# How to Bypass Cloudflare When Scraping

> How to bypass Cloudflare when scraping: the 403 challenge and errors 1020 and 1015 explained, and one Web Unlocker call that returns the real page. Start free.

[Home](https://quanticdata.io/) / [Web Unlocker](https://quanticdata.io/web-unlocker/) / Cloudflare

Web Unlocker · Cloudflare

# How to bypass Cloudflare when you scrape

Cloudflare stops a scraper with a `403` and a "Just a moment..." page, or with an error such as 1020 or 1015. The Web Unlocker sends the same URL from a residential or mobile IP, lets a real browser pass the check when one is asked, and returns the page with its status in one JSON answer.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-cloudflare-start-1) · [Read the docs](https://quanticdata.io/docs/#tag/Web-Unlocker/operation/unlockRequest)

- **9 of 9**: calls to Cloudflare-protected pages answered with the real page, canary of 11 November 2026
- **88.9%**: across all 27 protected targets of the same run
- **4.1 s**: median response across the run

- [What the block looks like](https://quanticdata.io/web-unlocker/bypass-cloudflare/#signs)
- [Why Cloudflare blocks a scraper](https://quanticdata.io/web-unlocker/bypass-cloudflare/#why)
- [Get the page](https://quanticdata.io/web-unlocker/bypass-cloudflare/#call)
- [Measured](https://quanticdata.io/web-unlocker/bypass-cloudflare/#measured)
- [Own stack or unlocker](https://quanticdata.io/web-unlocker/bypass-cloudflare/#compare)
- [Limits](https://quanticdata.io/web-unlocker/bypass-cloudflare/#limits)
- [FAQ](https://quanticdata.io/web-unlocker/bypass-cloudflare/#faq)

## What a Cloudflare block looks like

Cloudflare answers in several ways, and each one says something different about why the request was stopped. Look at the status, one header and the text of the page.

| Where to look | What a Cloudflare block shows |
| --- | --- |
| Status code | `403` with the challenge page. `429` or error 1015 when the site rate limits you. `503` on older JavaScript challenges. |
| Response headers | `cf-mitigated: challenge` on a challenge. `server: cloudflare` and a `cf-ray` id are on every answer, blocked or not. |
| Page title and text | "Just a moment..." with "Verifying you are human" or "Checking your browser before accessing". The page loads a script from `/cdn-cgi/challenge-platform/`. |
| Turnstile | A box that says "Verify you are human". It often clears by itself; sometimes it asks for a click. |
| Error pages | "Error 1020: Access denied" (a security feature set up by the site owner blocked the request), "Error 1015: You are being rate limited", "Error 1010" (the browser signature was refused), "Error 1009" (your country is blocked), and "Sorry, you have been blocked" with a Ray ID. |
| Cookies after a pass | `cf_clearance` proves the challenge was passed. `__cf_bm` belongs to bot scoring. |

![A Cloudflare block and the page behind it: first the 403 answer with the words Just a moment and the cf-mitigated challenge header, then the challenge page replaced by the real page answering 200 after one Web Unlocker call, last the JSON answer with status 200, blocked false, the tier that served it, attempts and cost.](https://quanticdata.io/web-unlocker/bypass-cloudflare/diagram.webp?v=20261111g1)

*What Cloudflare answers to a script, and what one Web Unlocker call returns instead.*

## Why Cloudflare blocks a scraper

Cloudflare sits in front of the site and scores every request before the site sees it. A plain HTTP client fails on things a browser gets right without trying.

- The IP: addresses of hosting providers score worse than home and mobile connections.
- The handshake: the TLS and HTTP/2 fingerprint of the client has to match the browser named in the `User-Agent`. A Python or Go client that says it is Chrome does not match.
- JavaScript: the challenge page runs a script and expects a browser to answer it. A client that cannot run it never leaves the 403.
- The clearance: `cf_clearance` belongs to the visitor that earned it. Sent from another IP or another client, it is ignored and the challenge comes back.
- The settings of the site: the countries, paths and rates its owner chose are behind the 1020, 1015 and 1009 errors. No client change lifts a block on your country: the request has to leave from an allowed one.

## Get the page behind Cloudflare with one call

Send the URL to the REST endpoint. With `mode: "auto"`, the default, the first attempt is a browser-grade request from a residential IP. If Cloudflare answers with a challenge, a real browser opens the page, waits for the check to clear and returns what it sees.

cURL:

```bash
curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'
```

Python:

```python
import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])
```

Node.js:

```javascript
const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));
```

Set `country` to a country the site serves: error 1009 is a country rule. For many pages of one site, keep calling from the same account: once a challenge is passed, the next calls reuse that session and come back faster.

### What the answer tells you

| Field | What it says |
| --- | --- |
| `blocked` | `false` when the real page came back. `true` only when every attempt met the block; the block page is then in `body`. |
| `vendor` | The system the engine recognised on a blocked attempt. For this guide: `cloudflare`. |
| `blockClass` | Usually `js_challenge` for the "Just a moment..." check, `captcha` when the box needs a person, and `access_denied`, `rate_limited` or `geo` for a setting of the site. |
| `tier_served` | `tls` for a browser-grade request, `browser` when a real browser had to open the page. |
| `attempts`, `latency_ms` | How many tries the call took and how long it lasted. |
| `cost` | The bytes this call moved and what it was charged. |

## Measured, with a date

In the canary of 11 November 2026, all 9 calls to Cloudflare-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

The first request to a protected site waits for the site's own check. The next ones from the same account reuse the session: in our test of 11 November 2026, four requests in a row to the same Cloudflare-protected page took 12.4 s, 1.5 s, 1.5 s and 1.4 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the [Web Unlocker status page](https://quanticdata.io/web-unlocker/status/).

## Your own scraper or the Web Unlocker

Getting past Cloudflare once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

| What has to be right | With your own scraper | With the Web Unlocker |
| --- | --- | --- |
| The IP address | You rent residential or mobile IPs and rotate them yourself. | Residential (Premium) or mobile exits, chosen by country, state and city. |
| The browser identity | Handshake, HTTP/2 settings and headers must describe one browser, and be updated with every browser release. | A browser-grade request on the first attempt, kept current for you. |
| The JavaScript check | You run real browsers for the pages that need one, and keep them from looking automated. | A real browser opens the page only when the site asks for one. |
| After a pass | You store `cf_clearance` per IP and per client, and replay it from exactly that pair. | The session is reused for your next calls to that site. |
| When a call still fails | You recognise the Cloudflare block page yourself and decide what to retry. | Retries on a fresh exit. The answer says `blocked`, `blockClass` and `vendor`. |

## What it is for, and what it does not do

- It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
- Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with `blocked: true` and `blockClass: "captcha"`, so your code can skip the page or try later.
- It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
- Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.

## Cloudflare and scraping: questions people ask

### How do I bypass Cloudflare with Python requests?

Not with requests alone on a protected page. Its handshake does not look like a browser, so Cloudflare answers 403 before your headers matter, and it cannot run the challenge script. Send the URL to the Web Unlocker instead: one POST from Python, and the JSON answer carries the page that a browser-grade client or a real browser received.

### What does Cloudflare error 1020 mean?

Error 1020, Access denied, means a security feature that the site owner configured blocked your request. It is a refusal, not a challenge, so waiting or reloading does not help. What gets a different answer is a different request: from a residential IP in a country the site serves, with a coherent browser identity.

### What does error 1015 "You are being rate limited" mean?

The site allows a number of requests per IP in a time window, and that IP went over it. The block lifts when the window ends, usually within minutes. Spread the calls over more IPs or slow down: the Web Unlocker leaves from a different exit on every call unless you pin a session.

### Does a residential proxy alone get past Cloudflare?

It fixes the IP score and nothing else. If the client behind the proxy still shows a handshake that is not a browser, or cannot run JavaScript, the challenge stays. The Web Unlocker uses the same residential and mobile exits and adds the browser-grade request, the real browser when needed and the retries.

### How long does the Cloudflare check take?

The check takes a few seconds in a real browser, so the first call to a protected site is the slow one. After a pass the session is reused for your next calls to that site, until the site asks again. In our test of 11 November 2026, four calls in a row to the same Cloudflare-protected page took 12.4, 1.5, 1.5 and 1.4 seconds.

### Is it legal to scrape a site protected by Cloudflare?

The protection system does not decide that. What matters is the page and the data: whether the page is public, what the terms of the site say, and which law covers the data, personal data above all. The Web Unlocker fetches pages anyone can open without signing in; it does not log in and it does not create accounts.

## Send the URL that Cloudflare blocks

Create the free account, open Web Unlocker in the dashboard and paste the URL into the test box. The answer shows the status, the tier that served the page, the attempts and the cost of the call.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-cloudflare-start-2) · [How the Web Unlocker works](https://quanticdata.io/web-unlocker/)

Block pages:

- [Block page dictionary](https://quanticdata.io/web-unlocker/block-pages/)
- [Error 1015](https://quanticdata.io/web-unlocker/cloudflare-error-1015/)
- [Error 1020](https://quanticdata.io/web-unlocker/cloudflare-error-1020/)
- ["Just a moment..."](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/)
- [Cloudflare Turnstile](https://quanticdata.io/web-unlocker/cloudflare-turnstile/)
- [CAPTCHA when scraping](https://quanticdata.io/web-unlocker/captcha-when-scraping/)

Other systems:

- [DataDome](https://quanticdata.io/web-unlocker/bypass-datadome/)
- [Akamai Bot Manager](https://quanticdata.io/web-unlocker/bypass-akamai/)
- [PerimeterX (HUMAN)](https://quanticdata.io/web-unlocker/bypass-perimeterx/)
- [Kasada](https://quanticdata.io/web-unlocker/bypass-kasada/)
- [Imperva (Incapsula)](https://quanticdata.io/web-unlocker/bypass-imperva/)
- [F5 BIG-IP and Shape](https://quanticdata.io/web-unlocker/bypass-f5/)
- [AWS WAF](https://quanticdata.io/web-unlocker/bypass-aws-waf/)

Also:

- [Web Unlocker](https://quanticdata.io/web-unlocker/)
- [Status and canary](https://quanticdata.io/web-unlocker/status/)
- [Residential proxies](https://quanticdata.io/residential-proxies/)
- [Mobile proxies](https://quanticdata.io/mobile-proxies/)
- [Web Scraper API](https://quanticdata.io/web-scraping-api/)

## References

By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData · Published 11 November 2026 · Updated 11 November 2026 · [Read as Markdown](https://quanticdata.io/web-unlocker/bypass-cloudflare/index.md)

- [Cloudflare docs: interstitial challenge pages](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/)
- [Cloudflare docs: detect a challenge page response (the cf-mitigated header)](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/detect-response/)
- [Cloudflare docs: clearance and the cf_clearance cookie](https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/)
- [Cloudflare docs: 1xxx errors, with the pages for 1009, 1010, 1015 and 1020](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/)
- [Web Unlocker in the QuanticData API docs: request, answer, errors and blocked pages](https://quanticdata.io/docs/#tag/Web-Unlocker)
- [Web Unlocker status: the canary list, the method and every run](https://quanticdata.io/web-unlocker/status/)

---

Source: https://quanticdata.io/web-unlocker/bypass-cloudflare/ · Site index for AI: https://quanticdata.io/llms.txt