Website Security & Threat Management
Cloudflare is free of CAPTCHAs; Turnstile is free for everyone

Cloudflare is free of CAPTCHAs; Turnstile is free for everyone

9/29/2023 · Benedikt Wolters, Maxime Guerreiro, Adam Martinetti

What this post added

This post announces the complete replacement of all CAPTCHAs issued by Cloudflare with Turnstile, a new CAPTCHA replacement. Turnstile is now generally available and free for unlimited use in its 'Managed' mode. It is designed to be easy on humans, hard on bots, and private, meeting WCAG 2.1 Level AA compliance and GDPR/CCPA requirements. The post details the technical approach of analyzing background data and browser characteristics during a lightweight test (e.g., proof-of-work) to identify bots, rather than relying on visual puzzles. It also highlights Turnstile's effectiveness in preventing automated account signups and its successful handling of high-traffic events like the Eurovision final vote. Lessons learned during the beta include the need for transparency in challenge failure reasons and the development of new methods to detect cached challenge pages and accommodate privacy-focused browser configurations.

Read the original post ↗