Cloudflare Turnstile: protect your forms without puzzles

You launch a campaign and your contact form fills up with junk messages: weird links, nonsense names, SEO offers. You add a CAPTCHA with traffic lights and bicycles, spam drops, but so do the real customers who get tired of solving puzzles on their phones.

There is a middle ground, and it costs nothing: Cloudflare Turnstile.

What is Cloudflare Turnstile?

It is Cloudflare's alternative to traditional CAPTCHAs: it verifies that whoever uses your form is a person without showing a puzzle. According to Cloudflare's documentation, it runs small JavaScript challenges that collect browser signals and adjusts the difficulty to each request, so most visitors never see anything to solve.

It can also be embedded in any website without sending traffic through Cloudflare. If your site already runs there, even better, as we explain in what the free Cloudflare plan includes.

What widget modes does it have?

It has three modes, and Cloudflare recommends the managed one.

Mode	What it does
Managed	Decides whether to show a checkbox based on the visitor's risk
Non-interactive	The visitor never needs to interact with the widget
Invisible	The widget is completely hidden

For a contact form, the managed mode is usually the middle ground: almost nobody notices it, but if something smells like a bot, the checkbox appears.

How much does it cost and what are the limits?

The Turnstile free plan costs nothing and allows unlimited challenges. According to the plans page, these are the limits of the free plan versus Enterprise:

Feature	Free	Enterprise
Widgets	Up to 20 per account	Unlimited
Hostnames	10 per widget	200 per widget
Analytics history	Up to 7 days	Up to 30 days
Remove Cloudflare branding	No	Yes

For a small business with one or two sites, 20 widgets is plenty. If you want to measure what happens with your visits, also look at Cloudflare Web Analytics.

How do I install it properly?

In three steps: create the widget, embed it and validate the token on your server. This is how the getting started guide describes it:

1. Create the widget in the Cloudflare dashboard. You get a site key (public, goes in your HTML) and a secret key (private, only on your server).
2. Embed it on the page with the site key.
3. Validate the token by sending it to the Siteverify API with your secret key.

Common mistake: adding the widget and forgetting the validation. Cloudflare is clear: without calling Siteverify, your setup is incomplete. A bot can skip the widget and submit the form directly, so the secret key must never appear in browser code.

What happens with expired tokens?

Each token expires after 300 seconds and can only be validated once. If someone takes more than five minutes to fill in your form, or tries to resubmit it, the token stops working and a new challenge must be generated. Design the form so that, after a validation error, it asks for the challenge again instead of showing a confusing failure.

What if I don't want forms?

Removing the form also removes spam at the root. On this site, for example, contact goes straight to WhatsApp or a booking page. If you prefer that path, see how a capture funnel with booking works. But if your business needs forms (quotes, sign-ups, support), Turnstile is a cheap way to keep them clean.

Heads up: a CAPTCHA stops bots, it does not replace the rest of your security. Keep your site updated and review the Cloudflare SSL/TLS mode.

In short

Turnstile solves the Monday dilemma of a form full of spam: it filters bots without putting puzzles in front of your customers. The free plan is enough for most small businesses, as long as you validate the token on your server with Siteverify. If you want us to get it working, we do it within our hosting and domains service.