Cloudflare Drops CAPTCHAs Entirely, Makes Turnstile Free
Cloudflare has announced that it has completely eliminated CAPTCHAs from its services, replacing every instance with its own Turnstile challenge system. The company has also made Turnstile's 'Managed' mode generally available and free for unlimited use, for any website operator on any platform. The move follows the completion of a process that began with the replacement of all Cloudflare-issued CAPTCHAs with Turnstile this month, meaning the company will no longer issue visual puzzles under any circumstances.
The decision is based on data showing that humans fail CAPTCHA puzzles roughly 15% of the time, while bots are often significantly better at solving them than people. Turnstile was designed to offer a challenge that is easier for humans, harder for bots, and more privacy-preserving. It avoids visual puzzles entirely, so users with low vision or blindness experience the same simplified flow as everyone else. Audio CAPTCHAs were also rejected as a fallback: they are frequently harder for humans than visual ones, with only a 31.2% agreement rate among three human solvers, and bots can accurately solve over 85% of audio challenges using free speech-to-text services. Turnstile is WCAG 2.1 Level AA compliant.
The system is also built to meet ePrivacy Directive, GDPR, and CCPA compliance requirements. Turnstile is now included in Cloudflare's FedRAMP Moderate authorized package for government customers. The service does not rely on tracking user data such as browsing history to distinguish humans from bots.
How the Checkbox Challenge Works
Turnstile's effectiveness does not hinge on the act of checking a box itself, which bots can easily replicate, including mimicking human-like mouse movement. Instead, the system analyzes background data while the box is checked. It runs a series of in-browser tests, examines browser characteristics, checks native browser APIs, and asks the browser to pass lightweight challenges such as proof-of-work or proof-of-space tests to verify it is a real browser. Currently, Turnstile checks billions of visitors daily and can identify browser abnormalities that bots exhibit during these tests.
During a year-long trial, Cloudflare rotated between CAPTCHAs and Turnstile challenges using its Managed Challenge system. Even without requiring any user interactivity, Turnstile proved as effective as a CAPTCHA at stopping bots. Cloudflare then replaced its CAPTCHA flow with the Turnstile checkbox solution and adds an extra test when suspicious signals are detected for an additional layer of security.
Fraud Prevention Success
Cloudflare has been using Turnstile's invisible mode on its own signup pages to combat automated account creation, known as "new account fraud." In the current month alone, the company has blocked over 1 million automated signup attempts using Turnstile, with no reported false positives and no change in self-service billing that relies on the signup flow.
Beta Feedback and Fixes
During the twelve-month beta, more than 76,000 users signed up for Turnstile, and the developer community created integrations for WordPress, Angular, Vue, and a Cloudflare-recommended React library. Cloudflare added support for 17 new languages, new callbacks, and new error codes in response to customer feedback.
The biggest single test for Turnstile was handling the Eurovision final vote. During the one-hour voting window, challenge traffic from the voting site outpaced the combined usage of Turnstile on challenge pages across the more than 25 million Cloudflare websites. The infrastructure handled the spike without issue.
Two unexpected failure scenarios emerged during the beta. First, older desktop computers with expired motherboard batteries often have inaccurate system time. Since Turnstile checks system time to detect improperly cached challenge pages, this inadvertently caught humans who only needed to update their clocks. Turnstile now surfaces a clear error message in such cases, and Cloudflare is developing new methods to check for cached content that won't affect legitimate users.
Second, some privacy-focused users who change their user-agent or block third-party scripts entirely—behaviors that overlap with bot evasion tactics—can trigger failures. These issues are now displayed clearly in the Turnstile widget so users can understand and make an informed choice. Cloudflare is also adding a feedback form to the widget to quickly address any future edge cases discovered by users.
Pricing and Availability
Turnstile is now in General Availability and fully production-ready. The visible widget in Managed mode is free for unlimited use. The Enterprise tier includes SaaS platform support and a visible mode without the Cloudflare logo. Self-serve customers can expect pay-as-you-go access to advanced features in early 2024. Existing advanced features remain available below the 1 million siteverify request limit, as during the beta. Users can sign up on the Turnstile product page to get started.
