Cloudflare 403 Forbidden: Why You Get It and the Fix

A Cloudflare 403 means your request was refused, and one of three things refused it: a Cloudflare security rule, a failed challenge, or the website's own server. The status alone only says the server refuses to process the request (MDN: 403); the page that comes with it tells you which case you are in.

Per Cloudflare's Error 403 page, a 403 without Cloudflare branding comes from the origin server. A challenge page response always carries cf-mitigated: challenge (Detect a Challenge Page response; How challenges work).

Read the response, then change one thing at a time:

1. Read the page title and body. An "Error 10xx" code names the Cloudflare rule type. "Just a moment..." is a challenge. A plain site-styled 403 is the origin.
2. Read the headers. A cf-ray header (the Ray ID) and server: cloudflare tell you the response passed through Cloudflare (Cloudflare HTTP headers), not who blocked it. A cf-mitigated: challenge header means a challenge.
3. Open the same URL in a normal browser on the same IP. If it loads, the IP is not banned: the problem is your client.
4. Repeat from another IP and location. If it passes, the block is about IP reputation, network or country.
5. Slow down to one request every few seconds. If the 403s stop, a rate rule fired.

This Python requests snippet sends one request through the ProxyField gateway and prints the status, the Cloudflare headers, the title and any 10xx code. Replace <login>, <password> and the URL.

import re
import requests

proxy = "http://<login>-country-us-city-new_york:<password>@gate.proxyfield.io:7000"
r = requests.get("https://example.com/", proxies={"http": proxy, "https": proxy}, timeout=30)

print("status:", r.status_code)
for name in ("server", "cf-ray", "cf-mitigated", "retry-after"):
    print(name + ":", r.headers.get(name))
title = re.search(r"<title>(.*?)</title>", r.text, re.I | re.S)
print("title:", title.group(1).strip() if title else None)
code = re.search(r"Error\s*(1\d{3})", r.text)
print("cloudflare error code:", code.group(1) if code else None)

Fix the simplest cause first; each step says when it applies.

1. Slow down and back off

If the 403s start after a burst, or you see Error 1015 or a 429, a rate limiting rule fired. Lower concurrency, add random delays and back off on each error. If a Retry-After header is present, wait at least that long (MDN: Retry-After). Cloudflare's Error 1015 page warns that retrying within a short period can extend the block.

2. Send complete, consistent browser headers

If a plain HTTP client gets a 403 on its first request, or you see Error 1010, your headers give you away. Send a User-Agent that matches the client you really are, plus the Accept, Accept-Language and Accept-Encoding headers that browser sends (MDN: User-Agent). Error 1010 means the site banned your browser's signature (Error 1010). A Chrome User-Agent on a Python client does not make it Chrome: a claim the rest of the request contradicts can make things worse.

3. Use a real browser for JavaScript challenges

If the response has cf-mitigated: challenge, a plain HTTP client cannot pass: the challenge runs in the browser. Load the page with Playwright or Puppeteer and keep the cookies in one browser context for the session, so you are not challenged on every page. Setup: Playwright with proxies, Puppeteer with proxies. Cloudflare lists the browsers its challenges support; a headless browser can still be challenged.

4. Match the TLS and HTTP fingerprint to the browser you claim to be

If a browser-like client with correct headers is still blocked, the TLS handshake may be the tell. Cloudflare profiles TLS clients with JA3 and JA4 fingerprints and uses them among its bot detection engines. An HTTP library has its own fingerprint, whatever User-Agent it sends. The simplest consistent setup is a real browser (fix 3).

5. Change the IP type: residential, mobile or ISP

If another IP passes where yours fails, the rule is about IP reputation, network (ASN) or country. Datacenter ranges are the usual target of network-based rules. Move to residential proxies, mobile proxies or static residential (ISP) proxies. Keep one sticky IP for a whole challenge session and rotate between sessions, not inside one.

ProxyField gives you a new IP on every request (rotating proxies) or sticky sessions from 30 s to 36 h (presets 1, 5, 10, 30 min, 1, 3, 6 h), with country, region and city targeting. This Playwright launch uses the gateway with country and city targeting:

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(proxy={
        "server": "http://gate.proxyfield.io:7000",
        "username": "<login>-country-us-city-new_york",
        "password": "<password>",
    })
    context = browser.new_context()  # one context keeps one set of cookies
    page = context.new_page()
    response = page.goto("https://example.com/")
    print(response.status, response.headers.get("cf-mitigated"), page.title())
    browser.close()

Add a sticky session before you run a challenge flow: -session-<id>-ttl-<seconds> after the location, as in <login>-country-us-session-he9f2qga-ttl-600 (ttl is 30 to 129,600 seconds, 20 minutes by default). A new IP type does not change your headers, fingerprint or request rate, so fixes 1 to 4 still apply.

6. Use the site's API or a scraping API

If the site offers an official API or data export, use it. If not, ProxyField's web scraping API fetches any URL as plain HTTP or with JavaScript rendering, billed on successful results only. Contact sales.

7. If the block is deliberate, stop and ask

If the 403 comes from the origin, or the same rule blocks every IP and client you try, the site does not want automated access. Check its robots.txt (RFC 9309) and terms, and ask the owner for access. Getting past an access barrier the owner set up on purpose can raise legal risk: see is web scraping legal.

A residential IP can clear blocks based on IP reputation or datacenter ranges; it does not fix a mismatched browser fingerprint, missing JavaScript or a too-fast request rate.

On targets with no Cloudflare bot rules, cheaper per-GB datacenter proxies are usually enough.

403 is the HTTP status; the 10xx number on a Cloudflare page names the rule behind it:

• 1020 Access denied: a firewall rule on the site blocks you (Error 1020).
• 1015: too many requests in a given period (fix 1).
• 1010: the site banned your browser's signature (fix 2).
• 52x: the origin server failed, not your request.

The Cloudflare table on the errors hub lists the rest.

Hit a Cloudflare 403 while browsing? The site's rules flagged your connection:

• Turn off your VPN, proxy or browser extensions and reload.
• Clear the site's cookies, or try a private window.
• Still blocked? Send the Ray ID from the error page to the site owner; only they can change the rule.