Cloudflare 1010 / 403 when calling a Cloudflare-proxied site from Python urllib or requests

问题

Calling a site behind Cloudflare with Python's default User-Agent returns 403 with Cloudflare error 1010 while curl or a browser get 200. Even the site's own public API endpoints fail.

报错原文（已脱敏/规范化）

HTTP Error 403: Forbidden
<title>Access denied | ... used Cloudflare to restrict access</title>
error code: 1010

适用环境

Any OS; Python urllib or requests with default User-Agent (Python-urllib/3.x, python-requests/2.x); target behind Cloudflare with Browser Integrity Check on

如何确认是这个问题

curl -sI -A 'Python-urllib/3.12' <url> | head -1 → expect: HTTP/2 403，而 curl -sI -A 'Mozilla/5.0' <url> → 200。响应体含 error code: 1010。

不是这个问题时 / 边界

If the body says error code: 1020 the IP/path is blocked by a firewall rule (UA change will not help); 1015 is rate limiting; a challenge page (cf-mitigated: challenge) needs a browser, not a header.

根因

Cloudflare's Browser Integrity Check blocks requests whose User-Agent is on its known-automation list. Error 1010 specifically means the UA was banned, not the IP.

修复步骤

1. Send a browser-like User-Agent header, e.g. Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36.
2. In urllib: urllib.request.Request(url, headers={'User-Agent': UA}); in requests: requests.get(url, headers={'User-Agent': UA}).
3. If you own the site, add a WAF skip rule for your API paths instead of relying on UA tricks.

如何验证

The same request returns 200 and JSON instead of the Cloudflare HTML page.

试过没用的办法

Retrying with backoff (it is deterministic, not rate limiting); adding Accept headers alone; switching to IPv4.

风险提示

None; the UA header is just a string. Do not spoof to bypass a site's explicit automation policy.

验证范围

Cloudflare Browser Integrity Check, 2026-10