What is Cloudflare Error 1015 (Rate Limited)?

Cloudflare Error 1015 is a specific HTTP response indicating that the client has triggered a rate-limiting rule configured on Cloudflare's edge network. The response body typically contains an HTML page stating "Error 1015 | You are being rate limited." It is a protective measure designed to prevent brute-force attacks, DDoS attempts, and aggressive scraping. The limit is usually defined as a maximum number of requests per IP address within a rolling time window (e.g., 100 requests per minute).

When a request hits a Cloudflare edge node, the firewall evaluates it against active rate-limiting rules. It checks the client's IP, session cookie, or other defined characteristics, and increments a counter in a token bucket. If the counter exceeds the threshold, Cloudflare intercepts the request, blocks it from reaching the origin server, and returns the 1015 error. The block remains active until the penalty period expires, meaning any subsequent requests from that IP will instantly fail.

A common mistake in scraping is assuming rate limits apply uniformly across a domain. Administrators frequently apply strict limits to resource-heavy endpoints (like /api/search or /graphql) while leaving static assets or homepage routes loosely limited. A scraper might successfully fetch 500 product pages but instantly trigger a 1015 when it attempts to paginate through a search API at the same concurrency level.

We treat 1015 errors as a failure of our traffic shaping, not just a network error. Before a pipeline goes into production, our discovery workers profile the target to infer the exact rate limit thresholds per endpoint. We then configure our distributed scheduler to enforce a hard concurrency ceiling per IP, adding a 20% safety buffer. If a 1015 does occur, the offending IP is automatically quarantined in our proxy pool to prevent cascading failures.

Cloudflare's rate limiting can be configured to trigger based on HTTP response codes from the origin. For example, an administrator can set a rule that bans an IP if it receives more than five 404 Not Found or 401 Unauthorized responses in a minute. This means a scraper with broken selectors or bad credentials can trigger a 1015 block even if its overall request rate is extremely low.