Quick Answer
Cloudflare Error 1015 means a website's rate-limit rule temporarily blocked requests; it is not a Hypertext Transfer Protocol (HTTP) status. There is no universal duration, so visitors should stop refreshing, follow retry guidance, and wait before one controlled attempt. Site owners should use the Ray ID and Security Events to find and tune the matching rule.
Key Takeaways
- Error 1015 means rate limiting: A Cloudflare rule has restricted requests after its configured limit was exceeded.
- The duration is not universal: A fixed mitigation timeout can range from 10 seconds to one day. Available values depend on the plan and action.
- Repeated retries can make matters worse: Cloudflare advises visitors to wait instead of refreshing the blocked page repeatedly.
- Counters can use more than an Internet Protocol (IP) address: Cookies, headers, and paths can also define buckets.
- Site owners should trace the matching rule: Ray IDs, request details, Security Events, and logs can reveal the cause.
- Error 1015 is not a 429 status: Error 1015 appears in the body. The 429 code is a standard response status.
- Changing networks is unreliable: It helps only when the route alters a characteristic used by the matching rule.
How Is Cloudflare Error 1015 Different From HTTP 429 and Error 1020?
Cloudflare Error 1015 identifies Cloudflare rate limiting, HTTP 429 is a standard status, and Error 1020 identifies a firewall denial. Each response requires a different first check.
The three responses point to different troubleshooting paths. Error 1015 appears as a Cloudflare code in the response body, while a default rate-limit block usually returns HTTP 429. A custom rate-limit block can use another 400–499 status, so read the status and body together.
| Response | What it identifies | Where to look | Correct first response |
|---|---|---|---|
| Cloudflare Error 1015 | A Cloudflare rate-limiting rule restricted the request | Error page body, Ray ID, and Security Events | Stop retries or inspect the matching rule |
| HTTP 429 | A server or intermediary says too many requests arrived | HTTP status and any Retry-After header | Back off and follow the supplied retry time |
| Cloudflare Error 1020 | A Cloudflare firewall rule denied access | Error page, Ray ID, and Security Events | Inspect the access rule rather than rate limits |
Error 1020 means a Cloudflare firewall rule denied access, so changing a rate-limit threshold will not resolve it. Check the response body, status, Ray ID, and Security Events before changing any configuration. The broader guide to proxy error codes separates rate limiting from authentication, connection, and destination failures.
What Does Cloudflare Error 1015 Mean?
Cloudflare Error 1015 means a website's rate-limiting rule has restricted a request after its configured limit was exceeded. The usual error page says, "You are being rate limited."
Cloudflare's Error 1015 guidance explains that the website owner sets the rule. Cloudflare applies that customer's configuration; it does not choose which individual visitors should be blocked.
A rule first matches defined traffic, such as requests to a login path. Cloudflare then counts matching requests with the same configured characteristics during a chosen period. The selected action applies to further requests when that counter reaches the configured rate.
The selected action can block, challenge, or log matching traffic, depending on the plan and configuration. Its behavior can use a fixed duration or throttle requests above the limit.
The counting characteristic is not always the visitor's IP address. Depending on the plan, a rule can use an IP address, cookie, header, path, country, or another supported value. This detail explains why changing one part of a request may not remove the restriction.
By default, Cloudflare 1xxx error codes appear in the Hypertext Markup Language (HTML) response body. They are not HTTP status codes themselves. Compatible clients can request structured details when site customizations do not override them.
How Long Does Cloudflare Error 1015 Last?
Cloudflare Error 1015 has no universal duration because each rate-limit rule controls its mitigation timeout or throttling behavior. A fixed timeout applies for a set period, while throttling acts only on requests above the maximum rate.
Cloudflare's rate-limiting parameter reference lists Application Programming Interface (API) timeout values from 10 to 86,400 seconds. Those values represent 10 seconds through one day. The available choices vary by plan and action.
A zero-second timeout does not mean an instant block. In Cloudflare's API, zero selects throttling behavior for supported actions. Throttling applies the action only to requests above the configured maximum instead of enforcing one fixed cooldown.
Three settings are easy to confuse:
| Rule setting | What it controls | Example meaning |
|---|---|---|
| Request threshold | How many counted requests are allowed | Allow 20 matching requests |
| Counting period | The window used to calculate the request rate | Count those requests over 60 seconds |
| Mitigation timeout | How long the selected action remains active | Block matching requests for 10 minutes |
Cloudflare's error-response reference assigns the default Error 1015 response a 30-second Retry-After value. A rule-specific dynamic value takes precedence when present. This value guides the next attempt; it does not redefine the configured mitigation timeout.
A browser page may not display this response header. Visitors should follow visible instructions, and developers should inspect the response directly. If the request remains blocked, stop the triggering traffic and contact the website owner.
Do not treat 30 seconds as a universal block duration. A site's fixed timeout can be longer, and throttling has no single cooldown. After the supplied wait, make one controlled attempt instead of restoring full traffic.
Cloudflare warns that repeated attempts within a short period may extend the restriction. Immediate refreshes also create new requests, even when the page still shows the same message. Closing duplicate tabs and pausing automated tools prevents accidental retries during the wait.
What Usually Triggers Cloudflare Error 1015?
Cloudflare Error 1015 appears when traffic matching a rate-limit rule reaches its configured request threshold within the counting period. The trigger can come from ordinary browsing, automation, shared networks, or an overly broad rule.
One page load can generate several requests for documents, scripts, images, and API calls. Repeated refreshes can therefore reach a limit faster than the visible page count suggests. Several open tabs or an auto-refresh extension can multiply that traffic.
Common visitor and application triggers include:
- Refreshing a product, login, booking, or checkout page repeatedly
- Opening several tabs that poll the same service
- Running a monitoring extension with a short interval
- Sending concurrent API or crawler requests without a target-specific limit
- Retrying failed requests immediately or at several application layers
- Sharing an IP address with other active users when the rule counts by IP
The website's configuration can also create false positives. A threshold may be too low for normal traffic, or a match expression may cover more paths than intended. A shared IP counter can group unrelated users behind one office, carrier, or virtual private network (VPN) gateway.
Cloudflare can count requests using IP with Network Address Translation (NAT) support. That option relies partly on the _cfuvid cookie to distinguish visitors behind a shared address. Clearing cookies can place those visitors into one shared counter bucket, so it is not a universal repair.
Some Cloudflare Workers subrequests can count separately and trigger a rule sooner than expected. Site owners should inspect the complete request path, including cached assets and internal subrequests. The trigger reflects the rule's scope, threshold, period, characteristics, and matching traffic.
How Can a Visitor Fix Cloudflare Error 1015?
Visitors fix Cloudflare Error 1015 by stopping the triggering requests and allowing the site's configured restriction to clear. Only the website owner can change the matching rate-limit rule.
Use this sequence without adding more traffic than necessary:
- Stop refreshing: Leave the blocked page alone instead of testing it every few seconds. Repeated attempts may extend the restriction.
- Pause automatic requests: Disable auto-refresh extensions, monitoring tools, scripts, and duplicate tabs that may continue in the background.
- Wait for the site: Follow any displayed retry time or Retry-After value. When no time appears, wait before making one controlled attempt.
- Record the evidence: Save the exact page, time, screenshot, and Ray ID when the page displays one. Do not include account secrets.
- Contact the website owner: Send the evidence through the site's official support channel. Contact them if one controlled retry still fails after any supplied wait.
Restarting the browser does not clear an IP-based timeout. Clearing cookies also cannot remove a counter based only on the IP address. With IP with NAT support, removing the identification cookie can even reduce Cloudflare's ability to separate shared users.
Changing a Domain Name System (DNS) resolver does not reduce requests already sent or change the website's rate-limit rule. Disabling certificate checks or other browser protections does not reduce the request rate. Those changes add risk without addressing the rule.
A different network may produce a different result when it changes a characteristic used by the rule. That outcome does not prove the first connection was defective. It also does not justify cycling through networks to avoid the site's limits.
If a proxy was already part of the route, keep its session stable during diagnosis. The guide to proxy sessions explains why changing exits also changes the network identity seen by the site.
How Can a Website Owner Fix Cloudflare Error 1015?
Website owners fix false Error 1015 blocks by tracing the matching rate-limit event, then correcting only the faulty rule setting. Disabling rate limiting across the site removes protection and hides the actual cause.
The Stop-Trace-Tune process keeps the investigation focused:
- Stop uncontrolled testing: Pause load tests, crawlers, or clients that are flooding the affected route. Keep one reproducible request for validation.
- Capture a blocked request: Record its Uniform Resource Locator (URL), method, time, source context, response status, and Ray ID. Remove credentials before sharing evidence.
- Find the event: Search Security Events, Log Explorer, or available logs within a narrow time range. Sampled Security Events may not contain every request.
- Identify the rule: Confirm the exact rule, action, match expression, counting expression, threshold, period, characteristics, and mitigation timeout.
- Check hidden contributors: Review cached-asset counting, Workers subrequests, shared counters, and overlapping rules. The first three can raise a counter, while overlapping rules can apply separate actions.
- Compare normal traffic: Measure legitimate peak behavior on the affected route before choosing a new threshold. Separate human, API, and internal service traffic where possible.
- Tune narrowly: Raise an unrealistic threshold, narrow the match, improve the characteristics, or shorten an excessive timeout. Preserve protection for abusive traffic.
- Validate safely: Use Log mode first when available, then monitor the result before restoring a blocking or challenge action.
Cloudflare's Ray ID documentation explains how the identifier supports event searches. A Ray ID helps correlate traffic, but Cloudflare does not guarantee that every request receives a globally unique value.
Enterprise users can use Cloudflare's request-rate analysis to compare normal and abusive traffic. Other plans can still use available Security Events, origin logs, application metrics, and controlled tests.
A verified internal service may need a tightly scoped exception. Restrict each exception through strong, verifiable characteristics. Avoid exempting broad address ranges or unrelated paths.
Owners should also return a useful message. A custom response can explain why the request was blocked, where support is available, and when to retry. The default response status is 429, while eligible plans can configure another 400–499 status.
Does Changing Your IP Address Fix Cloudflare Error 1015?
Changing an IP address can affect Error 1015 when that change alters an address, network, country, or other rule characteristic. It remains unreliable because cookies, headers, paths, fingerprints, and request behavior may stay unchanged.
Even a changed result requires careful interpretation. A new route may create a different counter, but the same request pattern can reach its limit again. Changing routes does not remove the site's policy.
IP rotation belongs at planned workflow boundaries. It should not replace host-level rate limits, backoff, caching, or session control.
Whether a route change matters depends on the rule's configured characteristics:
| Rule characteristic | Likely effect of changing networks | What it means |
|---|---|---|
| Source IP address | Usually changes | An IP-based rule may create a different counter |
| Network identity or country | May change | The result depends on the new route |
| Cookie, header, path, or fingerprint | Usually remains | The same counter inputs may still match |
| Request pattern | Remains until the client changes it | The new route can hit the same limit again |
Traffic from several users can fill the same IP-based counter when they share one proxy exit. Before changing providers or pools, use the steps for how to test proxies against a controlled destination. Then test the intended site at an approved, conservative rate.
Ordinary visitors should normally wait and contact the website. A proxy adds another variable and can make the support investigation harder.
How Should You Handle Cloudflare Error 1015 at Scale?
Cloudflare Error 1015 at scale requires host-level rate controls, capped retries, deduplication, and stable session boundaries for each destination. Faster retries only add pressure.
An automated client should inspect both the HTTP status and Cloudflare error representation. Default browser responses carry 1015 in HTML, while compatible clients can request structured responses through content negotiation. Custom error configurations can override these formats, so clients still need defensive handling.
| Detection layer | Default Error 1015 signal | Important caveat |
|---|---|---|
| HTTP status | 429 | A custom block response can use another 400–499 status |
| Cloudflare code | 1015 in HTML or error_code in a structured response | Custom error content can replace the default body |
| Retry guidance | Retry-After header or retry_after field | The retry value does not guarantee that the mitigation ended |
Use this handling order:
- Stop immediate retries: Prevent several workers or service layers from retrying the same failed request together.
- Honor server guidance: Follow a valid Retry-After value or documented API reset time when one exists.
- Back off with limits: Increase delay between attempts, add jitter, and cap the retry count. Send the final failure to a queue or operator.
- Reduce target pressure: Lower concurrency, requests per second, and duplicate fetches for the affected host or endpoint.
- Reuse useful results: Cache unchanged responses and deduplicate queued URLs before another network request begins.
- Preserve required state: Reuse client sessions, cookies, and one exit during linked steps. Rotate only at a deliberate workflow boundary.
- Separate routing budgets: Maintain distinct queues and limits for each destination host and intended region. Do not combine every route into one retry loop.
- Prefer supported access: Use an official API, feed, or export when it supplies the required data.
Reliable web scraping with proxies combines target-specific pacing, response validation, and queue control. Proxies change routes, but they do not replace workload limits.
Monitoring should separate first attempts from retries. Track valid results, rate-limit responses, retry volume, and waiting time. These measures show whether the scheduler is reducing pressure.
After the supplied wait, test one request before restoring the full job. The cURL with a proxy setup can reproduce one controlled route without restarting every worker.
How Can Proxidize Support Automation Affected by Error 1015?
Proxidize supports rate-aware automation with location controls, rotating or sticky sessions, and standard proxy connections. Proxidize does not remove Cloudflare limits.
Proxidize Residential Proxies provide country, city, and Internet service provider (ISP) targeting across 195+ countries. Mobile Proxies provide 4G/5G mobile IPs with country, city, and ISP-level targeting. Both products offer rotating and sticky sessions.
A sticky session can keep one exit IP across linked browser, API, or application requests. That consistency matters when a page load and follow-up requests share session state. It also removes route changes as a troubleshooting variable.
Rotating sessions suit independent tasks and deliberate workflow boundaries. Rotation should not begin immediately after Error 1015 because the original request pattern can trigger another counter. Keep host-level budgets, retry caps, caching, and deduplication in place.
Best For: Residential Proxies suit global, location-specific data collection across many markets.
Best For: Mobile Proxies suit mobile-network testing and mobile-specific results.
Choose the product based on the required network type and coverage, not as a reaction to one blocked request. Test the intended route at a controlled rate before scaling it. Separate credentials also make usage records easier to attribute.
What Should You Remember About Cloudflare Error 1015?
Cloudflare Error 1015 means a rate-limiting rule restricted traffic matching its scope, counter, threshold, and timing settings. The correct fix depends on whether you are the visitor, site owner, or application developer.
- Error 1015 appears after matching traffic reaches a configured Cloudflare rate limit.
- A fixed mitigation timeout can range from 10 seconds to one day, depending on the plan and action.
- Throttled rules do not use one fixed cooldown; they act on requests above the configured rate.
- Visitors should stop repeated attempts, pause automated traffic, wait, and contact the website when needed.
- Site owners should trace the event, inspect every rule parameter, and change the narrowest faulty setting.
- Automated clients should honor retry guidance, reduce concurrency, cache results, and cap retries.
- Changing an IP address helps only when it alters a counted characteristic and does not correct an excessive request pattern.
Frequently asked questions
Cloudflare's default Error 1015 response supplies a 30-second Retry-After value, unless a rule-specific value overrides it. That value is retry guidance, not a universal promise that the block ends after 30 seconds. Stop repeated requests, follow the supplied value, and contact the website when the error continues.
Cloudflare Error 1015 normally represents a temporary action, although the same traffic can trigger it again. Standard API values allow a fixed timeout of up to one day for supported plans and actions. Some actions use throttling instead of one fixed duration.
Clearing cookies does not remove a counter based only on an IP address. It can also make identification less precise when a rule uses Cloudflare's IP with NAT support. Visitors without its identification cookie may share one counter bucket, so clearing cookies is not a dependable Error 1015 fix.
No. Error 1015 is a Cloudflare code shown in the HTML body, while HTTP 429 is a standard response status. A default Cloudflare rate-limit block uses 429, but an eligible site owner can configure another status between 400 and 499.
When GameStop, Foodpanda, or another site displays Error 1015, the code still identifies a Cloudflare rate-limit response. Discord's “The resource is being rate limited” message can instead be an ordinary API 429 with a retry_after value. Follow the named service's response fields and support guidance rather than assuming every message is Error 1015.
Rules can count by IP address, cookie, header, path, or combined characteristics. Different IPs, cookies, or headers can place devices in separate buckets, while paths can have separate limits. Shared offices, carrier networks, VPNs, and proxy exits may place users behind one IP address.
A different route may change a counter using the IP address, network, or country. Cookie, header, path, or fingerprint values can still match. Visitors should wait, while authorized automation should lower its request rate, follow retry guidance, and respect published access rules.
“Unable to purge” is a separate Cloudflare 1015 error involving cache-purge operations, not the visitor rate-limit page. Retry the purge once, as Cloudflare instructs. If the failure continues, contact Cloudflare through its official support channel and include the purge request details.