Cloudflare Error 1015: You are being rate limited

A 1015 is a temporary block for sending too much, set by the owner of the site and applied by Cloudflare. It says nothing about who you are.

You did nothing wrong on purpose. The site counted more requests from your address than its rule allows: fast reloading, many tabs, a form sent again and again, or other people behind the same address, as on office networks, campus Wi-Fi and VPNs. Booking and appointment pages, where people refresh for a free slot, are the classic case.

• Stop reloading and wait. The block ends by itself after the time the owner of the site set, and Cloudflare warns that repeated tries in a short time may extend it.
• Close extra tabs and anything that refreshes the page by itself, such as an auto-refresh extension.
• The count is usually kept per IP address. On a shared address, such as an office, a school or a VPN, it fills faster: your own mobile connection has its own count.
• Blocked again and again on normal use, or on the very first visit? Tell the site. Cloudflare does not decide who is limited; the owner of the site sets the rule and can change it.

For a script, a 1015 is the site telling you its limit. The rule counts requests that share a characteristic, the IP address in most setups, over a period, and blocks the ones that follow for a duration.

• One address, too many requests: a loop without a pause crosses the limit in seconds.
• Retries make it worse: each retry is one more request against the same count, and repeated tries may extend the block.
• The limit is often per path: login, search and API routes have tighter rules than ordinary pages.
• It is not a verdict on your client. A real browser on the same address would be limited too, so changing headers does nothing.
• What works is fewer requests per address: slow down, cache what you already have, and spread the rest over more addresses.

The whole picture of the system is in the guide: How to Bypass Cloudflare When Scraping.

The Web Unlocker leaves from a different residential or mobile exit on every call unless you pin a session, so the requests of one job are not counted against one address. Send the URL to the REST endpoint; the answer says whether the page or a block came back.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

Do not pin one session for a job that fetches many pages: a pinned session keeps one exit, and one exit carries the whole count. Set a cache lifetime on calls you repeat, so a page you already have is not fetched again.

What the answer tells you

The canary of 11 November 2026 runs a fixed list of 27 protected targets, Cloudflare sites among them: 72 of 81 calls came back with the real page, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.