Cloudflare Turnstile
Cloudflare's own CAPTCHA replacement, which verifies visitors through background browser checks instead of puzzles and usually shows only a checkbox or nothing.
Turnstile is Cloudflare's answer to a question the whole industry reached at once: the puzzles no longer work, so stop showing them. It replaced hCaptcha as Cloudflare's default in 2023, and its pitch is the absence of a challenge. Instead of asking a visitor to prove humanity by solving something, it runs a series of non-interactive browser checks in the background and, in most cases, either passes silently or shows a single checkbox that resolves itself.
What those background checks actually do is run real browser work and watch how the client copes: lightweight challenges the environment must execute correctly, browser and device signals, and the same network and behavioural inputs every modern system weighs. A genuine browser completes them without the user noticing; a client that is not really a browser, or is a browser missing the expected characteristics, fails them without a puzzle ever being offered. The verification is of the environment, not of a human solving a task.
This is the reason the usual shortcut collapses against it specifically. Solving services exist to answer visible puzzles, and Turnstile's design is to not present one, so there is frequently nothing for a solver to submit. The token Turnstile issues is minted by passing the background checks in a real browser, which means the only reliable way to obtain it is to actually run one, not to outsource an answer to a puzzle that was never asked.
Because it is Cloudflare's and rides Cloudflare's edge, it is met as one component of that platform's wider defence rather than a standalone gate, and the same configurability applies: an operator chooses how aggressively it runs, so one site waves you through invisibly while another challenges immediately. It has also spread beyond Cloudflare-fronted sites, since operators can embed it independently, so meeting Turnstile no longer guarantees the rest of Cloudflare sits behind it.
The approach that works is therefore the general one with no puzzle-solving escape hatch: present a genuine browser that passes the background checks, on a clean address, with coherent fingerprint and unhurried behaviour. Against a seriously configured deployment that is real-browser automation maintained carefully, or a specialist endpoint that maintains it, because there is no token to buy your way to.
Frequently asked questions
How is Turnstile different from a normal CAPTCHA?
It usually shows no puzzle at all. Instead of asking you to solve something, it runs non-interactive checks in the background that a real browser passes automatically, displaying at most a self-resolving checkbox. It verifies that the environment is a genuine browser rather than that a human solved a task, which is a fundamentally different thing to satisfy.
Can CAPTCHA solvers get past Turnstile?
Mostly not, because there is typically nothing to solve. Solving services answer visible puzzles, and Turnstile's whole design is to avoid presenting one. Its token comes from passing background browser checks, so obtaining it reliably means running a real browser, not submitting an answer to a challenge that was never shown.
Why does Turnstile block my headless browser?
Because the background checks probe exactly the ways a headless or instrumented browser differs from an ordinary one: missing or inconsistent environment characteristics, automation traces, and behaviour that does not match a real session. A trusted address does not help here, since what fails is the browser environment itself rather than the network it arrives from.
Does seeing Turnstile mean the site uses Cloudflare?
No longer reliably. It began as Cloudflare's default challenge on Cloudflare-fronted sites, but operators can now embed it independently on sites Cloudflare does not otherwise protect. Meeting Turnstile tells you which challenge you face; it no longer guarantees the full Cloudflare edge and its other defences sit behind it.
Back to the full glossary.