How it works
A CAPTCHA protects sign-up, login, contact and checkout forms from bots that create fake accounts, try stolen passwords or flood inboxes. Older versions asked people to read warped text or pick out traffic lights. Modern ones such as Cloudflare Turnstile, Google reCAPTCHA and hCaptcha mostly run quiet checks in the browser (small computations and signals about the browser and its behaviour) and only show a checkbox or puzzle when something looks wrong.
Turnstile has three modes: Managed (a checkbox appears only when needed), Non-Interactive and Invisible. It works on any website, whether or not the site runs through Cloudflare's network. The widget gives the browser a token, the form sends it to your server, and the server confirms it with Cloudflare's Siteverify API using the secret key. Tokens are single use and expire after five minutes, and a form that skips the server-side check is not protected at all.
Turnstile does not use visitor data for ad targeting. Google's reCAPTCHA is free up to 10,000 assessments a month per organisation and then charges, and hCaptcha has a free plan and paid tiers. None of them stops every bot, since paid solving services and real people in click farms get through, so CAPTCHAs work best alongside rate limits and checks on the server.
Cloudflare Turnstile and CAPTCHAs pros and cons
Pros
- Free with unlimited verifications on the standard plan
- No picture puzzles; most visitors never see a challenge
- Works on any site, with or without Cloudflare in front
- Does not use visitor data for advertising
- Simple server-side check through the Siteverify API
Cons
- Determined attackers can still pay humans or solving services
- A few real visitors (old browsers, strict privacy setups) may be challenged or blocked
- Adds a third-party script that your CSP and privacy notice must allow for
- Protects nothing unless the server verifies every token
When to use Cloudflare Turnstile and CAPTCHAs
Pick it when
- Sign-up, login, password reset and contact forms that attract bots
- Forms that send SMS or OTP codes, where bot abuse costs money
- Free trials, comments or votes that bots can game
Skip it when
- Server-to-server APIs, which need API keys and rate limits instead
- Native mobile screens, where device checks such as Play Integrity and App Attest are the usual tools
Cloudflare Turnstile and CAPTCHAs pricing
Free tier
Free for up to 20 widgets with unlimited challenges. The Enterprise plan (unlimited widgets, more hostnames, no Cloudflare branding) is priced through Cloudflare's sales team.
Cloudflare Turnstile and CAPTCHAs pricing page (opens in a new tab)Approximate, checked September 2026.What the other tools cost
Related terms
More in Security
Defences