Cloudflare Turnstile

Turnstile runs a set of non-interactive probes in the browser — lightweight proof-of-work, browser-integrity checks, behavioural signals — and combines them with what Cloudflare’s network already knows about the connection. Most visitors see a box that resolves itself and never touch it.

You verify the resulting token server-side, exactly as with the others. If your site is already behind Cloudflare, the same dashboard carries WAF rules and rate limiting, so the pieces compose without a second vendor.

The design choice worth naming: Turnstile is not trying to prove the visitor is human. It is trying to establish that the client is a genuine browser being used in a genuine way. That is a narrower claim, and it is why it can be made without a puzzle.

Commodity automation broadly, and a good deal of headless-browser traffic that reCAPTCHA v2 waves through, because the integrity checks look at the environment rather than at whether someone can identify a crosswalk.

It also stops it without charging your buyer. That matters more than it sounds. Every other challenge on this site trades conversion for protection and the trade is rarely measured; Turnstile is the only one where the trade is close to free, which means it is the only one you can leave on across an entire site without wondering what it cost you.

Three ways, in ascending order of how much they should worry you.

• Solver services added support. Turnstile is a standard product line for the same market that sells reCAPTCHA and hCaptcha tokens. Being newer bought a delay, not an exemption.
• Residential proxy pools defeat the network half. Cloudflare’s reputation signal is strong against datacentre traffic and much weaker against a rotating pool of real consumer connections — see IP and rate limiting for why that pool is cheap.
• A real browser, driven by a real person, passes. This is not a bypass. It is the specification working as written.

That third point is the one that decides whether Turnstile solves your problem, and the answer depends entirely on which problem you have. If your traffic looks like this, Turnstile helps enormously:

If it looks like this, Turnstile changes nothing, because there is no automation to detect:

As your default challenge, on every form, replacing whatever you are running now. There is no scenario in which reCAPTCHA v2 is the better choice on a form you are building today, and the migration is small.

Pair it with the rate limiting in the same dashboard rather than treating them as alternatives — the challenge handles the sophisticated single request, the limit handles the unsophisticated thousand.