A visitor arrives.
Turnstile runs a quick check. Usually, your visitor simply carries on. A successful check creates a short-lived token.
THE CAPTCHA ALTERNATIVE
Let people
through.
Keep bots out.
A better welcome to your website.
Cloudflare Turnstile checks for bots without
making people solve a puzzle.
✓ No image puzzles✓ Works on any website✓ Privacy first
01 A smoother visitor experience02 A real check on your server03 A few lines to get started
01 / THE EXPERIENCE
Give it a try.↙
This is real Turnstile. Choose a mode, submit the form, and watch it work.
acme.example / signup
acme®
Your next great idea
starts here.
Create your account. Keep the momentum.
A small check.
A complete round trip.
A complete round trip.
- 1Check in the browser
Turnstile checks your visitor.
Waiting for a token… - 2Verify on your server
The form sends the token to your server.
Your secret key stays here. - 3Let the request through
Only after Cloudflare confirms the token.
SERVER RESPONSE—
// Submit the form to see // the real server response.
Try to bypass the check ↗
Send a request directly to the server. These should all be blocked.
Reuse becomes available after a successful submission.ⓘ A green check in the browser is only the first step. The form is protected when your server verifies the token.
02 / UNDER THE HOOD
Two sides. One simple flow.
Your page starts the check. Your server makes the decision.
TOKEN
Your server asks Cloudflare.
The form includes that token. Your server sends it to Cloudflare’s Siteverify service using a private secret key.
RESULT
The request gets a decision.
Valid token? Process the form. Missing, expired, or already used? Stop the request and ask the visitor to try again.
5 minutesToken lifetimeOne useEach token can be redeemed onceAlways verifyThe server check is required
03 / BUILD IT INTO YOUR APP
Small change.
Better experience.
A public key for your page. A private key for your server. Then connect the two.
YOUR CLOUDFLARE DASHBOARD
The secret is for your server. Keep it in an environment variable or secret store. Never put it in your HTML, browser code, or public repository.
FIND YOUR FIT
Three modes. Your choice.
The same server verification, with different visitor experiences.
◉RECOMMENDED
Managed
Cloudflare decides whether a visitor needs to interact. Most pass automatically. Some may be asked to check a box.
◎
Non-interactive
A visible widget shows the check’s progress. Visitors don’t need to click or solve anything.
◌
Invisible
The check runs in the background, with no widget shown. Include the required Turnstile privacy notice on your page.
A FEW GOOD QUESTIONS
Clear answers.
Less guesswork.
Does my website need to use Cloudflare? +
No. Turnstile works on websites hosted anywhere. Your website doesn’t have to use Cloudflare’s network. This demo uses a Cloudflare Worker for its server, but you can use your existing server.
Will visitors ever need to click? +
Managed mode may ask a visitor to check a box when more information is needed. Non-interactive and invisible modes require no interaction. Turnstile does not ask visitors to identify objects in images.
How do I switch from reCAPTCHA? +
Replace the reCAPTCHA browser script and widget with Turnstile. Update your server to read cf-turnstile-response and verify it at Cloudflare’s Siteverify endpoint. Also update your public and secret keys.
What if the check expires or fails? +
Tokens expire after five minutes and are single-use. Handle the expiry and error callbacks, reset the widget, and ask for a fresh check. If server verification is unavailable, keep the request blocked and let the visitor retry.
Is this demo creating an account or taking payment? +
No. These are example forms. They verify real Turnstile tokens, but don’t create accounts, sign anyone in, charge a card, or save your email. The email field stays in your browser.
A BETTER WAY INKeep the welcome.
Try it for yourself ↗