What this error means

If a request to a Cloudflare-protected site comes back with a 1015 error, the site has decided you're sending too many requests too quickly and has temporarily blocked further access. It's a safeguard Cloudflare offers site owners to fend off things like DDoS attempts, brute-force login attacks, and heavy bot traffic — not a fault in your own systems.

You'll typically see it worded one of a few ways:

• "You are being rate limited"
• "Service resource is being rate limited"
• "This resource is being rate limited"

They all point to the same underlying block.

Why it happens

A 1015 only shows up on sites running Cloudflare's Web Application Firewall (WAF) or its bot-management layer, and it's usually triggered by one of these:

• Request volume — too many calls in a short window, whether that's a burst on purpose or just an unusually chatty integration
• Automated traffic — scripts, scrapers, or API clients that don't behave like a normal browser session
• Shared IPs — being on a network (office, VPN, shared hosting) where many users' traffic looks like it's coming from one source

How Cloudflare decides to block you

Two separate systems can produce this error:

The WAF inspects incoming traffic against a rule set and blocks anything that looks abusive — this includes rate-limit rules the site owner has configured around specific IPs, cookies/session tokens, request headers, or even browser fingerprinting signals.

Bot management looks at behavioural patterns to judge whether traffic is human. If it flags a client as automated, it can trigger a 1015 even if that client isn't actually sending an unusual number of requests — detection alone is enough.

Some blocks clear on their own after a cooldown period; others are effectively permanent until the traffic pattern changes, and repeated triggers can escalate into a harder block (Cloudflare Error 1020).

What to do about it

• Slow down. We can add even more delays between requests so we can stay under the site's threshold. This is not ideal.
• Spread the load. As we are making many requests from the same IP. Our developers can use their staging connection across multiple IPs avoids tripping per-IP limits.
• Turn it off or add exception - Your web host needs to understand that this is a business application providing real benefits back to the business and not something to be denied. Whilst it may have their server performing better ultimately, it doesn't meet the business requirements.