Access denied. The site owner has blocked access based on your browser’s signature. error_name: browser_signature_banned. HTTP 403.
What is the issue or error you’re encountering
A server-side GET using Python urllib to our own Worker on its workers.dev hostname returned Cloudflare HTTP 403 / Error 1010 at 2026-09-26 23:32:24 UTC. Which supported diagnostic path identifies the security control responsible for this rejection on a workers.dev hostname? Is there an owner-accessible event log or configuration, or does this require Cloudflare investigation? We want to diagnose the rejection without changing client identity to evade it or disabling security protections.
What steps have you taken to resolve the issue?
Checked the authenticated Workers dashboard:
The deployment and bindings are visible.
No custom domain or zone route is configured for this Worker.
The Access tab offers initial Zero Trust organization setup.
Workers Logs and Traces were disabled, so we do not have an invocation log proving whether the request reached the Worker. The recent invocation count was zero when checked; this alone does not establish the cause.
The free-plan support portal permits account, billing and registrar cases, and directs other technical questions to the community.
The response included a Cloudflare Ray ID, which can be provided through an appropriate diagnostic channel if requested. No credentials, headers, account IDs, customer data or internal admin path are included here. This technical report was prepared with AI assistance.
What are the steps to reproduce the issue?
The observed request was a read-only GET from a Python urllib client to an authenticated endpoint on the hostname above. Expected: the endpoint’s normal authenticated response. Observed: Cloudflare HTTP 403 / Error 1010 browser_signature_banned. We have not retried the rejected request, changed the client identity, or disabled security controls. We are omitting the protected endpoint path and credentials from this public post; this is not a public unauthenticated reproduction.
My own test Worker on a workers.dev subdomain previously returned HTTP 403 with Cloudflare Error 1010 on /health. I have no customer-managed Cloudflare zone for this endpoint. The Worker is currently disabled intentionally, and I am not making new test requests or changing settings.
My account’s Support portal displays the Free-plan restriction and only permits billing, account, and Registrar cases. There is no technical-case option available to me there.
I have not been able to identify the rule or configuration responsible for the response. Which dashboard location should a workers.dev owner check, or which administrative owner should they ask to investigate? What is the documented route for requesting a cause investigation in this situation?
On October 16, I could read the deployment and bindings in the authenticated dashboard. The workers.dev endpoint was disabled, with no custom domain or zone route configured. The account-level WAF page offered an Enterprise add-on but did not identify the control responsible for the historical HTTP 403 / Error 1010 response. These are management observations, not a new runtime test.
Could Cloudflare staff or a moderator clarify:
Which team or administrative owner can investigate Error 1010 on a workers.dev hostname when the customer has no Cloudflare-managed zone?
Which documented investigation channel is available to a Free-plan owner when the support portal offers no technical-case option, and how should the existing Ray ID and timestamp be supplied privately?
Is there an existing read-only diagnostic view that can identify the control without re-enabling the endpoint or reproducing the rejected request?
I am seeking the responsible diagnostic channel. This follow-up does not include a new request to the Worker, a user-agent or domain change, or a security-setting change. No credentials or customer data are included. Prepared with AI assistance.
As previously stated, you need to either set an appropriate User-Agent header on your requests, or use a custom domain so you can change the security settings to bypass or disable Browser Integrity Check.
Please stop pasting in AI slop, it’s not helping you.