Cloudflare error pages, explained for visitors and site owners
Last verified
Cloudflare sits between visitors and millions of websites, so its error pages are what people see when something goes wrong in either direction. Two very different families share the same branded page. The 1xxx errors (1020, 1015, 1010, 1009, 1005 and others) mean the site owner's own Cloudflare settings stopped the request: a firewall rule, a rate limit, a country or network ban. The 52x errors (520 to 526) mean Cloudflare could not get a good response from the website's own server, which is a problem on the site's side, not yours. A third case, the challenge page that says "Verify you are human", means the owner wants to confirm a real browser is present before serving the page.
Scripts and browser automation hit the 1xxx family far more often than people do, because owners use Cloudflare precisely to filter automated traffic. When that happens, the error is a statement of the owner's policy. Every entry below explains the meaning from both sides: what a visitor or automation user can legitimately do (wait, slow down, use an official API, ask the owner for access with the Ray ID), and what a site owner should check in Cloudflare to confirm or adjust the rule. None of the entries describe ways to get past a block or challenge on a site you do not control.
Every Cloudflare error page shows a Ray ID. It is the single most useful piece of information: site owners can search it in Security Events to see which rule fired and why. Generic HTTP status codes such as 403 and 429 are covered in the web scraping HTTP errors reference.
Official reference: Cloudflare Docs - HTTP status codes and Cloudflare errors
How to read a Cloudflare error
A Cloudflare error response identifies itself in the headers and the page:
HTTP/1.1 403 Forbidden
Server: cloudflare
CF-RAY: 8a1b2c3d4e5f6789-AMS <- Ray ID + data center code
cf-mitigated: challenge <- present only on challenge pages
Error 1020 Ray ID: 8a1b2c3d4e5f6789
Access denied1xxx codes come from the owner's security configuration. 52x codes are about the connection between Cloudflare and the origin server. Quote the Ray ID and the time (with time zone) whenever you contact a site owner.
All 16 messages
Jump to: Blocked by the site's security rules (7) · Rate limiting (1) · Challenge pages (1) · Origin server errors (520-524) (5) · Origin SSL errors (525-526) (2)
Blocked by the site's security rules
| Message |
|---|
| Error 1020: Access denied |
Error 1010: Browser signature bannedError 1010: The owner of this website has banned your access based on your browser's signature |
Error 1009: Country or region bannedError 1009: Access denied: Country or region banned |
Errors 1006, 1007, 1008: Your IP address has been bannedAccess denied: Your IP address has been banned |
| Error 1012: Access Denied |
Error 1005: ASN bannedError 1005: Access Denied: Autonomous System Number (ASN) banned |
Sorry, you have been blockedSorry, you have been blocked. You are unable to access example.com |
Rate limiting
Challenge pages
| Message |
|---|
"Checking if the site connection is secure" / "Verify you are human"Verify you are human by completing the action below. example.com needs to review the security of your connection before proceeding. |
Origin server errors (520-524)
| Message |
|---|
Error 520: Web server returns an unknown errorError 520: Web server is returning an unknown error |
| Error 521: Web server is down |
| Error 522: Connection timed out |
| Error 523: Origin is unreachable |
| Error 524: A timeout occurred |
Origin SSL errors (525-526)
Definitions
- CAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response m
- Cloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Ente
- Cloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, is
- User AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and
- Rate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given
Other error directories
- Google Apps Script errors16 messages
- Google Sheets IMPORT functions errors15 messages
- HTTP errors in web scraping and automation errors15 messages
- Make (formerly Integromat) errors9 messages
- n8n errors11 messages
- Playwright errors16 messages
- Puppeteer errors15 messages
- Selenium WebDriver errors14 messages
- Zapier errors8 messages
Frequently asked questions
Is a Cloudflare 1xxx error Cloudflare's fault?
Usually not. The 1xxx errors are produced by settings the website owner configured in Cloudflare, such as firewall rules, rate limits and country or network bans. Cloudflare's own documentation says it cannot override the owner's security settings. The owner is the person to contact, and the Ray ID on the page lets them find the exact rule.
What is a Cloudflare Ray ID?
A Ray ID is a unique identifier Cloudflare assigns to every request, shown on error pages and returned in the CF-RAY response header. The suffix is the code of the Cloudflare data center that handled the request. Site owners search it in Security Events or logs to see which rule blocked a request, so include it in any support message.
How long does Cloudflare error 1015 last?
As long as the site owner configured. Rate limiting rules have a counting period and a mitigation timeout, which the owner sets. Some last seconds, others minutes or longer. Cloudflare's advice to visitors is to wait and try again later. Sending more requests during the block can keep you over the threshold, so pause completely before resuming at a lower rate.
Why does my script get a Cloudflare error when my browser does not?
Cloudflare and the site's rules see different signals from each. Scripts often run from cloud networks, send no cookies, use library default User-Agents, cannot run challenge JavaScript, and request pages quickly. Owners commonly block or challenge exactly those patterns. The legitimate path is the site's API, a lower request rate, or asking the owner for access.
Can I bypass Cloudflare to scrape a site?
This reference does not cover bypassing Cloudflare, because a Cloudflare block or challenge is the site owner's chosen policy. Working around it can breach the site's terms and, in some jurisdictions, the law. Check robots.txt and the terms, look for an official API or data export, or contact the owner with your use case and the Ray ID.
Are 52x errors caused by my request?
Almost never. Errors 520 to 526 describe the connection between Cloudflare and the website's own server: the server crashed, refused or dropped the connection, took too long, or has a certificate problem. Retrying later is the only client-side step. Site owners should check origin logs, firewall rules for Cloudflare IPs, and origin certificates.
What is the Cloudflare 524 timeout?
Cloudflare waits a fixed time for the origin to start responding after it sends a request. Cloudflare's current documentation gives a default Proxy Read Timeout of 125 seconds, adjustable up to 6,000 seconds on Enterprise. Older references cite 100 seconds. Long-running work should respond immediately and let clients poll for the result.
How do site owners let a legitimate integration through?
Owners can add WAF skip rules or IP Access allow rules for a partner's fixed IPs, exempt API paths from challenges, rely on Cloudflare's verified bots list for known crawlers, or issue API credentials. Narrow exceptions are safer than lowering protection for everyone. Integrators should ask, providing their IPs and a contact.
Retries and timeouts without writing the loop
Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.