Cloudflare Turnstile

A managed widget that runs browser checks in the background and usually passes with no interaction; when it is unsure it shows a single checkbox, never an image puzzle. Free, with no traffic limits.

Vendor

Cloudflare

Launched

September 2022 (beta), generally available 2023

Type

Managed challenge; visible, invisible and non-interactive modes

Can I install it?

Yes, free key from the Cloudflare dashboard, no Cloudflare DNS required

Price

Free

Replace with

CleanTalk when you need a content and reputation check, not only a browser check

Three test keys, three outcomes

Cloudflare dummy keys

1x...AA - always passes

Renders and passes without a click.

2x...AB - always blocks

This is what a rejected visitor sees. Few test pages show the failure state.

3x...FF - forces the interactive challenge

The checkbox Turnstile shows when it is unsure about you.

Time it in the full test

What the visitor goes through

Usually nothing: the widget spins for a second and shows "Success". When the browser looks unusual it asks for one checkbox click. There are no image puzzles.
Privacy browsers, Tor and hardened Firefox builds fail more often, and a failed Turnstile check is a dead end for the visitor: there is no "try a different puzzle".

How it gets bypassed

Solver services list Turnstile alongside reCAPTCHA and hCaptcha and sell tokens for it; a bot running a real browser profile often passes on its own.
Turnstile checks the browser, not the sender or the message. A person pasting a sales pitch passes like everyone else.

What it costs

Close to zero seconds for most visitors, which is why it replaced hCaptcha on Cloudflare's own challenge pages. The cost is the users it wrongly rejects, and the spam it never looks at: content and sender reputation are outside its scope.

Embed code

Keys below are Cloudflare's public dummy keys; use your own site key in production.

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<form method="post">
  ...
  <div class="cf-turnstile" data-sitekey="1x00000000000000000000AA" data-theme="light"></div>
  <button type="submit">Send</button>
</form>
<!-- server: POST https://challenges.cloudflare.com/turnstile/v0/siteverify with secret + cf-turnstile-response -->

Browser check is not a sender check

Turnstile asks "is this a browser?". CleanTalk asks "is this sender a spammer?" and reads the message too. Keep Turnstile if you like it, or replace it and lose nothing.

1,105,000+ websites protectedup to 99.97% accuracylive in 60 seconds7-day free trial, no card

Start 7-day free trial Run the full test

Sources: developers.cloudflare.com/turnstile (client-side rendering; testing: dummy sitekeys 1x...AA always passes, 2x...AB always fails, 3x...FF forces interactive challenge); Cloudflare blog, Turnstile announcement, September 2022. Related: hCaptcha, reCAPTCHA v3. CleanTalk is not affiliated with Cloudflare.