What Is Cloudflare Turnstile? How It Works

Cloudflare Turnstile is a CAPTCHA replacement that decides whether a visitor is human by watching how their browser behaves, instead of making them label images. Most visitors see nothing more than a checkbox that ticks itself. Behind that checkbox, Cloudflare runs a set of browser checks and issues a token the site uses to confirm the visit is legitimate.

That's the whole idea in one breath. The rest of this explains what it's actually checking, the forms it takes, and why so many sites switched to it.

How Turnstile works

When a page loads Turnstile, a small script runs in the visitor's browser. It looks at signals the browser gives off: the JavaScript environment, how rendering behaves, and subtle traits that separate a real browser from a headless script. Cloudflare pairs that with its own reputation data for the visitor's IP, since it sits in front of a large chunk of the web and has seen that address before.

If the checks pass, Turnstile writes a token into a hidden field called cf-turnstile-response. The site sends that token to its server, the server asks Cloudflare to verify it, and the visit proceeds. No puzzle, no images, usually no interruption. When Cloudflare is less sure, it may show an actual checkbox to click, but the heavy lifting is invisible.

The three modes

Turnstile comes in three flavors, and the difference is how visible it is:

• Non-interactive — runs silently, no click. The common case.
• Managed — Cloudflare decides in the moment whether to show a checkbox, based on how risky the visit looks.
• Invisible — no widget renders at all; the check happens in the background.

All three end the same way: a token that proves the check ran. The mode only changes whether the visitor notices.

Why sites use it

Two reasons carry most of the switch. It's free at any scale, which is not true of reCAPTCHA Enterprise or hCaptcha's paid tiers. And it doesn't hand visitor data to an advertising network, which matters for privacy and for the regulations around it. Add that most people never have to solve anything, and you get fewer abandoned forms. For a site owner already on Cloudflare, turning it on is close to free in every sense.

What Turnstile is not

It isn't a wall. Turnstile raises the cost of automated abuse; it doesn't make it impossible. The token is only as trustworthy as the browser and IP behind it, which is exactly why, on the automation side, solving Turnstile comes down to presenting a clean environment and a good IP rather than defeating a puzzle. If you're doing legitimate automation, scraping public data, or testing your own forms, see how to solve Cloudflare Turnstile for the practical version. Curious how it stacks up against the alternatives? We compared Turnstile, reCAPTCHA, and hCaptcha.

FAQ

What is Cloudflare Turnstile in simple terms?

It's a CAPTCHA that checks your browser in the background and gives the site a token proving you're likely human, instead of asking you to solve a puzzle. Most visitors just see a checkbox that completes on its own.

Is Cloudflare Turnstile free?

Yes, it's free for site owners at any scale, which is a big part of why it's grown so fast against paid options.

Does Turnstile track users?

Turnstile is built to collect minimal data and doesn't feed a third-party ad network, which is one of its main selling points over reCAPTCHA.

Working with Turnstile in your own automation? The full request and response reference is in the Peak docs, and you can start free at peak.fo.