Cloudflare Error 1015: You are being rate limited

Identify: does your log match?

HTTP/2 429
server: cloudflare
cf-ray: 8d2f4a1b7c3e2f10-FRA
retry-after: 60
content-type: text/html; charset=UTF-8

Error 1015
Ray ID: 8d2f4a1b7c3e2f10 • 2026-10-22 09:14:03 UTC
You are being rate limited
The owner of this website (api.example.com) has banned you temporarily from accessing this website.

1. High

   Client exceeded a rate limiting rule

   Scrapers, retry loops or CI jobs from one IP send more requests than the rule allows per period. Cloudflare blocks until the mitigation timeout ends.

2. Medium

   Shared egress IP counted as one client

   Corporate NAT, CGNAT or a serverless platform's shared IPs aggregate many real users into a single counter.

3. Medium

   Rule too broad for API traffic

   A rule written for /login also matches /api/*, so legitimate high-frequency API clients get blocked.

Fix

for (const url of urls) {
  const res = await fetch(url);
  if (!res.ok) continue;
}

async function get(url: string, tries = 5): Promise<Response> {
  for (let i = 0; ; i++) {
    const res = await fetch(url);
    if (res.status !== 429 || i >= tries) return res;
    const wait = Number(res.headers.get('retry-after') ?? 2 ** i) * 1000;
    await new Promise(r => setTimeout(r, wait + Math.random() * 250));
  }
}

Verify: reproduce it on purpose

$ for i in $(seq 1 500); do curl -s -o /dev/null -w "%{http_code}\n" https://your-site.example/api/ping; done | sort | uniq -c

Prevent

• Expose rate limits in your API docs with Retry-After.
• Use Security Events in the dashboard to see which rule fired.
• Exempt health checks and known partners with a skip rule.