---
title: "What Is Error 1015? How to Fix You Are Being Rate Limited"
description: "Error 1015 is a temporary block shown when too many requests reach a site behind Cloudflare in a short time. Why it appears, how long it lasts, what to do."
url: https://proxynet.io/blog/cloudflare-error-1015
date: 2026-09-19
author: "Acar Diveroli"
category: "Tutorial, Web Scraping"
lang: en
---

# What Is Error 1015? How to Fix You Are Being Rate Limited

You refreshed an order dashboard a few times to see new orders, tried to log in to a gaming platform several times in a row, or kept reopening the same page on a booking site hoping a free slot would appear. Then the site vanished and a white screen took its place: "Error 1015. You are being rate limited." There is no friendly explanation, only the word Cloudflare at the bottom and a code that looks meaningless. Most people assume at this point that their internet is broken or that they have been thrown off the site for good. Neither is true.

This post explains what Error 1015 is, what each line on the screen tells you, why the block appears and how long it lasts. It is split for three readers: the visitor who sees the error, the site owner whose visitors see it, and the developer whose program receives this response. You will not find a recipe for getting around the limit here; you will find how the limit works and how to stay within it.

> **Note: Short answer**
>
> Error 1015 means you hit a rate limit set by the owner of a site that uses Cloudflare: your connection sent more requests in a short time than the site allows. The block is temporary and applies to your current connection, not to your account. The thing to do is wait. Refreshing the page over and over means new requests, and according to Cloudflare's own documentation it may extend the block. Take a break for a few minutes, close the open tabs, then try once. If the error keeps appearing during normal use, only the site owner can change the limit; note the Ray ID on the screen and contact the site.

## What is Error 1015?

Cloudflare is a network service that sits in front of websites. Your request first goes to Cloudflare's servers and from there to the site's own server; site owners use this layer for both speed and protection. One part of that protection is rate limiting: the site owner writes a rule saying "the same visitor may send at most this many requests in this much time", and Cloudflare enforces it.

Error 1015 is the page that tells you this rule has kicked in. Cloudflare's [Error 1015 documentation](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1015/) states the cause in one sentence: the website owner has configured rate limiting rules that restrict how many requests a visitor can make in a given time period. The same page stresses one more thing: it is the site owner, not Cloudflare, who decides which visitors are rate limited.

The number 1015 is not an HTTP status code. Cloudflare labels the error pages it generates itself with numbers in the 1000s, and 1015 is the member of that family reserved for rate limiting. The real HTTP code the server sends behind the page is `429 Too Many Requests` by default. In other words, 429 is the general code any server can use, and 1015 is the branded page Cloudflare shows while sending it. We cover the general code, and how it looks in browsers and apps, in our separate post on [429 Too Many Requests and rate limit errors](/blog/http-429-too-many-requests).

## What does "You are being rate limited" mean?

A rate limit is the upper bound on how many requests a service accepts in a given period; the sentence says that bound is now being applied to you. The page is short, but every line says something:

| Line on the screen | What it tells you |
|---|---|
| Error 1015 | The type of error: Cloudflare's rate limiting page. Not a virus, an internet outage or a site failure |
| You are being rate limited | The number of requests from your connection passed the threshold in the site owner's rule |
| The owner of this website has banned you temporarily from accessing this website | The block comes from the site owner's rule and it is temporary. "Banned" sounds harsh, but it does not mean a permanent ban |
| Ray ID | The identifier given to your request. With this code the site owner can find exactly your request in their own logs |
| Your IP | The IP address the site sees you from. On some pages it is hidden and appears when you click |

Pay attention to the word "request". A request is not the same thing as opening a page. When a single page opens, the browser can send dozens of requests in the background: images, scripts, dashboard screens that ask the server every few seconds whether there is a new order. If the site owner wrote the rule so that it counts these background requests too, the counter may already be full while you are saying "I only clicked once".

## How does a rate limit work?

A Cloudflare rate limiting rule has four parts: which requests are counted, what the requests are grouped by, the time window and the threshold. The flow looks like this:

1. **The site owner writes the rule.** For example, "at most 20 requests per minute to the login page from the same IP address".
2. **Cloudflare counts every request.** Whatever characteristic the rule groups by (most often the IP address), a separate counter is kept for each value of it.
3. **The counter passes the threshold within the window.** According to the [rule parameters documentation](https://developers.cloudflare.com/waf/rate-limiting-rules/parameters/), the window can be set between 10 seconds and 1 hour.
4. **The action is applied.** If the action is "block", the visitor sees the Error 1015 page. The site owner can instead choose to show a challenge screen or only log the request.
5. **The block duration runs.** According to the same documentation, this can be set from 10 seconds up to 1 day. When it ends, access opens again by itself.

Two details explain why the error sometimes looks inconsistent. First, Cloudflare keeps counters per data center; two requests that land in different data centers may not be written to the same counter. Second, the site owner can choose a "throttle" behaviour instead of a block: requests under the limit pass, and only the requests over the threshold are rejected.

## I did nothing wrong, so why did I get this error?

You do not need bad intentions to hit a rate limit. The counter does not look at intent, it counts requests. Each of the following can pass the threshold during ordinary use:

| Cause | What happens |
|---|---|
| Refreshing the page over and over | Every F5 sends dozens of new requests. It is the most common cause on booking, ticket and stock pages |
| Many open tabs and auto-refresh extensions | Each tab sends its own background requests; extensions that reload a page at an interval keep going while you are away from the computer |
| A misbehaving app or script | An app that retries without waiting when the connection drops can produce hundreds of requests in seconds |
| Repeated failed logins | Limits on login pages are kept low on purpose; a few attempts with a wrong password can fill the threshold |
| Sharing an IP address with others | The requests of everyone leaving from the same address are written to the same counter |

The last row is the real cause for most people who say "I did nothing". In an office, a dorm or a café, dozens of people reach the internet through a single IP address. On mobile data and on some home internet plans, the carrier puts many subscribers behind the same public address; how that works, and how to tell on your own connection, is in our post [What Is CGNAT? How to Check and Get Out of It](/blog/what-is-cgnat). On free VPN and proxy services thousands of people use the same exit address; the details are in our post on [whether free proxies are safe](/blog/are-free-proxies-safe).

Typical places where people run into this screen are the restaurant dashboards of food delivery platforms, gaming and chat platforms such as Discord and Roblox, and booking sites. The reasons are similar: a dashboard screen keeps refreshing itself, gaming and chat apps retry immediately when the connection drops, and on a booking site it is the user who keeps refreshing the page.

## How long does Error 1015 last?

There is no single answer, because the duration is set by the site owner, not by Cloudflare. The options run from 10 seconds to 1 day, and which one a given site picked is not visible from the outside. That is why exact figures you see online, such as "it lasts 15 minutes", are not reliable.

The block lifts by itself; you do not need to apply anywhere. Trying again and again while you wait, as the Cloudflare documentation also warns, may extend it: every F5 is not one request but a new batch of dozens.

A reasonable approach: take a break of five to ten minutes and try once. If it does not open, wait half an hour, then a few hours. If you still see the same screen a day later, either something on your connection is still sending requests or the rule is too strict.

## What should you do as a visitor?

1. **Stop refreshing.** Close the tab and leave the site alone for at least a few minutes.
2. **Close whatever is sending requests in the background.** Other open tabs of the same site, auto-refresh extensions, price or stock tracking extensions, desktop apps connected to the site.
3. **Try once.** If it opens, the problem is over.
4. **If the first three steps were not enough, measure the connection's share.** Connect the computer to your phone's mobile data and try. If it opens on mobile data but not on the office or home network, the counter belongs to the address you share, not to you. If you are in an office, tell the network administrator.
5. **If a VPN or free proxy is on, turn it off.** Coming from a crowded exit address means taking on other people's requests as well.
6. **Write to the site owner.** If the error keeps coming back during normal use, the fix is not on your side. Write to the site's support address with what you were doing when the error appeared, the time, and the Ray ID on the screen. Writing to Cloudflare will not help, because Cloudflare did not set the rule.

Clearing cookies or switching browsers usually does not help with this error, because in most rules the counter is tied to the IP address and a new browser leaves from the same address. Trying to escape the block by changing your IP address is not a lasting fix either: the same behaviour fills the counter of the new address too, and if the limit is tied to a session or an account, nothing changes at all.

A separate note for booking and ticket sites: refreshing the page every second while waiting for a free slot, or installing an extension that does it for you, is the behaviour that triggers the limit fastest. If the site has a notification or a waiting list, use it; if not, check by hand every few minutes.

## If you own the site: is your rule blocking real visitors?

If visitors send you "I am getting Error 1015" messages, your rule is working; the question is whether it stops the right people. A possible order of checks:

1. **Ask for the Ray ID and find it in the logs.** The Security Events log in the Cloudflare dashboard can be filtered by Ray ID. The entry shows the rule that fired, the IP address and the browser information.
2. **Look at what you are counting.** If the rule counts requests across the whole site, images, scripts and the dashboard's background queries go into the counter too. Narrow the limit to the address you want to protect (login, search, API endpoint).
3. **Widen the window.** This is Cloudflare's own recommendation: if the rule blocks within a very short window (for example 1 second), increase the window to 10 seconds. Browsers send requests in bursts while a page loads.
4. **Account for shared addresses.** For visitors on mobile data or corporate networks, hundreds of real people can sit behind a single IP address. Cloudflare offers a cookie-based identification for this case ("IP with NAT support"), which brings the counter closer to the visitor than to the address. Which grouping options are available depends on your plan.
5. **Soften the action.** Running a new rule with the "log" action first, to see how many requests it catches, is safer than blocking straight away.
6. **Choose the block duration to match the threshold.** A low threshold with a 1-day block keeps a customer who pressed F5 a few times away from the site for a whole day. If you have dashboard pages that stay open all day and refresh themselves, test the threshold against their normal pace.

## If you are a developer: the 429 behind 1015

If your program receives this response while reading a site's data, there are two places to look. According to the Cloudflare documentation, codes in the 1000s such as 1015 arrive in the body of the response, while the HTTP code arrives in the status line. The status code is 429 by default; the site owner can replace it with another code in the 400-499 range and replace the body with their own HTML, JSON or plain text response. So you may not always find the text "1015" in the body. That is why, when diagnosing, you should look not only at the code but also at the body and at the `Server: cloudflare` and `CF-Ray` headers.

**Advanced:** a single command is enough to see the response headers. Replace the address with your own target:

```bash
curl -s -o /dev/null -D - https://www.cloudflare.com/ | grep -i -E "^HTTP|^retry-after|^cf-ray|^server"
```

In a normal response you will see the status line and the `CF-Ray` and `Server: cloudflare` lines. In a rate limited response the status is 429; if the server sent it, `Retry-After` appears in the list too.

[RFC 6585](https://www.rfc-editor.org/rfc/rfc6585#section-4), which defines the 429 code, says the server may add a `Retry-After` header telling you how long to wait. The two forms of the header (seconds and a date) are shown with examples on [MDN's Retry-After page](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Retry-After). If the header is there, obey it. If not, apply exponential backoff and lower your rate. A tested Python example that parses both forms of the header and decides by status code is in our post [HTTP Status Codes in Web Scraping: 403, 407, 429, 503](/blog/http-status-codes-web-scraping).

The lasting fix is not in the retry logic but in the request pace:

- **Cap concurrency.** Put an upper bound on the number of connections open to the same site at the same time. Why raising concurrency past a certain point only produces more 429s, and how to measure the right value, is in our post [Concurrency vs Parallelism: What Sets Scraping Speed?](/blog/concurrency-vs-parallelism).
- **Look for the official route first.** If the site has an API, its limits are documented and tied to your key.
- **Read the robots.txt file.** Some sites state the time to wait between requests there with a `Crawl-delay` line. How to read the file is in our post [What Is a robots.txt File and How Do You Read It?](/blog/robots-txt).

Changing the User-Agent or the IP address to "reset" the counter is often suggested, but the limit does not care about your identity; it cares about the load you put on the site. Splitting the same load across other addresses strains the site just as much. The full picture of working without getting blocked is in our post [How to Scrape Websites Without Getting Blocked](/blog/web-scraping-without-getting-blocked).

## Which errors is Error 1015 confused with?

Cloudflare's different screens say different things, and what you should do changes with them:

| Screen | What it means | Who fixes it |
|---|---|---|
| Error 1015, You are being rate limited | Too many requests too often; a temporary rate limit | You wait; the site owner changes the threshold |
| Sorry, you have been blocked (Error 1020 and similar) | Your request was rejected because of a security rule, not because of speed | Only the site owner; [the table of codes is in this post](/blog/sorry-you-have-been-blocked) |
| Verify you are human | Not a block but a verification step; once you pass, the site opens | Mostly you; the steps are [in this post](/blog/cloudflare-verify-you-are-human) |

In practice the distinction matters for this reason: with 1015 waiting works, while with a security rule block the result does not change however long you wait. The signals sites use to tell automated traffic apart are covered in our post on [how bot detection works](/blog/how-bot-detection-works).

## For businesses: shared addresses and spreading the load up front

For teams that run into the error as part of their work, there are two separate situations.

**Teams that hit the limit because of someone else's traffic.** If an agency or operations team connects to the same dashboards all day from a crowded office network, a shared VPN or the carrier's common address, the counter can fill up regardless of the team's own usage. What you are after here is not getting past the limit but tying the counter to your own usage only: [ISP Proxy](https://proxynet.io/static-isp-residential-proxy) give you a fixed address registered to an internet service provider, and every request leaving that address is yours. What an unshared address means is explained in our post [What is Private Proxy?](/blog/private-proxy).

**Teams that collect data with permission and at large volume.** In jobs such as price comparison or stock monitoring, tens of thousands of pages are read, and sending all the traffic from a single address runs that address into the limit. [Rotating Proxy](https://proxynet.io/rotating-proxy) spread requests across a wide pool of addresses, but spreading does not replace lowering the total pace: if the total number of requests you send to the site per second stays the same, the load the site owner sees stays the same too. First the total rate is brought down to a level the site can handle, then that traffic is divided across addresses. You can find the whole workflow on our [data scraping solution](/data-scraping) page.

## Common mistakes

- **Continuing to press F5 once the screen appears.** Every refresh is written to the counter and may extend the block.
- **Trying to escape by turning on a free VPN.** Moving to a crowded address means sharing a counter that is already full.
- **On the developer side: retrying without waiting.** Every retry fired immediately at a 429 produces a new 429 and may extend the block.
- **On the site owner side: switching a rule to block mode without testing it.** A rule that was never run in log mode first leaves real customers outside the door on the first busy day.

## Decision guide

| Your situation | What to do |
|---|---|
| You are seeing the error for the first time | Close the tab, wait a few minutes, try once |
| It appears on a site where you refresh the page often | Widen the refresh interval, remove the auto-refresh extension |
| It opens on mobile data but not on the office or home network | The address is shared; tell the network administrator, turn off the VPN if it is on |
| It appears every day during normal use | Write to the site owner with the Ray ID; the threshold may be too low |
| Visitors are complaining on your own site | Find the Ray ID in Security Events, widen the window, narrow the rule |
| Your program receives 429 and 1015 | Obey Retry-After, lower concurrency, move to the official API if there is one |
| Your team hits the limit because of a shared address | Use a fixed address that belongs only to you |

## Frequently asked questions

### Is Error 1015 a permanent ban?

No. Despite the word "banned" on the page, the block is temporary and lifts by itself when its duration ends. Nothing is done to your account; the block applies to your current connection. If the same behaviour continues, the block starts again.

### Is Error 1015 a virus or an internet fault?

Neither. The page comes from the Cloudflare layer in front of the site and is only about the number of requests. If other sites open normally, there is nothing wrong with your internet. Still, if a broken extension or a stuck app keeps sending requests to a site, you need to close it.

### Does restarting the modem help?

It is not a reliable route. On some subscriptions the IP address changes when the modem reconnects, on others it stays the same. Even if it changes, the same screen comes back a few minutes later if the behaviour that triggers the limit continues; if the limit is tied to an account or a session, nothing changes. Waiting is the surer way.

### Another device in the same home can open the site, why can't I?

The devices may be leaving through different connections: one on Wi-Fi, the other on mobile data. If they are on the same network, the rule may also be looking at something other than the IP address (a cookie, a request header). On the device that cannot open the site, check the extensions and the tabs left open.

### What is a Ray ID and what is it for?

It is the identifier given to every request that passes through Cloudflare. It means nothing to you, but with this code the site owner can find your request, the rule that fired and the time in their own security logs. When you write to the site, make sure the Ray ID is included in the screenshot.

### Does using a proxy fix Error 1015?

If your own behaviour triggers the error, no: the same pace fills the counter of the new address too. The only case where a proxy really makes a difference is when the counter is filled not by you but by the others you share the address with; then a fixed address that belongs only to you removes the problem at its source.

## Summary

**Error 1015** is a temporary block telling you that you hit a rate limit set by the owner of a site that uses Cloudflare. The HTTP code behind it is 429, the site owner sets its duration and threshold, and Cloudflare only enforces it. For the visitor the fix is to wait and not refresh; if the error keeps appearing, write to the site owner with the Ray ID. The site owner checks what the rule counts and how wide the window is; the developer obeys `Retry-After` and lowers the request pace. If you hit the limit because of the address you share rather than your own usage, take a look at our [proxy services](/proxy), which offer addresses that belong only to you.