Beginner’s Guide to Cloudflare Turnstile 2026
Wondering how to add Cloudflare Turnstile to your website? It takes about ten minutes: create a widget, drop in a script, and validate a token on your server. This guide walks through the exact steps, free-tier limits, and an honest verdict for indie hackers — and for the short version, see our Cloudflare Turnstile free tier overview. Cloudflare’s official Turnstile docs
Verdict
Cloudflare Turnstile is an 8/10 for indie hackers. The free plan offers unlimited challenges, up to 20 widgets, and WCAG 2.2 AAA compliance — genuinely rare for bot protection. It’s a privacy-first, invisible alternative to CAPTCHAs that works on any hosting setup. The only real friction: you’ll write server-side validation code yourself.
How This Guide Was Built
This review is based on official documentation, pricing pages, and community reports — we did not run the tool hands-on. We verified free-tier limits, widget setup steps, and platform availability from Cloudflare’s official Turnstile pricing page and product documentation. We did not test performance, latency, or visual behavior in a live browser. Last verified: August 2026.
What Is Cloudflare Turnstile?
Cloudflare Turnstile is a CAPTCHA-free bot verification widget that runs a JavaScript challenge in the visitor’s browser, then produces a token your server verifies via Cloudflare’s Siteverify API. It’s designed to be invisible to humans while blocking automated traffic, and it works on any website regardless of your CDN. Cloudflare’s official Turnstile docs
How does Turnstile verify visitors without a CAPTCHA?
Instead of asking users to identify traffic lights, Turnstile runs a non-interactive browser challenge that analyzes non-intrusive browser signals. On success, it generates a token (up to 2,048 characters) that your server sends to Cloudflare’s Siteverify API for confirmation. The entire process typically completes without user interaction. Cloudflare’s official Turnstile docs
How Do I Add Cloudflare Turnstile to My Website?
Adding Cloudflare Turnstile requires three steps: create a widget in your dashboard, embed the client-side script, and validate the token on your server. You’ll need a Cloudflare account, a website to protect, and basic familiarity with HTML and a server-side language. Cloudflare’s official Turnstile docs
Step 1: Create a widget in the Cloudflare dashboard
Log into your Cloudflare account, navigate to Turnstile, and click “Add Widget.” You’ll choose a widget name and hostname(s) — the free plan allows up to 10 hostnames per widget. Cloudflare then issues a sitekey (public) and a secret key (private). The sitekey goes in your HTML; the secret key stays server-side. Cloudflare’s official Turnstile docs
Step 2: Embed the widget on your page
Add the Turnstile JavaScript snippet to your HTML, typically inside your form. Use the sitekey in the widget’s sitekey attribute. The script renders a challenge automatically — no user interaction required. Cloudflare’s official Turnstile docs
Step 3: Validate the token server-side
After form submission, your server receives a cf-turnstile-response token. POST it to https://challenges.cloudflare.com/turnstile/v0/siteverify with your secret key. The API returns a JSON response with a success boolean. Only accept the submission if success is true. This step is mandatory — never trust the client-side widget alone. Cloudflare’s official Turnstile docs
What Do You Get for Free on Cloudflare Turnstile?
The free plan includes unlimited challenges (traffic or verification requests), up to 20 widgets per account, 10 hostnames per widget, all widget types, pre-clearance support, and WCAG 2.2 AAA compliance. Analytics lookback is capped at 7 days, ephemeral IDs are unavailable, and Cloudflare branding stays visible. Community support is included. Cloudflare’s official Turnstile pricing page
Cloudflare Turnstile vs reCAPTCHA vs hCaptcha: Free-Tier Comparison
Community reports suggest reCAPTCHA v2/v3 and hCaptcha are the main alternatives, with Turnstile often chosen for privacy and invisible UX. On the free tier, Turnstile offers unlimited challenges and 20 widgets; reCAPTCHA and hCaptcha also have free tiers but with different quota structures and privacy trade-offs. Turnstile’s key edge is its non-interactive nature and Cloudflare’s infrastructure. We did not test reCAPTCHA or hCaptcha hands-on.
Pros and Cons of Cloudflare Turnstile
Pros: Free plan is genuinely unlimited on challenges; works on any website (not just Cloudflare-proxied); WCAG 2.2 AAA compliance; no data harvesting for ad retargeting; runs on infrastructure powering 20% of the Internet. Cloudflare’s product page
Cons: 20-widget cap per account; 7-day analytics lookback; no ephemeral IDs; Cloudflare branding remains; requires server-side code; community support only on free tier. Cloudflare’s official Turnstile pricing page
FAQ
Does Turnstile work if I’m not on Cloudflare’s CDN?
Yes. Turnstile is an independent service that works on any website — whether you’re on AWS, Netlify, on-premises, or another CDN. It doesn’t require your site to be proxied through Cloudflare. This makes it a flexible choice for multi-cloud setups. Cloudflare’s official Turnstile docs
Is Cloudflare Turnstile really unlimited on the free plan?
Yes, the free plan offers unlimited challenges, meaning no traffic or verification request caps. The limits are on widgets (20 per account) and hostnames (10 per widget), not on usage volume. This makes it suitable for most production applications. Cloudflare’s official Turnstile pricing page
What happens if I exceed 20 widgets on the free plan?
Free accounts are limited to 20 widgets per account. To add more, you would need to delete existing widgets or contact Cloudflare — the docs note customers with Enterprise Bot Management and Enterprise Turnstile can have the limit increased. Enterprise plans offer unlimited widgets and up to 200 hostnames per widget. For most indie hackers, 20 widgets is ample, since one widget can be reused across the hostnames you register. Cloudflare’s official Turnstile pricing page