Cloudflare Error 1015: You Are Being Rate Limited
What Cloudflare error 1015 means, how it differs from 1020 and a 429, what triggers it, and how to respond without escalating to a longer ban.
Error 1015 is Cloudflare's rate limit response. It means you sent more requests than the site's configured rule allows in a given window — not that you were identified as a bot, and not that you are banned.
1. What It Means
The site owner configured a rate limiting rule, and your requests exceeded it.
- Origin: Cloudflare's edge, not the site's application. The origin server never saw the blocked requests.
- Configured by: the site owner, per path or per zone. The thresholds are theirs, not Cloudflare's.
- Duration: temporary, from seconds to hours depending on the rule.
- Keyed on: usually your IP address, sometimes a session or an API token.
The important part is that it is mechanical and temporary. A counter exceeded a threshold; when the window passes, it resets.
2. How It Differs From Its Neighbours
| Error | Meaning | Clears on its own |
|---|---|---|
| 1015 | Rate limited — too many requests | Yes |
| 1020 | Firewall rule denied you | No |
| 1010 | Browser signature rejected | No |
| 1006/1007/1008 | IP banned | No |
| 429 | Standard HTTP rate limit | Yes |
| 503 + challenge | Under attack mode | On solving |
Confusing 1015 with 1020 is the expensive mistake and it goes both ways. Waiting out a 1020 accomplishes nothing — it is a rule about who you are, and time does not change that. Aggressively rotating IPs to defeat a 1015 converts a two-minute pause into a firewall rule that does not expire.
3. What Triggers It
- Request rate. The direct cause — too many in the window.
- Concurrency. Many parallel workers sharing one exit IP hit a per-IP limit collectively, even when each is polite.
- Shared addresses. Office NAT, a VPN exit, or a datacenter IP used by others. The traffic that tripped the limit may not be yours.
- Retry storms. A failure that triggers immediate retries multiplies the load that caused it.
- Expensive endpoints. Search and filter paths often carry much tighter limits than static pages.
4. How to Respond
Stop immediately. Continuing to send requests during a 1015 keeps the counter hot and, on some configurations, extends the window.
Wait, then resume slower. Check for a Retry-After header — if it is present, it is the exact answer. Otherwise back off exponentially with jitter. Without jitter, every parallel worker retries in lockstep and re-creates the burst.
Reduce concurrency first, not delay. If eight workers share one IP, the per-IP rate is eight times what any single worker sees. Halving workers usually helps more than doubling the per-request delay.
Check whether you need the requests at all. Caching responses during development, and avoiding re-fetching unchanged pages, often removes the problem rather than pacing it.
Distribute properly if volume is genuinely required. More exit addresses spread a legitimate load. Doing this reactively, the moment you are limited, reads as evasion — and evasion is what turns a 1015 into a 1020.
5. Diagnosing It
curl -sI https://example.com/path | head -20
Look for the status code, Retry-After, and cf-ray. The cf-ray value identifies the request at Cloudflare's edge and is what a site administrator needs if you contact them.
If you own the site, the rule lives under Security → WAF → Rate limiting rules, and the Security Events log shows exactly which rule fired and on which key.
6. If You Own the Site
- Check the rule's key. Limiting by IP punishes shared connections. Limiting by session or token is fairer where you can.
- Exempt what should be exempt. Verified search crawlers, your own monitoring, known partners.
- Scope by path. A global limit tuned for a search endpoint will throttle static pages needlessly.
- Read the events before tightening. Legitimate traffic tripping a rule is common, and the symptom looks identical to abuse.
7. Real-World Examples
- A scraper limited at ten workers and fine at three, with the same total delay — concurrency was the variable, not pacing.
- An office of thirty people rate limited collectively behind one NAT address.
- A two-minute 1015 becoming a permanent 1020, after the client started rotating IPs to get around it.
- A monitoring job tripping a search-path rule it had no reason to be hitting, after a redirect sent it there.
- A retry loop that never resolved, because each retry refreshed the window it was waiting out.
8. Summary
Cloudflare error 1015 is a rate limit: a site-owner-configured threshold was exceeded, the edge refused the request, and the origin never saw it. It is temporary and mechanical, and it clears on its own.
The correct response is to stop, honour Retry-After where present or back off exponentially with jitter, and resume with lower concurrency — concurrency is more often the cause than per-request delay, because a per-IP limit counts every worker sharing that IP.
Keep it distinct from 1020 and the ban codes, which do not clear with time. And resist rotating addresses to push through it: a temporary throttle answered with evasion is how a two-minute pause becomes a firewall rule.