Cloudflare Error 1015 "You Are Being Rate Limited": Fix Guide

Error 1015 means the site you visited uses a Cloudflare rate limiting rule, and your IP or session sent more requests than the rule allows within its time window. Cloudflare describes it as the website having received too many requests and temporarily blocking you. The block is deliberate and temporary, and the origin server was not involved.

You see a Cloudflare page headed "You are being rate limited" with Error code 1015 and a Ray ID. It appears when you refresh a page repeatedly, run a scraper or API client, log in many times, or when a plugin makes rapid background requests. The 1015 value is a Cloudflare error code. In practice the block response typically carries HTTP status 429 (Too Many Requests), so check what yours returns with curl -I.

Why it triggers

1. Your client really sent too many requests, such as a loop, polling every second, or a crawler with no delay.
2. The site's rule is aggressive, for example blocking after a handful of requests in a few seconds to a login, search or checkout path.
3. A shared IP, such as an office, school, VPN or mobile carrier network, where many users together exceed the threshold.
4. A page loading many resources, where each asset counts as a request under a broad rule.
5. Background requests from WordPress (admin-ajax.php, the heartbeat API), a browser extension, or a mobile app retrying failed calls.
6. Monitoring or health checks from tools that probe a protected path too frequently.

If you are a visitor

• Wait. The block is temporary, and the duration is set by the site owner in the rule (it may be seconds or longer).
• Stop refreshing. Repeated requests can restart or lengthen the penalty.
• Close extra tabs and pause extensions or downloaders that call the site in the background.
• Try a different network only if you suspect shared-IP effects; the What Is My IP tool shows the address the site sees.
• Contact the site with the Ray ID if it persists for ordinary browsing.

If you run an API client or script

Slow down and be polite:

import time, requests

def get_with_backoff(url, tries=5):
    delay = 2
    for attempt in range(tries):
        r = requests.get(url, headers={"User-Agent": "my-tool/1.0 (contact: me@example.com)"})
        if r.status_code != 429:
            return r
        retry_after = r.headers.get("Retry-After")
        time.sleep(int(retry_after) if retry_after and retry_after.isdigit() else delay)
        delay *= 2
    return r

• Respect Retry-After if the response includes one.
• Use exponential backoff and a hard cap on retries.
• Cache responses and reduce polling frequency; use webhooks or conditional requests where an API offers them.
• Ask the site owner about an official API or an allowlisted IP rather than trying to evade limits.

If you are the site owner

Find the rule

Open the Cloudflare dashboard, go to your domain's Security area, and look at rate limiting rules and Security Events. Filter events by Ray ID or by the rule's action to see which rule fired. The event shows the rule name, so you can see which URL path and threshold matched.

Tune it

Cloudflare's guidance is to review the thresholds if your rules are too restrictive, for example blocking users within just a few seconds; consider a longer measurement window of 10 seconds or more. Practical changes:

• Raise the request threshold or lengthen the counting period so ordinary page loads do not hit it.
• Narrow the match expression to the sensitive endpoints, such as /wp-login.php, /api/login or /search, rather than the whole site.
• Count only what matters, for example only POST requests or only requests returning errors, if your plan supports that.
• Exclude trusted traffic, such as your office IP, payment webhooks and your monitoring service, with a skip rule or allowlist.
• Pick a gentler action like a managed challenge for borderline cases, and shorten the block duration.
• Check plugin behavior in WordPress; heavy admin-ajax polling is a common false trigger.

Available characteristics, actions and limits depend on your Cloudflare plan, so check Cloudflare's current rate limiting documentation.

How to verify

Wait out the block period and request the URL once. Confirm a normal response with the HTTP स्टेटस चेकर, and inspect response headers with the HTTP Header Checker to see whether Cloudflare is involved. The Cloudflare एरर चेकर identifies the error from outside. As an owner, replay a burst of requests against a test path and confirm the rule fires only at the threshold you intended.

अगले कदम

• Identify the error with the Cloudflare एरर चेकर.
• Read DDoS basics for website owners.
• If you got a different block page, see Cloudflare error 1020.
• Review Cloudflare setup, DNS and SSL modes.

सामान्य प्रश्न

How long does a 1015 block last?

It depends on the rate limiting rule the site owner configured. It may be a short period, and it usually ends sooner if you stop sending requests.

Is 1015 a ban?

No. It is a temporary throttle tied to a rule. A permanent block would come from a different rule, often shown as error 1020.

Why am I limited when I only opened one page?

A page can trigger many requests, and shared IPs add traffic from other users. The site's rule may also be strict for that path.

Can I change the limit if I am just a visitor?

No. Only the site owner can edit the rule. Wait, reduce request rate, and contact them if it keeps happening.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.