Stops bots at your signup form without making real people click traffic lights. Cloudflare Turnstile is a free replacement for CAPTCHA that checks whether a visitor is human without showing image puzzles. You add a widget to a form and verify the token on your server. The Free plan has unlimited challenges, up to 20 widgets, 10 hostnames per widget, 7 days of analytics, pre-clearance support and WCAG 2.2 AAA compliance, with community support only. Enterprise adds unlimited widgets, up to 200 hostnames per widget, 30 days of analytics, ephemeral IDs, custom branding and compliance support. A r/golang user called it super easy to use instead of reCAPTCHA. Other Reddit users report weaknesses: a r/webdev poster says it blocks basic bots but struggles with headless, human-like credential stuffing, and r/CloudFlare posts describe visitors who could not pass the check or saw slow responses. It suits sign-up and contact forms where you want low friction.
Free tier quotas
Challenges
Unlimited
Widgets
Up to 20
Hostnames per widget
10
Analytics lookback
7 days
Pre-clearance
Supported
Accessibility
WCAG 2.2 AAA compliant
Support
Community
Price
Free of charge
Last sniffed Oct 23, 2026. Always confirm on the official pricing page.
👍 Good boy
+A r/golang user said it was super easy to deploy instead of reCAPTCHA and they were impressed.
+Unlimited challenges on the free plan mean there is no per-verification bill.
+Visitors usually do not see image puzzles, which keeps sign-up forms short.
+WCAG 2.2 AAA compliance is listed on the free plan.
+It works on sites that do not use Cloudflare for hosting or DNS.
+20 widgets with 10 hostnames each covers several projects under one account.
👎 Watch out
−A r/webdev poster said it blocks basic bots but struggles with headless, human-like credential stuffing.
−A r/webdev user who compared seven CAPTCHA alternatives dislikes it as a visitor, because it is invisible with no fallback.
−A r/CloudFlare post describes being unable to pass the check and log in, and the poster on the free plan found support too slow for an urgent case.
−A r/CloudFlare user asked about extremely slow Turnstile performance in testing.
−Free support is community only, and the free plan keeps just 7 days of analytics.
−Ephemeral IDs, custom branding and larger hostname limits are Enterprise only.
The catch
It is a good fit for stopping simple bots on forms. Several Reddit users note that it does not stop determined bots that behave like a real browser, so it is one layer, not your whole abuse plan.
There is no fallback puzzle for visitors it cannot clear, and some users on r/CloudFlare report being locked out.
Support on the free plan is the community forum.
What’s included
✓Invisible and managed challenge modes
✓Server-side token verification
✓Pre-clearance for sites behind Cloudflare
✓Up to 20 widgets
✓Analytics for challenge results
✓WCAG 2.2 AAA compliant
✓Works with any site, Cloudflare customer or not
✓Drop-in replacement for reCAPTCHA
Free tier value
Generosity
A+
Estimated value
Free, unlimited challenges
Feature parity
Unlimited challenges, up to 20 widgets, 7 days of analytics, community support.
