Overview
Cloudflare’s smart CAPTCHA alternative.
Turnstile can be embedded into any website without sending traffic through Cloudflare and works without showing visitors a CAPTCHA.
Cloudflare issues challenges through the Challenge Platform, which is the same underlying technology powering Turnstile.
In contrast to our Challenge page offerings, Turnstile allows you to run challenges anywhere on your site in a less-intrusive way without requiring the use of Cloudflare’s CDN.
Rather than try to unilaterally deprecate and replace CAPTCHA with a single alternative, we built a platform to test many alternatives and rotate new challenges in and out as they become more or less effective.
With Turnstile, we adapt the actual challenge outcome to the individual visitor or browser. First, we run a series of small non-interactive JavaScript challenges gathering more signals about the visitor/browser environment. Those challenges include, proof-of-work, proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior. As a result, we can fine-tune the difficulty of the challenge to the specific request and avoid ever showing a visual puzzle to a user.
Turnstile also includes machine learning models that detect common features of end visitors who were able to pass a challenge before. The computational hardness of those initial challenges may vary by visitor, but is targeted to run fast.
Turnstile widget types include:
- A non-interactive challenge.
- A non-intrusive interactive challenge (such as checking a box), if the visitor is a suspected bot.
- An invisible challenge to the browser.
Turnstile is WCAG 2.1 AA compliant.
| Free | Enterprise | |
|---|---|---|
Number of widgets | 10 widgets | Unlimited |
Interactivity modes | Managed, Invisible, Interactive | Managed, Invisible, Interactive |
Offlabel (remove Cloudflare branding) | No | Yes |
Pre-clearance support | Yes | Yes |
Hostname validation | 10 hostnames per widget | Maximum of 200 hostnames per widget. |
Analytics time window | 30 days maximum | 30 days maximum |
Ephemeral IDs | No | Yes |
Refer to Cloudflare Turnstile's product page ↗ for more information on Turnstile's plans.
Get started
Migration guides
Dashboard
Turnstile analytics
Assess the number of challenges issued, evaluate the challenge solve rate, and view the metrics of issued challenges.
Pre-Clearance
Integrate Cloudflare challenges on single-page applications (SPAs) by allowing Turnstile to issue a Pre-Clearance cookie.
Cloudflare bot solutions identify and mitigate automated traffic to protect your domain from bad bots.
Get automatic protection from vulnerabilities and the flexibility to create custom rules.