Cloudflare is free of CAPTCHAs; Turnstile is free for everyone

This post announces the full integration of Turnstile, Cloudflare's CAPTCHA replacement, across all Cloudflare-issued challenges, effectively eliminating CAPTCHAs for all users. It also details the decoupling of Turnstile from the Cloudflare platform, making it available as a free, unlimited service for all website operators. The post elaborates on Turnstile's technical approach, emphasizing its privacy-preserving nature, WCAG 2.1 Level AA compliance, and bot detection mechanisms that rely on in-browser tests and analysis of browser characteristics rather than visual puzzles. It highlights successful deployments, including protecting Cloudflare's own signup flow and handling the Eurovision voting traffic. Lessons learned from the beta, such as improved error reporting for system time inaccuracies and privacy-related browser configurations, are also discussed, along with the introduction of a user feedback form.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack