What is Cloudflare Turnstile, and how do I protect a form from bots?

Cloudflare Turnstile is the alternative to reCAPTCHA: it checks there’s a real person behind the screen without annoying puzzles (it’s usually invisible, or a simple check). And it’s free.

How it works

It gives you two keys: a Site Key (public, goes in the front end) and a Secret Key (private, goes on your server). The front end shows the widget and, on submit, sends a token; your backend verifies it against Cloudflare before accepting the form.

<!-- On the front end -->
<div class="cf-turnstile" data-sitekey="TU_SITE_KEY"></div>
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async></script>

On the server you make a POST to siteverify with the Secret Key and the token; if it responds success, it’s human. You don’t need your domain on Cloudflare: Turnstile works on its own.