Owners can block whole countries, and Akamai reputation profiles can target shared IP addresses.

    1. Disconnect the VPN or pause the proxy extension, then reload the page once.

    2. Clear any manual proxy under your system's network settings.

    3. Keep it off here; the site is judging the shared VPN address, not you.

  2. Check next

    Send the reference number to the site

    Applies when the page stays blocked with nothing in the way. Owners look the code up in Akamai's tools and can change the rule.

    1. Copy the whole Reference # line exactly, every dot and letter included.

    2. Add the page address, the date, the time and your time zone.

    3. Send it the same day through the site's contact form or support email.

  3. Site owners

    Translate the reference in Edge Diagnostics

    If you run the site, the code leads to that request's edge logs, available for only the last 6 or 24 hours, so translate it soon.

    1. In Control Center, open Test & troubleshoot > Edge Diagnostics > Translate Error String.

    2. Enter the code in lowercase with its #, up to 10 at a time.

    3. Check Reason for failure and WAF details, then adjust the rule that matched.

    4. For scripted lookups, call POST /error-translator in the Edge Diagnostics API.

Stop the Akamai Access Denied from coming back

For offices, shared networks and the teams that run sites on Akamai.

  1. IT teams: lengthen the interval of connectivity probes that test public Akamai sites.

  2. Stop download managers and scripts opening many connections to one site at once.

  3. Owners: verify each IP/Geo Firewall block; Akamai warns it is easy to block wanted traffic by accident.

  4. Owners: send the Global Request Number as a response header, so every request has a code to translate.

  5. Owners: keep the reference ID on custom deny pages, with a contact address beside it.

Check your own IP/Geo FirewallLoad your Akamai site from a residential IP in each country you allow.
Try residential proxies

Related errors

Learn more

FAQ

An Akamai edge server, the layer that delivers the site's pages, turned the request down on the owner's instructions. The number identifies that single request in Akamai's logs.

Take any VPN or proxy out of the path first. If the refusal stays without one, write to the site with the reference line, page address and time.

Akamai's docs don't say what each dotted part encodes. They say the owner's Edge Diagnostics tool turns the code into the client IP, URL, date and reason for failure.

Akamai's docs give no fixed length, and each site sets its own rules. Microsoft expects blocks from too many connections to lift once volume stays low for a while; longer bans are covered in our IP ban guide.

The owner's Akamai rules refused it, so stop rather than retry. Send the owner the Reference # from the response body, and keep to their API, robots.txt and terms.

Usually. Akamai's default deny status is 403, though owners can set any code from 100 to 999. A 403 with no Reference # line is covered in our 403 Forbidden guide.

Tell proxy errors from Akamai's

Geonode's docs explain each proxy status code, like 465 when a location has no proxies.

Try residential proxies