Turnstile
Turnstile is Cloudflare's CAPTCHA alternative: a small widget that confirms a visitor is human using invisible browser challenges — no traffic lights to click, no distorted text, and no user data sold to anyone.
Overview
Traditional CAPTCHAs tax your legitimate users to inconvenience your attackers — and the economics have inverted: solving services and ML models crack picture puzzles cheaply, while real humans abandon forms rather than fight them. Every extra second of friction on a signup or checkout form measurably costs conversions.
Turnstile replaces the puzzle with non-interactive browser challenges: small proofs of work and behavioural signals evaluated in the visitor's browser, invisible in the vast majority of cases. It drops into any site as a widget wherever you would have used reCAPTCHA or hCaptcha, and it works on any website — your site does not need to be on Cloudflare.
Key capabilities
- Invisible verification for most visitors — no image puzzles or text challenges, ever
- Three widget modes: managed (Cloudflare decides if interaction is needed), non-interactive, and fully invisible
- Drop-in compatibility with reCAPTCHA-style integration patterns, making migration straightforward
- Works on any website, whether or not the site's traffic runs through Cloudflare
- Server-side verification via the Siteverify API, so tokens cannot be replayed or forged
- Privacy by design: no ad-tracking cookies, no selling of user data, minimal data collection
- Pre-clearance integration with Cloudflare WAF/Bot Management to reduce repeat challenges on protected sites
- Analytics on solve rates, widget performance and suspicious activity
How it works
You embed a lightweight JavaScript widget on pages you want to protect — login, registration, checkout, contact forms. In the visitor's browser, Turnstile runs a rotating set of non-interactive challenges: JavaScript proofs of work, checks of browser environment consistency, and behavioural signals, backed by the machine-learning insight Cloudflare gains from the bot traffic it fights across its network. Most humans see nothing but a brief spinner and a checkmark.
On success the widget produces a one-time token, which your frontend submits with the form. Your backend then calls the Siteverify API to validate the token before accepting the action — this server-side step is essential, as it is what prevents bots from simply replaying or fabricating tokens.
If your site also runs behind Cloudflare, Turnstile can issue clearance that WAF and Bot Management respect, so a verified user is not re-challenged as they browse. Signals never depend on tracking users across the web, which is what allows Turnstile to be both effective and compliant with strict privacy expectations.
Plans & licensing
Turnstile is free for typical use, including commercial sites, with generous widget and hostname allowances. An Enterprise tier adds higher limits and enterprise features and support. It requires no Cloudflare zone plan at all. As of 2026, subject to change — confirm current limits with us.
Deployment with Integrity
As a certified Cloudflare partner for Central and Eastern Europe, Integrity delivers this product end to end — including a free pilot so you see results on your own traffic before committing. A typical rollout:
- Assessment. We identify the forms and endpoints suffering abuse — fake signups, credential stuffing, spam — and any existing CAPTCHA to replace.
- Free pilot. Turnstile is added to one high-abuse form alongside server-side verification; we compare bot volume and human completion rates against the previous state.
- Integration. Widgets roll out across forms; backend verification is implemented in each service accepting protected submissions; old CAPTCHA dependencies are removed.
- Tuning. Widget modes are chosen per form (invisible where possible), and analytics are reviewed for solve-rate anomalies.
- Defence in depth. Where the site runs on Cloudflare, Turnstile is paired with WAF rate limiting and bot rules for layered protection.
- Handover. Your developers get the integration documented and tested — and talk to us if abuse patterns later change.
Ready to start? Contact us to arrange the free pilot.
FAQ
Do visitors ever see a puzzle?
No. Turnstile never shows image or text puzzles. In managed mode a small minority of suspicious sessions may be asked for a single checkbox click; everyone else sees at most a brief automatic verification.
How hard is migrating from reCAPTCHA?
Usually hours, not days. The client-side widget follows the same implicit/explicit rendering patterns, and the server-side change is swapping one verification endpoint and secret for another. We have done drop-in replacements without any form redesign.
Is Turnstile enough to stop bots on its own?
It is a strong gate for the forms it protects, but determined attackers probe APIs and endpoints without widgets too. Treat Turnstile as one layer: combined with rate limiting and (on Cloudflare-proxied sites) bot scoring, the whole becomes much stronger than any single control.