Cloudflare Turnstile
CAPTCHA-free bot verification from Cloudflare — a lightweight widget that confirms visitors are human without puzzles, friction, or data collection.
Use Cases
Free Tier
Free for unlimited challenges on the standard plan — no request caps, no bandwidth charges, works without Cloudflare DNS
How to Maximize the Free Tier
Turnstile is free at unlimited volume on the standard plan — there is no quota to budget, so it slots into any stack without cost anxiety. The non-negotiable: validate every token server-side via the Siteverify API — tokens expire after 5 minutes and can only be redeemed once, so an unchecked widget gives you zero protection. Create separate widgets for development, staging, and production, and restrict widget hostnames to domains you control. Because it works on any site regardless of whether it's proxied through Cloudflare, you can drop it into a Netlify-hosted form, a Supabase-backed login, or a Vercel app. Combine it with Formspree or Web3Forms (both in the directory) for fully spam-free static-site forms. Watch the Turnstile analytics tab for low token-validation rates — that signals your server-side check is misconfigured.
Getting Started
1. Create a free Cloudflare account. 2. In the dashboard, go to Turnstile and add a site (enter your domain and widget hostnames). 3. Copy the sitekey and secret key. 4. Add the Turnstile script and widget to your form or page HTML. 5. On form submit, send the token to your backend and verify it with the Siteverify API (POST https://challenges.cloudflare.com/turnstile/v0/siteverify). 6. Check the Turnstile analytics to confirm tokens are being validated.
Pros
- Unlimited free tier: No request caps on the standard plan — scales with your traffic at zero cost
- Invisible UX: Most visitors pass a silent challenge with no puzzle or interaction, unlike traditional CAPTCHAs
- Easy migration: Drop-in replacement for reCAPTCHA/hCaptcha; works on any domain, not just Cloudflare-proxied sites
Cons
- Cloudflare account required: You must sign up for Cloudflare even if you don't use any other Cloudflare service
- Server-side validation mandatory: Protection only works if you implement the Siteverify API check — skipping it voids all bot blocking
- Enterprise escalation: Heavy bot-management needs route to paid Cloudflare Bot Management, not Turnstile