Turnstile Analytics gets a deeper view into bot traffic
Attackers have moved beyond simple brute force and site-takedown attempts. Modern bot campaigns simulate real user behavior to execute account takeovers, credential stuffing, fake account creation, content scraping, and fraudulent transactions — often while rotating IPs, routing through proxies, or hiding behind VPNs. In this environment, the pass/fail metrics of traditional CAPTCHA dashboards no longer offer enough signal.
Cloudflare has responded with a major update to Turnstile Analytics. The new dashboard consolidates traffic insights, challenge effectiveness, and threat indicators into a single view, aiming to reduce the manual log correlation that was previously needed to identify attack patterns and tune bot defenses.
What the updated dashboard exposes
The previous Turnstile dashboard gave little visibility into the characteristics of blocked bots or the behavior of traffic that passed challenges. Customers often had to combine limited analytics with Siteverify API responses and external sources to detect abuse trends. The upgraded version surfaces several new sections designed to make that analysis more direct.
Top statistics
A new TopN section shows the top values for hostname, autonomous system (ASN), user agent, browser, source IP address, country, and operating system. This lets you analyze traffic at a granular level and spot anomalies, such as which browsers, ASNs, user agents, or locations generate the most failed challenges. High-risk source IPs with elevated challenge failure rates can be cross-referenced against other security layers — for instance, by adjusting WAF custom rules based on observed Turnstile trends.
Challenge outcomes
The Challenge outcomes section breaks down traffic into Likely Human and Likely Bot categories. Monitoring trends in these metrics over time is key: a sudden drop in solve rate combined with a spike in challenge attempts can signal an active attack. This section helps you track bot activity fluctuations and correlate them with internal security logs to keep rules current and investigate incidents efficiently.
Solve rates
For visitors that successfully clear the challenge, Solve rates details how they were solved, broken down into interactive solves, non-interactive solves, and pre-clearance solves. In managed mode, for example, this reveals how many visitors required interaction with the widget versus those verified without any user involvement.
Token validations
A final critical step occurs after the challenge. The token issued by Turnstile must be validated via the Siteverify API; rendering the widget without this step leaves your site unprotected. The Token validation section tracks the status of that call, confirming whether tokens are valid, have not been previously redeemed, and have not expired.
Applying the dashboard to a login-page attack
To see the analytics in practice, consider protecting a login page from credential stuffing or account takeover attempts. You can either create separate widgets for login and sign-up pages, or use a single widget with the action field to distinguish between them. The cData field can carry custom data — such as a session ID — tied to each attempt, which is useful for tracing suspicious behavior while keeping your site compliant, since cData is not stored by Cloudflare systems.
After a visitor completes the widget challenge, parse the token on your server and validate it via the Siteverify API. A "success": true response permits the login flow; a "success": false indicates an invalid token, meaning Turnstile classified the visitor as a bot. In the latter case, you can control the user experience — for example, redirecting to an error page or flagging the session as suspicious. A common trick is to let the bot believe login succeeded while blocking high-value actions (purchases, account changes) behind additional verification.
Monitoring your login page's analytics starts with the Top statistics section. Review anomalies in country, ASN, and user agent distribution, and verify they match your legitimate user base. Track source browsers and operating systems against expected demographics, and cross-check your maintaineed list of suspicious IPs against their success and failure rates.
During a suspected credential-stuffing attack, zoom into the time window where challenges unsolved spike and the "likely bot" metric rises sharply. In a sample scenario, this demonstrates Turnstile catching the wave of bots — they failed to solve or complete the challenge blunting the attack at the widget layer.
The Token validation section adds another layer of understanding. If, say, 0.01% of tokens issued in a window were invalid, that denotes non-legitimate visitors who received token outcomes. The meaning behind that number depends on the login credentials those suspicious visitors attempted. Correct credentials might indicate an account takeover attempt or already-compromised accounts; incorrect credentials in a rapid burst suggest credential stuffing. Correlating Turnstile metrics with your internal application data — such as password correctness — sharpens the picture of attacker intent.
What’s next on the roadmap
Cloudflare has further enhancements planned for Turnstile Analytics. Client-side and server-side error metrics are in development to go beyond challenge outcomes, and Ephemeral IDs will be incorporated so you can filter by ID, view top IDs, and see the frequency of their solve attempts.
