Cloudflare Turnstile Setup

Cloudflare Turnstile setup — privacy-friendly CAPTCHA, done properly

A focused service to implement Turnstile, the free, low-friction alternative to reCAPTCHA. We place the widget on the forms that matter, migrate you off reCAPTCHA and — the step most people miss — validate the token server-side so it actually holds up.

Set up Turnstile See Bot Protection

Who this is for

Sites drowning in form and signup spam
Teams wanting to replace reCAPTCHA
WooCommerce & WordPress form owners
Custom SaaS sign-up & auth flows

Problems we solve

The abuse Turnstile actually helps with

Spam signups and registrations

Automated account creation pollutes your user base, skews analytics and burns email and SMS quota. Turnstile on signup helps cut the volume of junk accounts.

Contact and lead-form spam

Bots flood contact, demo and newsletter forms with junk. A low-friction challenge on submit makes that automation slower and more costly to run.

reCAPTCHA fatigue and privacy concerns

Image puzzles hurt conversion and third-party tracking raises consent questions. Many teams want a privacy-friendly alternative that real users barely notice.

Widget added but never validated

A Turnstile or CAPTCHA widget on the page with no server-side token check gives a false sense of safety — attackers simply skip the front end entirely.

Login and password-reset abuse

Credential stuffing and reset-link harvesting hammer auth endpoints. A challenge on these paths adds cost to automated attempts without blocking real users.

Migration that quietly breaks forms

Removing reCAPTCHA without correctly wiring Turnstile can disable validation or break submissions. Migration needs careful, tested, staged rollout.

What we configure

A complete Turnstile implementation

Not just dropping a widget on the page — the placement, mode and backend validation that make it effective.

Widget on the right forms

We place Turnstile where abuse actually lands — signup, login, password reset, checkout and contact or lead forms — so friction goes only where it earns its keep.

reCAPTCHA migration

We map your existing reCAPTCHA v2/v3 placements, swap in Turnstile widgets and tokens, and update your backend verification so nothing silently stops validating.

Server-side validation

The step most teams skip: verifying the Turnstile token on your server via the siteverify API. Without it the widget is decorative and easy to bypass.

Widget mode selection

Managed, non-interactive or invisible — we choose the mode per form so high-risk paths get a real challenge and low-risk paths stay near-frictionless.

Privacy-friendly by design

Turnstile is free and avoids the tracking and puzzle fatigue of legacy CAPTCHA, which helps conversion and supports your privacy and consent posture.

Fits your platform

WooCommerce and WordPress forms, custom SaaS sign-up flows, and static sites with serverless functions — we wire Turnstile into the stack you already run.

The step people miss

Why is server-side validation the part that matters?

The Turnstile widget on your page produces a token when a visitor passes the challenge. That token is only a claim — it proves nothing until your server checks it against Cloudflare’s siteverify API and confirms it is valid, unused and tied to your site key.

Skip that check and the widget is decorative: an attacker can ignore the front end and post straight to your endpoint. We add the verification call, reject missing or failed tokens, handle timeouts and errors gracefully, and test it end to end so genuine submissions always get through.

Talk to a specialist

What we wire on your backend

Token verified via the siteverify API
Missing or failed tokens are rejected, not trusted
Idempotent checks so a token can't be replayed
Graceful handling of timeouts and edge errors

Widget modes

Managed, non-interactive or invisible

We pick a mode per form so high-risk paths get a real challenge and low-risk forms stay near-frictionless.

Managed

Cloudflare decides whether to show an interactive challenge based on signals. Most visitors pass invisibly; suspicious ones get a quick checkbox. A sensible default for most forms.

Non-interactive

A visible widget that runs checks without asking the user to do anything. Good when you want a clear visual indicator but no clicking or puzzle-solving.

Invisible

No visible widget at all — the challenge runs in the background on submit. Best for low-friction flows where any visible element would hurt conversion.

How we work

From audit to a tested, validated rollout

1
1. Audit your forms
We review where you take input — signup, login, reset, checkout, contact and lead forms — plus any existing reCAPTCHA, and agree which paths actually need a challenge.
2
2. Add the client widget
We embed the Turnstile widget with the right mode per form and a clean fallback, so the page renders correctly and real users see little or no friction.
3
3. Validate on the server
We wire the token to Cloudflare's siteverify endpoint in your backend, reject failed or missing tokens, and handle errors — the step that makes Turnstile actually work.
4
4. Test, migrate & monitor
We migrate away from reCAPTCHA in stages, test real submissions across browsers, and watch form analytics to confirm spam drops without blocking genuine users.

How it fits together

How does Turnstile complement bot management?

Turnstile and bot management are not the same control. Turnstile validates a single interaction — the moment a form is submitted — and is great for proving a human filled in your signup or contact form.

Cloudflare bot management and WAF rules score the whole request path and behaviour across your site, catching scraping, credential stuffing and abuse that never touches a form. Used together, the challenge handles the form and the rules handle the path, which reduces abuse far more than either alone.

See Bot Protection

Two layers, different jobs

Turnstile validates the form interaction
Bot rules score the request path and behaviour
Rate limiting blunts high-volume auth abuse
WAF protects endpoints behind the form

Scope

What is and isn’t included

What is included

Form audit and challenge-placement plan
Turnstile widget setup with the right mode per form
reCAPTCHA migration on existing forms
Server-side token validation via siteverify
WooCommerce / WordPress and custom-form integration
Cross-browser testing and post-launch monitoring

What is not included

Application code, auth logic or MFA development
Payment-fraud, chargeback or anti-fraud platforms
Full bot management, WAF or rate-limiting build (separate)
Hosting, server or database administration
A guarantee against every bot or all form spam

When you need this

Spam signups or contact-form spam are getting worse
You want to replace reCAPTCHA for privacy or conversion
A CAPTCHA widget is on the page but never validated
Login or password reset is being abused by bots
You’re launching new forms and want them protected from day one

When Cloudflare is not enough

Turnstile is one low-friction layer at the edge. On its own it does not replace:

Secure development, code review and timely patching of your application and plugins.
Backups, disaster recovery and a tested restore process.
A dedicated anti-fraud, chargeback or payment-risk platform.
Hosting, database administration and origin server maintenance.
Full incident response and forensics for large or regulated enterprises.

What Cloudflare can and cannot do

Cloudflare reduces risk, blocks a large share of malicious traffic, hardens critical endpoints and improves performance. No edge platform can make a website completely or permanently secure, and Cloudflare does not, on its own, stop payment fraud or replace secure development, patching, backups, anti-fraud platforms or proper hosting. We configure Cloudflare as one strong layer in a complete security posture.

Related services

Explore related Cloudflare services

Bot ProtectionScore the whole path, not just the form.Cloudflare WAF SetupProtect the endpoints behind your forms.Cloudflare for WooCommerceTurnstile on registration & checkout.Cloudflare for SaaS & APIsReduce trial and signup abuse at scale.Cloudflare AuditStart with an independent review.ContactTell us which forms are being hit.

Frequently asked questions

What is Cloudflare Turnstile and how is it different from reCAPTCHA?

Turnstile is Cloudflare's free, privacy-friendly CAPTCHA alternative. Instead of asking users to solve image puzzles, it runs lightweight challenges in the background and only adds visible friction when a visitor looks suspicious. Compared with reCAPTCHA it avoids the tracking and puzzle fatigue that hurt conversion, which is why many teams migrate. It validates that a browser interaction looks human; it is not a payment-fraud tool and no challenge stops every bot.

Where should I place the Turnstile widget?

The highest-value placements are the forms that attract automated abuse: signup and registration, login, password reset, checkout, and contact or lead-generation forms. We add Turnstile where abuse actually lands rather than on every form, so real users see friction only where it helps. The right widget mode varies by path, with stronger challenges on auth and checkout and near-invisible ones on low-risk forms.

Do I still need server-side validation if the widget is on the page?

Yes, and this is the step most setups miss. The client widget produces a token, but that token must be verified on your server against Cloudflare's siteverify API before you trust the submission. Without server-side validation an attacker can ignore the widget entirely and post straight to your endpoint, so the CAPTCHA becomes decorative. We always wire and test the backend check as part of the setup.

Which Turnstile widget mode should I use?

There are three modes. Managed lets Cloudflare decide whether to show an interactive challenge and is a sensible default for most forms. Non-interactive shows a visible widget that runs checks without user action. Invisible runs entirely in the background with no visible element, which suits low-friction flows. We pick the mode per form based on how much abuse the path attracts and how sensitive conversion is.

Can you set up Turnstile on WooCommerce or WordPress forms?

Yes. We configure Turnstile for WooCommerce registration, login and checkout, and for common WordPress and form-plugin contact and lead forms, including the server-side verification. For custom SaaS sign-up flows and static sites we wire the widget to your own backend or a serverless function. The approach is the same everywhere: client widget plus a verified token on the server.

Does Turnstile replace bot management or fraud prevention?

No. Turnstile validates a single interaction at the moment a form is submitted, while Cloudflare bot management scores the whole request path and behaviour across your site — the two complement each other. Turnstile helps reduce form spam and bot signups, but it is not a payment-fraud or chargeback tool and no challenge can promise to stop every bot. We position it as one low-friction layer alongside WAF, rate limiting and bot rules.

How this project is scoped — no hourly meter

Fixed scope, fixed timeline — priced by deliverable against an agreed Statement of Work, not by an hourly meter. Typically 2–4 weeks, delivered remotely.

What's included

Discovery & kick-off call to confirm goals and scope
Architecture & configuration review
Cloudflare setup for the agreed scope: DNS, SSL/TLS, WAF baseline, caching/performance and the products in your plan
Validation and a supervised go-live
Handover pack: runbook, configuration documentation and a team walkthrough
A 14-day post-go-live support window for fixes to what we configured

Not included (quoted separately)

Non-Cloudflare work (application/backend changes, third-party security tools)
Additional domains/zones beyond the agreed scope
Ongoing monthly management (that is a Care plan)
Anything not in the Statement of Work — handled as a separately quoted change order

Indicative “from” prices are a starting point. Your final price is confirmed in a written proposal after a free scoping call, and depends on the number of zones, the Cloudflare products in scope and environment complexity.

Set up Turnstile the right way

Get a privacy-friendly challenge on the forms that matter, a clean migration from reCAPTCHA, and the server-side validation that makes it actually work.