How to Fix Cloudflare Error 1020 When Scraping (2026 Guide)

You pointed requests or Playwright at a target and got Error 1020: Access denied. The HTML never arrived. In 2026, Cloudflare sits in front of a large share of retail, SaaS, and media sites — so every scraping team hits 1020 eventually.

This guide is a fix order that works in production: diagnose the layer, apply the smallest change that clears the block, then scale.

What Cloudflare 1020 actually means

Error 1020 is not a generic HTTP status — it is Cloudflare-specific. The edge proxy decided your request should not proceed. Typical triggers:

1. IP reputation — datacenter ASN, burned residential, or geo mismatch
2. TLS / JA3 fingerprint — Python requests does not look like Chrome
3. Missing post-challenge state — you need cookies from a JS interstitial
4. Behavior — burst concurrency, identical headers, no referrers

Step 1: Confirm it is Cloudflare (not origin 403)

Check headers for cf-ray, server: cloudflare, or HTML containing cdn-cgi/challenge. If present, tuning origin headers will not help — you are blocked at the edge.

For a quick sanity check, route one request through Aethyn Premium residential at proxy.aethyn.io:2099 and compare pass rate. If 1020 disappears, reputation was the primary issue. If it persists, move to TLS and JS layers.

Step 2: Fix IP reputation first

See our solution guide for scraping behind Cloudflare for a Playwright + Elite workflow.

Step 3: Upgrade transport — browser-grade TLS

Cloudflare Bot Management compares your TLS fingerprint (JA3/JA4) to known browsers. Plain urllib and requests fail this check on strict sites.

Fix: drive the page with Playwright over Aethyn proxies. The browser supplies legitimate TLS, HTTP/2 settings, and JS execution for interstitials.

Read the deep dive: TLS fingerprinting for scrapers.

Step 4: Handle JS challenges and cookies

On Managed Challenge or Interactive Challenge pages:

1. Launch Playwright with proxy at browser context level
2. Wait for networkidle or a known selector
3. Export cookies to your HTTP client if you must drop to requests afterward
4. Keep sticky sessions — rotating mid-challenge resets suspicion

Do not screenshot-solve CAPTCHAs on sites you are not authorized to test.

Step 5: Pace like a human

Even perfect IPs fail if you send 200 parallel requests per second.

• Cap concurrency (start at 3–5 workers per domain)
• Randomize inter-request delay (200–800 ms jitter)
• Rotate User-Agent only when you rotate IP — mismatched pairs score badly
• Cache aggressively — fewer requests means fewer chances to trigger 1020

Premium vs Elite for Cloudflare targets

Aethyn Premium starts at €2.00/GB; Elite adds stricter sourcing and city/ISP targeting for hard exits.

When to stop fighting 1020

If the data is available via an official API, partner feed, or licensed dataset — use that first. Proxies are for public web collection, not for circumventing access controls on systems you should not touch.