Turnstile explained.
Turnstile is Cloudflare's free, privacy-friendly CAPTCHA alternative that confirms a visitor is human with a mostly non-interactive challenge, usually with no puzzle to solve.
How Turnstile works
Turnstile runs a small widget in the visitor's browser that quietly gathers signals (how the page was loaded, browser characteristics, small proof-of-work checks) and decides whether the visitor looks human, most often without showing a puzzle at all. When it is satisfied it hands the browser a short-lived token, which the form sends along with the submission. Your server then calls Cloudflare's verify endpoint with that token and your secret key, and Cloudflare answers with a simple pass or fail.
Because the token is single-use and checked server-side, a bot can't just fake a passing value in the HTML. Unlike Google's reCAPTCHA, Turnstile is free at any volume and is built to avoid tracking visitors for advertising.
For a form backend, Turnstile is a spam-protection layer you can require in front of the endpoint, so a submission without a valid, verified token is rejected before it is ever stored or delivered.
Why teams reach for Turnstile.
Usually no puzzle
Most visitors pass without clicking anything, so you filter bots without the friction of picking traffic lights out of a grid.
Verified server-side
The browser gets a single-use token and your server confirms it with Cloudflare, so a forged value in the form doesn't get through.
Free and privacy-first
It is free at any volume and built to avoid profiling visitors for ads, which keeps it clear of most consent headaches.
Related questions
Turnstile is a kind of CAPTCHA, just a quieter one. A classic CAPTCHA makes the visitor solve a visible puzzle, while Turnstile usually scores the visitor invisibly and only escalates to interaction if it is unsure, so the human cost is far lower.
CAPTCHA, defined →Yes. Cloudflare offers Turnstile free at any volume, which is a large part of its appeal next to reCAPTCHA's paid tiers. You create a site key and a secret key in the Cloudflare dashboard and use them in your form and on your server.
Layering is still wise. A honeypot costs real visitors nothing and quietly catches naive bots, so running it alongside Turnstile means you are not betting all your spam protection on a single check that a determined attacker might target.
No single check does. Turnstile stops the vast majority of automated abuse, but sophisticated or well-funded attackers can still get through, which is why serious setups combine it with a honeypot and rate limiting rather than relying on one layer.
Want to see it working?
Read the docsAdd a human check without the puzzle.
Free tier forever. No credit card required.