How to Fix Cloudflare Error 1020 When Scraping (2026 Guide)

You pointed requests or Playwright at a target and got Error 1020: Access denied. The HTML never arrived. In 2026, Cloudflare sits in front of a large share of retail, SaaS, and media sites — so every scraping team hits 1020 eventually.

This guide is a fix order that works in production: diagnose the layer, apply the smallest change that clears the block, then scale.

What Cloudflare 1020 actually means

Error 1020 is not a generic HTTP status — it is Cloudflare-specific. The edge proxy decided your request should not proceed. Typical triggers:

1. IP reputation — datacenter ASN, burned residential, or geo mismatch
2. TLS / JA3 fingerprint — Python requests does not look like Chrome
3. Missing post-challenge state — you need cookies from a JS interstitial
4. Behavior — burst concurrency, identical headers, no referrers

1015, 1020, and 429

These three show up in the same logs and they are not the same failure.

If the body says error 1015, read How to fix Cloudflare error 1015. HTTP 429 is covered in proxy errors 403 and 429 and the 403/429 solution.

Step 1: Confirm it is Cloudflare (not origin 403)

Check headers for cf-ray, server: cloudflare, or HTML containing cdn-cgi/challenge. If present, tuning origin headers will not help — you are blocked at the edge.

For a quick sanity check, route one request through Aethyn Premium residential at proxy.aethyn.io:2099 and compare pass rate. If 1020 disappears, reputation was the primary issue. If it persists, move to TLS and JS layers.

Step 2: Fix IP reputation first

See our solution guide for scraping behind Cloudflare for a Playwright + Elite workflow.

Step 3: Upgrade transport — browser-grade TLS

Cloudflare Bot Management compares your TLS fingerprint (JA3/JA4) to known browsers. Plain urllib and requests fail this check on strict sites.

Fix: drive the page with Playwright over Aethyn proxies. The browser supplies legitimate TLS, HTTP/2 settings, and JS execution for interstitials.

Read the deep dive: TLS fingerprinting for scrapers.

Step 4: Handle JS challenges and cookies

On Managed Challenge or Interactive Challenge pages:

1. Launch Playwright with proxy at browser context level
2. Wait for networkidle or a known selector
3. Export cookies to your HTTP client if you must drop to requests afterward
4. Keep sticky sessions — rotating mid-challenge resets suspicion

Do not screenshot-solve CAPTCHAs on sites you are not authorized to test.

Step 5: Pace like a human

Even perfect IPs fail if you send 200 parallel requests per second.

• Cap concurrency (start at 3–5 workers per domain)
• Randomize inter-request delay (200–800 ms jitter)
• Rotate User-Agent only when you rotate IP — mismatched pairs score badly
• Cache aggressively — fewer requests means fewer chances to trigger 1020

Premium vs Elite for Cloudflare targets

Aethyn Premium starts at €2.00/GB; Elite adds stricter sourcing and city/ISP targeting for hard exits.

When to stop fighting 1020

If the data is available via an official API, partner feed, or licensed dataset — use that first. Proxies are for public web collection, not for circumventing access controls on systems you should not touch.