Cloudflare Error 1015 (You Are Being Rate Limited): Causes and Fixes

Seeing 1015 tells you that whoever runs the site instructed Cloudflare to ration requests per client over some stretch of seconds or minutes, and your browser or script spent its ration too quickly. Cloudflare then answers with a page headed You are being rate limited, normally carrying HTTP status 429, until a cooldown chosen by the owner runs out. Cloudflare itself does not pick the numbers, so the fix is either to send fewer requests, wait, or talk to the people who run the site.

Many articles on this error drift into tricks for slipping past the limit. This one does not. It explains how Cloudflare's rate limiting rules count requests, what a visitor can legitimately do, how developers and data teams should pace automated traffic, and how site owners can tune rules that punish real users by mistake.

Reading the Block Page

The block page contains three useful details: the error code 1015, the domain you tried to reach, and a Ray ID at the bottom. The Ray ID is a unique identifier of your request in Cloudflare's logs, and the site owner can look it up to see which rule fired. Copy it before closing the tab.

Do not confuse 1015 with neighbouring codes. Error 1020 means a firewall rule denied access outright, 1010 points to a blocked browser signature, and a 5xx code with Cloudflare branding signals trouble on the origin server, for example the situation described in our article on the HTTP 503 error.

Inside a Rate Limiting Rule

Owners assemble such a rule out of a handful of building blocks; knowing them makes nearly every 1015 story easy to decode.

Two consequences follow. First, if the counter is keyed by IP address, everyone sharing your address shares your allowance: a whole office, a university dorm or thousands of mobile users behind one carrier gateway. Second, the cooldown can be anything from seconds to a day, and hammering the page while blocked keeps feeding the counter.

Fixes for Regular Visitors

1. Stop refreshing. Close the tab and come back after several minutes. Cloudflare's own guidance warns that repeated attempts can extend the block.
2. Close duplicate tabs and pause heavy extensions. Link prefetchers, auto-refresh add-ons and price trackers can fire dozens of requests in the background.
3. Check for shared addresses. On a crowded VPN, office network or public Wi-Fi, your quota is pooled with strangers. Reloading later from your usual home or mobile connection is reasonable, but rapidly switching addresses to outrun the rule is exactly what it is designed to stop.
4. Patch the faulty app. A phone app stuck in a retry loop may quietly fire the same call hundreds of times each minute; updating or reinstalling it usually ends that.
5. Write to the people behind the site. Should ordinary browsing keep tripping the wall, give their support desk the Ray ID, the moment it happened and roughly where you are. Changing the rule is entirely in their hands.

Advice for Coders, Crawlers and Integrations

Automated clients cause most 1015 errors, and the right response is to behave like a polite guest. Collecting public data is a legitimate activity when done within the site's terms; our guide on reducing the risk of blocks during scraping covers the broader picture.

Respect 429 and Retry-After

Treat 429 as an instruction, not a hurdle. When the response contains a Retry-After header, wait at least that long. When it does not, back off exponentially with some random jitter and cap the number of retries:

import random, time

def polite_get(session, url, attempts=5):
    pause = 2
    for _ in range(attempts):
        reply = session.get(url, timeout=30)
        if reply.status_code != 429:
            return reply
        hint = reply.headers.get("Retry-After")
        delay = int(hint) if hint and hint.isdigit() else pause + random.uniform(0, 1)
        time.sleep(delay)
        pause *= 2
    raise RuntimeError(f"still limited after {attempts} tries: {url}")

Lower Concurrency and Spread Requests Over Time

Ten parallel workers each sending one request per second add up to 600 requests a minute from one client. Set a global ceiling for the whole crawler, not per worker, and schedule large jobs for off-peak hours of the target's time zone.

Request Less

Cache responses you already have, use conditional requests with If-Modified-Since or ETag so unchanged pages return a short 304, and skip images, fonts and scripts you do not need. Many sites offer an official API, a sitemap or bulk exports that give the same data at a fraction of the load.

Ask for Access

For legitimate high-volume needs, write to the site owner. Explain what you collect and why, include a contact address in your User-Agent string and ask for a higher quota, an API key or allowlisting. An allowlist entry is easiest to grant for a fixed address, which is where a dedicated IP from our static proxies helps: the owner sees one predictable source instead of a stream of changing addresses.

Never Fan Out Identities to Dodge the Cap

Splitting the same traffic across many IP addresses so that each stays under the threshold defeats the owner's intent, often breaches the site's terms and tends to trigger stricter bot defences. Spread load in time, not across identities. Our overview of website parsing errors shows how such escalations usually end.

Fixes for Site Owners

If your own visitors or integrations hit 1015, the rule is probably too tight or keyed on the wrong thing.

Find the Rule That Fired

Search your Cloudflare security events for the Ray ID the user sent you. The entry names the rule, the matched path and the characteristics used for counting.

Tune Thresholds and Windows

Cloudflare's documentation notes that very short windows cause false positives and recommends lengthening a one-second period to about ten seconds. Look at real traffic before setting a number, and prefer a managed challenge over a hard block for pages people browse.

Count by the Right Key

Counting by plain IP punishes users behind carrier gateways and corporate networks. Where your plan allows it, use IP with NAT support, a session cookie or an API key header so each real client gets its own counter.

Exclude What Should Not Count

Leave static assets and cached responses out of the rule, exempt your uptime monitors and payment webhooks, and allow verified search engine crawlers. Test new rules with the Log action for a few days before switching them to Block.

Check Your Own Code

Single-page apps that poll an endpoint every second, a mobile release with a retry loop or a misconfigured cron job can push your own customers over the limit. Fix the client first, then revisit the threshold.

Another 1015 variant, shown as Unable to purge, concerns cache purges in the dashboard and usually goes away on retry; contact Cloudflare support if it persists.