{"slug": "cloudflare-turnstile", "name": "Cloudflare Turnstile", "category": "other", "category_name": "Other software", "description": "", "recommenders": 4, "commenters": 9, "warners": 2, "score": 2.701, "rising": 0.02, "first": "2026-04-15", "latest": "2026-10-31", "why": "I ditched reCaptcha and switched to Cloudflare Turnstile recently. It\u2019s been a lot more effective.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 0, "warn": 2}, "spark": [0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I ditched reCaptcha and switched to Cloudflare Turnstile recently. It\u2019s been a lot more effective.", "icon": true, "domain": "cloudflare.com", "github_repo": null, "official_url": "https://www.cloudflare.com/products/turnstile/", "pricing": "", "aliases": ["Cloudflare Turnstile"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 795059632, "item_id": 49691227, "url": "https://news.ycombinator.com/item?id=49691227", "by": "p32929", "date": "2026-09-14", "stance": "recommend", "quote": "the Turnstile suggestion upthread is the right shape - one vendor, one failure mode", "excerpt": "Worth saying for the personal-site case specifically, which is most of the static sites people bolt a contact form onto: the form is often not worth the infrastructure at all. I maintain an open-source portfolio template (https://github.com/p32929/portfolio-v2) and the contact section is deliberately just links - email, GitHub, LinkedIn. No endpoint, no captcha, no keys to rotate, and nothing to migrate when a free t", "context": "", "use_case": "contact form CAPTCHA", "switched_from": "", "story": "Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form"}, {"id": 785532547, "item_id": 49095784, "url": "https://news.ycombinator.com/item?id=49095784", "by": "mintflow", "date": "2026-07-29", "stance": "recommend", "quote": "I use Cloudflare Turnstile, which has been working really well.", "excerpt": "Great idea. Recently, I\u2019ve decided to get back into blogging. It\u2019s surprisingly easy these days. I already have a domain on Cloudflare, and I had Codex build a simple blogging system for me. I write everything in Markdown, the site is hosted on Cloudflare, comments are stored in Cloudflare D1, and all articles live in the repository as Markdown files. GitHub Actions takes care of publishing automatically and also per", "context": "", "use_case": "comment spam prevention", "switched_from": "", "story": "Substack writers, you need a website"}, {"id": 784873169, "item_id": 49054573, "url": "https://news.ycombinator.com/item?id=49054573", "by": "gucci-on-fleek", "date": "2026-07-25", "stance": "recommend", "quote": "I'll begrudgingly accept that Turnstile is the least user-hostile product on the market right now.", "excerpt": "> That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap. Yeah, I really have no idea why Anubis works right now: residential proxies are far more expensive than compute, yet the bots seem to have no problem obtaining millions of residential IPs, but they give up on even short-ish Anubis challenges. > I never ran into this issue despite using seemingly ma", "context": "Firefox on Linux user with privacy extensions", "use_case": "CAPTCHA / bot challenge", "switched_from": "", "story": "Cloudflare's new AI traffic options for customers"}, {"id": 768671312, "item_id": 48041957, "url": "https://news.ycombinator.com/item?id=48041957", "by": "x3sphere", "date": "2026-05-06", "stance": "recommend", "quote": "I ditched reCaptcha and switched to Cloudflare Turnstile recently. It\u2019s been a lot more effective.", "excerpt": "I ditched reCaptcha and switched to Cloudflare Turnstile recently. It\u2019s been a lot more effective. Not sure about this but I won\u2019t be switching back for the time being.", "context": "", "use_case": "bot protection", "switched_from": "reCAPTCHA", "story": "Google Cloud fraud defense, the next evolution of reCAPTCHA"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 805017121, "item_id": 50313570, "url": "https://news.ycombinator.com/item?id=50313570", "by": "jyrkesh", "date": "2026-10-31", "stance": "warn", "quote": "roughly 30-50% of the internet is walled off to me in this browser profile because I can't pass the black box of Cloudflare's challenge.", "excerpt": "I've been using Edge Dev as my daily driver for years, and the last couple updates it's been failing Turnstile off and on. I get this error code on https://debug.challenges.cloudflare.com/ that's not currently throwing because it magically started working again. But when it's not working, I've realized that roughly 30-50% of the internet is walled off to me in this browser profile because I can't pass the black box o", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Turnstile solver library (no headless browser required)"}, {"id": 764587137, "item_id": 47786696, "url": "https://news.ycombinator.com/item?id=47786696", "by": "dataviz1000", "date": "2026-04-15", "stance": "warn", "quote": "considering what OpenAI is boasting about security, they are worthless.", "excerpt": "> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. I, for the NFL front offices, created a script that exposed an API to fully automate Ticketmaster through the front end so that the NFL could post tickets on all secondary markets and dynamic price the tickets so if rain on a Sunday was expected they could charge less. Ticketmaster was slow to develop an", "context": "", "use_case": "bot protection", "switched_from": "", "story": "Cybersecurity Looks Like Proof of Work Now"}]}], "who": [{"by": "gucci-on-fleek", "context": "Firefox on Linux user with privacy extensions", "url": "https://news.ycombinator.com/item?id=49054573", "date": "2026-07-25"}, {"by": "JensenTorp", "context": "runs websites behind Cloudflare", "url": "https://news.ycombinator.com/item?id=48352277", "date": "2026-05-31"}], "tags": [], "use_cases": ["bot protection", "contact form captcha", "bot protection for nitter instances", "comment spam prevention", "captcha / bot challenge", "spam protection"], "compared": [{"slug": "anubis", "name": "Anubis", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50277379", "title": "Cloudflare Turnstile solver library (no headless browser required)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49540574", "title": "Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49571634", "title": "Nitter has more working instances than before the takedowns", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49086788", "title": "Substack writers, you need a website", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49052564", "title": "Cloudflare's new AI traffic options for customers", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48489853", "title": "Show HN: A live map of how every country thinks the 2026 World Cup will go", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"warn": 1}, "2026-05": {"recommend": 1, "neutral": 1}, "2026-06": {"neutral": 1}, "2026-07": {"recommend": 2}, "2026-08": {}, "2026-09": {"neutral": 1, "recommend": 1}, "2026-10": {"warn": 1}}, "quotes": [{"id": 805017121, "item_id": 50313570, "url": "https://news.ycombinator.com/item?id=50313570", "by": "jyrkesh", "date": "2026-10-31", "stance": "warn", "quote": "roughly 30-50% of the internet is walled off to me in this browser profile because I can't pass the black box of Cloudflare's challenge.", "excerpt": "I've been using Edge Dev as my daily driver for years, and the last couple updates it's been failing Turnstile off and on. I get this error code on https://debug.challenges.cloudflare.com/ that's not currently throwing because it magically started working again. But when it's not working, I've realized that roughly 30-50% of the internet is walled off to me in this browser profile because I can't pass the black box o", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Turnstile solver library (no headless browser required)"}, {"id": 795059632, "item_id": 49691227, "url": "https://news.ycombinator.com/item?id=49691227", "by": "p32929", "date": "2026-09-14", "stance": "recommend", "quote": "the Turnstile suggestion upthread is the right shape - one vendor, one failure mode", "excerpt": "Worth saying for the personal-site case specifically, which is most of the static sites people bolt a contact form onto: the form is often not worth the infrastructure at all. I maintain an open-source portfolio template (https://github.com/p32929/portfolio-v2) and the contact section is deliberately just links - email, GitHub, LinkedIn. No endpoint, no captcha, no keys to rotate, and nothing to migrate when a free t", "context": "", "use_case": "contact form CAPTCHA", "switched_from": "", "story": "Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form"}, {"id": 793287729, "item_id": 49580483, "url": "https://news.ycombinator.com/item?id=49580483", "by": "miningtcup", "date": "2026-09-05", "stance": "neutral", "quote": "I believe that all listed instances use either https://www.cloudflare.com/products/turnstile/", "excerpt": "None of the instances listed have anything like that going on. I believe that all listed instances use either https://www.cloudflare.com/products/turnstile/, https://anubis.techaro.lol/, https://git.miningtcup.me/MiningTcup/dogwaf (made by me), or nothing at all. I recommend against using instances not listed unless you know the host because there are reasons for them to not be listed. I won't elaborate on the reason", "context": "", "use_case": "bot protection for Nitter instances", "switched_from": "", "story": "Nitter has more working instances than before the takedowns"}, {"id": 785532547, "item_id": 49095784, "url": "https://news.ycombinator.com/item?id=49095784", "by": "mintflow", "date": "2026-07-29", "stance": "recommend", "quote": "I use Cloudflare Turnstile, which has been working really well.", "excerpt": "Great idea. Recently, I\u2019ve decided to get back into blogging. It\u2019s surprisingly easy these days. I already have a domain on Cloudflare, and I had Codex build a simple blogging system for me. I write everything in Markdown, the site is hosted on Cloudflare, comments are stored in Cloudflare D1, and all articles live in the repository as Markdown files. GitHub Actions takes care of publishing automatically and also per", "context": "", "use_case": "comment spam prevention", "switched_from": "", "story": "Substack writers, you need a website"}, {"id": 784873169, "item_id": 49054573, "url": "https://news.ycombinator.com/item?id=49054573", "by": "gucci-on-fleek", "date": "2026-07-25", "stance": "recommend", "quote": "I'll begrudgingly accept that Turnstile is the least user-hostile product on the market right now.", "excerpt": "> That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap. Yeah, I really have no idea why Anubis works right now: residential proxies are far more expensive than compute, yet the bots seem to have no problem obtaining millions of residential IPs, but they give up on even short-ish Anubis challenges. > I never ran into this issue despite using seemingly ma", "context": "Firefox on Linux user with privacy extensions", "use_case": "CAPTCHA / bot challenge", "switched_from": "", "story": "Cloudflare's new AI traffic options for customers"}, {"id": 775837686, "item_id": 48489855, "url": "https://news.ycombinator.com/item?id=48489855", "by": "jonesai", "date": "2026-06-11", "stance": "neutral", "quote": "Spam protection is fingerprint hashing plus Turnstile", "excerpt": "Over the last week I built something for the World Cup. I'm a big football fan & wanted more experience shipping things. I should say upfront that I leaned heavily on Cursor and Claude for the code. Also I'm not planning to run ads on it, this is a learning project. The idea: every visitor picks one team to win the 2026 World Cup, as well as being able to make individual match predictions. Each country is coloured on", "context": "", "use_case": "spam protection", "switched_from": "", "story": "Show HN: A live map of how every country thinks the 2026 World Cup will go"}, {"id": 773636432, "item_id": 48352277, "url": "https://news.ycombinator.com/item?id=48352277", "by": "JensenTorp", "date": "2026-05-31", "stance": "neutral", "quote": "only the account creation page uses Turnstyle", "excerpt": "I want to point out that Cloudflare Turnstyle is a separate and more strict product than their usual \"are you a bot\" protection. I use Cloudflare protection on all my website but only the account creation page uses Turnstyle.", "context": "runs websites behind Cloudflare", "use_case": "bot protection on account creation", "switched_from": "", "story": "Cloudflare Turnstile requiring fingerprintable WebGL"}, {"id": 768671312, "item_id": 48041957, "url": "https://news.ycombinator.com/item?id=48041957", "by": "x3sphere", "date": "2026-05-06", "stance": "recommend", "quote": "I ditched reCaptcha and switched to Cloudflare Turnstile recently. It\u2019s been a lot more effective.", "excerpt": "I ditched reCaptcha and switched to Cloudflare Turnstile recently. It\u2019s been a lot more effective. Not sure about this but I won\u2019t be switching back for the time being.", "context": "", "use_case": "bot protection", "switched_from": "reCAPTCHA", "story": "Google Cloud fraud defense, the next evolution of reCAPTCHA"}, {"id": 764587137, "item_id": 47786696, "url": "https://news.ycombinator.com/item?id=47786696", "by": "dataviz1000", "date": "2026-04-15", "stance": "warn", "quote": "considering what OpenAI is boasting about security, they are worthless.", "excerpt": "> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. I, for the NFL front offices, created a script that exposed an API to fully automate Ticketmaster through the front end so that the NFL could post tickets on all secondary markets and dynamic price the tickets so if rain on a Sunday was expected they could charge less. Ticketmaster was slow to develop an", "context": "", "use_case": "bot protection", "switched_from": "", "story": "Cybersecurity Looks Like Proof of Work Now"}]}