Glossary
What is Cloudflare Turnstile?
Cloudflare Turnstile is a free CAPTCHA alternative that verifies visitors are human mostly without puzzles, using a series of small browser challenges and signals in the background. Site owners embed it on forms. It was the most common bot check on the directory submit forms we recorded: 35 of 352.
How it works
Turnstile runs non-interactive JavaScript challenges in the browser (proof-of-work, environment checks and other signals) and returns a token the site verifies on its server. Most real visitors see a brief spinner or a checkbox and pass. It doesn't use image puzzles, and Cloudflare positions it as more private than traditional CAPTCHAs.
Widget modes
| Mode | Visitor sees |
|---|---|
| Managed | A checkbox only when needed |
| Non-interactive | A spinner, no interaction |
| Invisible | Nothing |
Turnstile and agents
In a person's everyday browser, Turnstile usually passes without interaction, including when an agent is filling the form through an extension. In headless or server environments, it fails or challenges far more often. When it does demand interaction, the agent should hand control to the user.
Example
In our recorded flows, 35 directories used Turnstile. An agent working in the founder's own Chrome passed most invisibly; a server-based run of the same flows was challenged on nearly every one.
FAQ
Is Cloudflare Turnstile free?
Yes, for most uses, and it doesn't require using Cloudflare's CDN.
Does Turnstile track users?
Cloudflare says it doesn't use data for ad targeting and limits data collection.
Why does Turnstile keep failing for me?
Privacy extensions, automation flags or blocked JavaScript can cause failures.