Cloudflare Error 1015 "You are being rate limited": fix for visitors and site owners
You refreshed a few times, or a script looped, and now every page says “Error 1015: You are being rate limited”. The site’s owner set a limit on how many requests one client may send, and you went over it.
What you see
Error 1015
You are being rate limited
The owner of this website (www.example.com) has banned you temporarily from accessing this website.
The wording says “banned”, but it is a timed block, not a permanent ban. The HTTP status is 429 Too Many Requests.
If you are a visitor
- Stop refreshing. Every retry can restart the timer.
- Wait a few minutes, then load the page once.
- Close extra tabs or extensions that poll the site (auto-refreshers, price trackers).
- If you share an IP address (office, school, mobile carrier, VPN), someone else may have used up the limit. Try another network or switch off the VPN.
- If it never clears, contact the site and quote the Ray ID from the bottom of the page.
If it is your script or API client
- Read the
Retry-Afterheader if present and sleep that long. - Use exponential backoff with jitter: wait 1 s, 2 s, 4 s, 8 s plus a random bit, and give up after a few tries.
- Cache responses and batch requests instead of asking for the same thing in a loop.
- Run jobs on a gentle schedule rather than all at once; check your cron expression does not fire every minute by mistake.
# See the status and headers without hammering the site
curl -sI https://www.example.com/api/items | tr -d '\r' | grep -iE '^(HTTP|retry-after|cf-ray)'
If you own the site
- Copy the Ray ID and look it up in Security → Events. The event names the rate limiting rule and what it counted.
- Open the rule under Security → WAF → Rate limiting rules and check its threshold, period and mitigation timeout.
- Count by a better key than IP when many real users share one address: a session cookie, API token header or path.
- Scope the rule to what you actually want to protect (login, search, API) instead of the whole site.
- Add a skip condition for your own monitors and trusted integrations.
- Prefer a Managed Challenge action for browsers and Block only for API paths, so real people get a way through.
1015 vs other blocks
| Error | Cause | Clears by itself? |
|---|---|---|
| 1015 | Rate limiting rule: too many requests | Yes, after the timeout |
| 1020 | WAF or custom firewall rule matched | No, until the rule or your request changes |
| 1006 / 1007 / 1008 | Your IP is banned by an IP Access rule | No |
| 429 from the origin | The app itself rate limited you (no Cloudflare branding) | Depends on the app |
Related
Cloudflare Error 1006 to 1009 · All Cloudflare error codes · HTTP 429 Too Many Requests · Cloudflare Error 1020 · HTTP 503 · Anvil: 429 in plain words · Wirebook: why websites get tired
Questions
How long does Cloudflare error 1015 last?
As long as the site owner’s rule says: the mitigation timeout is commonly between 10 seconds and an hour. Retrying during the block can extend it.
Is error 1015 a permanent ban?
No. Despite the word “banned”, it is a temporary rate limit that lifts by itself.
Why am I rate limited when I barely used the site?
You may share an IP address with many people (office, school, mobile carrier, VPN), and the rule counts per IP.
What HTTP status does error 1015 use?
429 Too Many Requests.
How do I stop my script getting error 1015?
Respect Retry-After, back off exponentially with jitter, cache results and spread requests out over time.
How does a site owner find which rule caused 1015?
Search the Ray ID in Security → Events; the event names the rate limiting rule.
Published · updated .