Cloudflare 1010 / 403 when calling a Cloudflare-proxied site from Python urllib or requests

Problem

Calling a site behind Cloudflare with Python's default User-Agent returns 403 with Cloudflare error 1010 while curl or a browser get 200. Even the site's own public API endpoints fail.

Error (redacted / normalized)

HTTP Error 403: Forbidden
<title>Access denied | ... used Cloudflare to restrict access</title>
error code: 1010

Applies when

Any OS; Python urllib or requests with default User-Agent (Python-urllib/3.x, python-requests/2.x); target behind Cloudflare with Browser Integrity Check on

Confirm it is this problem

curl -sI -A 'Python-urllib/3.12' <url> | head -1 → expect: HTTP/2 403，而 curl -sI -A 'Mozilla/5.0' <url> → 200。响应体含 error code: 1010。

Not this when / boundary

If the body says error code: 1020 the IP/path is blocked by a firewall rule (UA change will not help); 1015 is rate limiting; a challenge page (cf-mitigated: challenge) needs a browser, not a header.

Root cause

Cloudflare's Browser Integrity Check blocks requests whose User-Agent is on its known-automation list. Error 1010 specifically means the UA was banned, not the IP.

Fix

1. Send a browser-like User-Agent header, e.g. Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36.
2. In urllib: urllib.request.Request(url, headers={'User-Agent': UA}); in requests: requests.get(url, headers={'User-Agent': UA}).
3. If you own the site, add a WAF skip rule for your API paths instead of relying on UA tricks.

How to verify

The same request returns 200 and JSON instead of the Cloudflare HTML page.

What did not work

Retrying with backoff (it is deterministic, not rate limiting); adding Accept headers alone; switching to IPv4.

Risks

None; the UA header is just a string. Do not spoof to bypass a site's explicit automation policy.

Verified scope

Cloudflare Browser Integrity Check, 2026-10