Cloudflare Error 1010: The owner of this website has banned your access based on your browser’s signature
Your browser, script or app was turned away before the site even saw it, because its headers looked like the ones spam bots send. That is the Browser Integrity Check, and Error 1010 is its red card.
What Browser Integrity Check looks at
It is a quick, header-only check that runs before your site is contacted. It looks for patterns that spam and attack tools commonly produce, most obviously a missing or nonsensical User-Agent. It does not run JavaScript or look at your behaviour, which is why a single change to headers often flips the result.
Who hits it
| Client | Likely reason | Try |
|---|---|---|
| A script (Python, Go, a shell one-liner) | No User-Agent, or a bare library default | Send a descriptive one, e.g. my-sync-script/1.2 (+contact URL) |
| A browser with privacy add-ons | Headers removed or replaced by an extension | Retry in a private window with extensions off |
| Headless or automated browsers | Header combination that does not match a real browser | Use the site’s API if it has one, or ask the owner |
| Corporate proxies | Proxy rewrites or drops headers | Try another network to confirm |
Checking from a terminal
# See the status and Ray ID
curl -sI https://www.example.com/ | grep -iE '^(HTTP|cf-ray)'
# Same request with an explicit User-Agent
curl -sI -A 'my-script/1.0 (+https://example.org/contact)' https://www.example.com/
If adding a User-Agent changes the answer from 403 to 200, Browser Integrity Check was the reason. In Python, pass a User-Agent header explicitly rather than relying on the library default. Pretending to be a specific browser is not needed and is not a good habit; a clear, honest name for your client is usually enough.
For site owners
- Search the Ray ID in Security Events to confirm Browser Integrity Check was the action that blocked the request.
- If your site has an API or webhook endpoint used by scripts, turn Browser Integrity Check off for those paths only with a configuration rule (or skip it in a custom rule), and keep rate limiting on them.
- Document in your API docs that clients should send a User-Agent. It saves your users a confusing 1010.
1010 vs 1020 vs a challenge
- 1010: the headers looked like a bot (Browser Integrity Check).
- 1020: a WAF or custom rule the owner wrote matched the request.
- A “Verify you are human” page is a challenge, not a block: a real browser can pass it.
Related
All Cloudflare error codes · Cloudflare Error 1020 · Cloudflare Error 1006 to 1009 · Cloudflare Error 1015 · 401 vs 403 · CORS errors
Questions
What does Cloudflare error 1010 mean?
Browser Integrity Check judged the request's headers, its browser signature, to look like a bot and blocked it before it reached the site.
Why does my Python script get error 1010 or a 403?
Often because it sends no User-Agent or a bare library default. Send a descriptive User-Agent header and try again.
Can a browser extension cause error 1010?
Yes. Extensions that strip or rewrite headers can make a normal browser look like a bot. Try a private window with extensions off.
How can a site owner stop 1010 on their API?
Use a configuration rule to turn Browser Integrity Check off for the API paths only, and keep rate limiting in place.
Is 1010 the same as 1020?
No. 1010 comes from Browser Integrity Check on headers. 1020 comes from a firewall or custom rule the owner wrote.
Published .