7 min read
Also: Turnstile, Turnstile CAPTCHA, cf-turnstile, cf-turnstile-response, Cloudflare CAPTCHA, challenges.cloudflare.com
Cloudflare Turnstile
Quick answer
Cloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, issues a single-use token, and needs your server to verify that token with the Siteverify API. For testing, the site key 1x00000000000000000000AA always passes and the secret 1x0000000000000000000000000000000AA accepts its dummy token; for the full-page check, see "Verify you are human".
Cloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, issues a single-use token, and lets the site verify that token server-side through the Siteverify API.
Last verified
What people do with Cloudflare Turnstile
- Fix "Verify you are human" / "Checking if the site connection is secure"
The full-page Cloudflare challenge that uses the same technology.
- Understand Cloudflare bot scores and Bot Fight Mode
How Cloudflare decides who gets challenged.
- Compare Turnstile with hCaptcha
Plans, siteverify and how each treats automated browsers.
- Compare Turnstile with reCAPTCHA
Google's checkbox and score-based CAPTCHA.
- Automate a web form that has a CAPTCHA
Fill forms automatically and hand the verification step to a person.
- Take over the browser when a challenge appears
Solve the check yourself, then let the agent continue.
Key facts
| Made by | Cloudflare |
|---|---|
| Announced / generally available | September 2022 (beta) / 29 September 2023 (GA) |
| Pricing | Free with unlimited verifications; up to 20 widgets on the free plan, unlimited on Enterprise |
| Widget modes | Managed, Non-interactive, Invisible |
| Server-side check | POST token + secret to challenges.cloudflare.com/turnstile/v0/siteverify; tokens are single-use |
| Requires Cloudflare proxy? | No, it can be embedded on any website |
What is Cloudflare Turnstile?
Cloudflare Turnstile is a CAPTCHA replacement made by Cloudflare. Site owners embed it in a form (a login page, a sign-up page, a checkout, a contact form) to check that the visitor is a real browser operated by a person before the form is accepted. Unlike classic CAPTCHA puzzles, Turnstile almost never asks the visitor to pick out traffic lights. Most people see a small widget with a spinner and a check mark, or nothing at all.
Cloudflare announced Turnstile in September 2022 and made it generally available on 29 September 2023, in a blog post titled "Cloudflare is free of CAPTCHAs; Turnstile is free for everyone". It works on any website. You do not need to put your site behind Cloudflare's proxy to use it, and that is a large part of why it spread so fast: a lot of sites that moved off Google reCAPTCHA or hCaptcha moved to Turnstile.
Turnstile is related to, but not the same as, the full-page "Just a moment..." challenge that Cloudflare shows in front of a whole site. That interstitial is part of Cloudflare's bot management and challenge platform. Turnstile is the widget a site owner places inside their own page. Both use the same underlying challenge technology.
How Turnstile works
A Turnstile integration has two halves.
In the browser. The site loads Cloudflare's script from challenges.cloudflare.com and places a widget on the page with a site key. When the widget runs, it executes a set of non-interactive JavaScript checks in the visitor's browser: proof-of-work and proof-of-space style computations, probes of web APIs, and checks for signs of browser automation or an unusual environment. Cloudflare does not publish the full list, and changes it over time. If the checks pass, the widget produces a token and puts it in a hidden form field named cf-turnstile-response.
On the server. When the form is submitted, the site's backend sends that token and its secret key to Cloudflare's Siteverify endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify). Cloudflare answers with success: true or false plus error codes. Cloudflare's documentation is explicit that server-side validation is mandatory: the widget alone protects nothing, because anyone can post a form without running it. A token is single-use and expires after a few minutes, so a token captured once cannot be replayed later.
Widget modes
Turnstile has three widget modes, chosen per widget in the Cloudflare dashboard:
Plans and pricing
Turnstile is free, with unlimited verifications, on the free plan; Cloudflare's plans page lists up to 20 widgets on the free plan and unlimited widgets on Enterprise. Enterprise adds features such as the ephemeral visitor ID returned by Siteverify and pre-clearance integration with Cloudflare's WAF. Check Cloudflare's Turnstile plans page for the current split, because it has changed since launch.
Testing with dummy keys
Cloudflare publishes test keys so you can build and test a Turnstile integration without real traffic. They work on any domain, including localhost:
1x00000000000000000000AA always passes, 2x00000000000000000000AB always blocks, and 3x00000000000000000000FF forces an interactive challenge.1x0000000000000000000000000000000AA always passes Siteverify and 2x0000000000000000000000000000000AA always fails.Test site keys produce the dummy token XXXX.DUMMY.TOKEN.XXXX. Production secret keys reject it, so pair a test site key with a test secret key. Cloudflare's testing page lists the full set.
Why Turnstile shows up in automation
If you automate a browser, Turnstile is one of the most common reasons a run stops at a form. Typical symptoms:
requests, curl or Google Sheets IMPORTXML will never produce one.What to do about it
Turnstile exists because the site owner decided automated traffic should not submit that form. The honest options are the ones that respect that decision:
Paying third-party "Turnstile solver" services to defeat a site's protection is a different thing, often against the site's terms, and not something this page explains.
Turnstile and Autonoly
Autonoly's agent works in a real, headed Chromium browser rather than a raw HTTP client, so pages render the way they do for a person. Autonoly does not solve or bypass Turnstile, and it does not use proxies or rotate IP addresses. When the agent meets a Turnstile widget or a Cloudflare challenge it cannot pass, it pauses and hands the browser to you through live browser control: you complete the check yourself, then hand control back and the agent continues from where it stopped.
Why It Matters
Turnstile has become one of the most widely embedded human checks on forms, so anyone automating sign-ups, logins or form submissions will meet it. Knowing how the token and Siteverify flow works explains why a run fails, and why the reliable answer is an API or a human step rather than a workaround.
How Autonoly Solves It
Autonoly runs a real headed Chromium browser, so pages behave as they do for a person, but it does not solve or bypass Turnstile and has no proxies. When the agent hits a Turnstile widget it cannot pass, it pauses and hands you the live browser; you complete the check and give control back, and the run continues.
Learn moreExamples
A form-filling run reaches a contact form protected by a Turnstile widget in Managed mode; the agent pauses, you tick the checkbox in the live view, and it submits the form
A developer finds that their headless script's form posts are rejected because the cf-turnstile-response field is empty, since the widget never completed
A team that wanted to pull order data past a Turnstile-protected login switches to the vendor's documented export API instead
Frequently Asked Questions
Is Cloudflare Turnstile free?
Yes. Since general availability in September 2023, Turnstile is free with unlimited verifications for everyone. Cloudflare's plans page lists up to 20 widgets on the free plan; Enterprise adds unlimited widgets and extra features such as the ephemeral visitor ID and WAF pre-clearance.
Do I need to use Cloudflare's CDN to use Turnstile?
No. Turnstile works on any website. You add Cloudflare's script and a widget with your site key to the page, then verify the token from your server with your secret key. Your traffic does not have to pass through Cloudflare's proxy.
What is the difference between Turnstile and the Cloudflare 'Just a moment...' page?
Turnstile is a widget a site owner places inside their own form. The 'Just a moment...' page is a full-page challenge Cloudflare shows in front of a whole site when a security rule or bot setting decides a request needs checking. They share the same challenge technology but are configured in different places.
Why does Turnstile keep failing in my automated browser?
Turnstile's checks look for signs of automation and unusual environments, such as headless mode, automation flags exposed over DevTools, and datacenter IPs. Tokens also expire after a few minutes and can be used only once. The supported fixes are an official API, permission from the site, or a human completing the step.
Do I have to validate the Turnstile token on my server?
Yes. Cloudflare's documentation says server-side validation through the Siteverify endpoint is mandatory. Without it, anyone can post your form without running the widget at all, so the widget on its own gives no protection.
Can Autonoly get past Cloudflare Turnstile?
No, and it does not try. Autonoly solves reCAPTCHA v2 and hCaptcha only when CAPTCHA solving is enabled. For Turnstile, the agent pauses and hands you the live browser so you can complete the check yourself, then it carries on.
Further reading
Related terms, automations and guides
Where this concept shows up in practice.
Stop reading about automation.
Start automating.
Describe what you need in plain English. Autonoly's AI agent builds and runs the automation for you — no code required.