Cloudflare Turnstile
The most recommended of 6 captcha services
Recommended as a free, low-friction way to stop comment spam and bots. Critics say it fails against real headless browsers and blocks some real users.
Recommended as a free, low-friction way to stop comment spam and bots. Critics say it fails against real headless browsers and blocks some real users.
119 people gave an opinion
- recommend it
- 33
- criticize it
- 86
- approval share
- 28%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 33 people recommend itNeeds 10 or more, met.
- 0.3 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Free and quick to add
“I like how I can slap up a free Turnstile on my projects in two minutes and not have to worry about endless comment spam”
Comment from 4 Jun 2026 in “VoidZero Is Joining Cloudflare” “Cloudflare is free, no image selector, allows VPNs and Tor for the most part”
Comment from 30 Jun 2026 in “Google's New reCAPTCHA Wants Your Camera Access and 21 Points of Your Hand” Less user-hostile than alternatives
“So I'll begrudgingly accept that Turnstile is the least user-hostile product on the market right now.”
Comment from 26 Jul 2026 in “Cloudflare's new AI traffic options for customers” “it's nice because it generally doesn't even need the interactive challenge”
Comment from 9 Jul 2026 in “Stop Using reCAPTCHA – It's Not a Real Captcha” “Bot rejection for contact forms. Better UX than reCaptcha.”
Comment from 31 May 2026 in “Cloudflare Turnstile requiring fingerprintable WebGL” Works well in practice
“Turnstile works great and it can send email itself”
Comment from 2 Sep 2026 in “Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form” “which has been working really well”
Comment from 29 Jul 2026 in “Substack writers, you need a website” “It's been a lot more effective.”
Comment from 6 May 2026 in “Google Cloud fraud defense, the next evolution of reCAPTCHA” Blocks bots and comment spam
“I like how I can slap up a free Turnstile on my projects in two minutes and not have to worry about endless comment spam”
Comment from 4 Jun 2026 in “VoidZero Is Joining Cloudflare” “Putting turnstile in front fixed problem.”
Comment from 2 Apr 2026 in “Your sign-up form is a weapon”
What people warn about
Each mark is one comment
Fingerprinting and privacy concerns
“At very least, turnstile isn't ran by the world's largest ads company that directly profits from accurately tracking users across the web.”
Comment from 5 Jun 2026 in “VoidZero Is Joining Cloudflare” “Ive been concerned about Cloudflare turnstile fingerprinting ever since I started being forced to "prove I was human"”
Comment from 1 Jun 2026 in “Cloudflare Turnstile requiring fingerprintable WebGL” “WebGL finger printing is just one of many things you need to do if you actually want to stop automation”
Comment from 1 Jun 2026 in “Cloudflare Turnstile requiring fingerprintable WebGL” Bots in real browsers bypass it
“as long as the reward for bypassing turnstile and other anti-bot protections remains high, these things really can't do much”
Comment from 1 Jun 2026 in “Cloudflare Turnstile requiring fingerprintable WebGL” “Turnstile is no longer effective. Anyone with a budget uses a real headless chrome instance and gets around it.”
Comment from 13 Oct 2026 in “I posted to HN, and then my website was flooded with AI bot traffic” “Cloudflare turnstile is handy for bots which aren't smart but any smart bots are okay with Cloudflare tunstile”
Comment from 8 May 2026 in “Archive.today requires scanning a QR code on your phone to use” Wrongly blocks legitimate users
“So now instead of having the slow-axx Cloudflare turnstile slowing down your requests, you get surprised with a "You are a BOT!!!"”
Comment from 13 Jul 2026 in “Precursor” “Cloudflare turnstile (captcha verification system) often fails unless your browser version is latest and cutting edge”
Comment from 1 Nov 2025 in “Tell HN: Cloudflare Dashboard Is Broken?” “If X% of the population gets wrongly branded with the scarlet letter B[ot], how do they appeal and get it fixed?”
Comment from 1 Jun 2026 in “Cloudflare Turnstile requiring fingerprintable WebGL” Slow, locks up browsers
“Turnstile feels bad as a user. Every site that I've seen it long will lock up Safari hard while it's doing whatever it's doing.”
Comment from 8 May 2026 in “Google Broke reCAPTCHA for De-Googled Android Users” “they greet me with an impossible gate that takes 15+ seconds to pass on Brave and gets invalidated quickly”
Comment from 19 Jul 2026 in “What AI did to stackoverflow in a graph”
Other captcha services people recommend
The four most recommended other captcha services, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Cloudflare TurnstileThis page | 33 | 86 | 28% | 10 | — | — |
| Google reCAPTCHA | 15 | 158 | 9% | 7 | — | — |
| hCaptcha | 6 | 10 | 38% | 4 | — | — |
| Cloudflare CAPTCHA | 6 | 22 | 21% | 4 | — | — |
| Google Cloud fraud defense | 6 | 54 | 10% | 1 | — | — |
What people said
40 of the 132 comments that mention it, newest first. Each links to the original comment.
“Turnstile can reduce scaling requirements by more than half, greatly reducing our costs.”
“Turnstile is no longer effective. Anyone with a budget uses a real headless chrome instance and gets around it.”
“if you have bots that use a browser driver it's completely useless”
“Run agents in confidence with Turnstile's queues.”
“one vendor, one failure mode”
“Turnstile works great and it can send email itself”
“Cloudflare Turnstile is a valid alternative though.”
“these days with Turnstile and Email Sending beta you can have Cloudflare handle it all”
“which has been working really well”
“So I'll begrudgingly accept that Turnstile is the least user-hostile product on the market right now.”
“they greet me with an impossible gate that takes 15+ seconds to pass on Brave and gets invalidated quickly”
“So now instead of having the slow-axx Cloudflare turnstile slowing down your requests, you get surprised with a "You are a BOT!!!"”
“it's nice because it generally doesn't even need the interactive challenge”
“Cloudflare is free, no image selector, allows VPNs and Tor for the most part”
“no image selector, allows VPNs and Tor for the most part”
“At very least, turnstile isn't ran by the world's largest ads company that directly profits from accurately tracking users across the web.”
“I like how I can slap up a free Turnstile on my projects in two minutes and not have to worry about endless comment spam”
“Large companies and banks see >95% fraud on sign in / sign up flows.”
“WebGL finger printing is just one of many things you need to do if you actually want to stop automation”
“Ive been concerned about Cloudflare turnstile fingerprinting ever since I started being forced to "prove I was human"”
“If X% of the population gets wrongly branded with the scarlet letter B[ot], how do they appeal and get it fixed?”
“as long as the reward for bypassing turnstile and other anti-bot protections remains high, these things really can't do much”
“I know some actual users get blocked.”
“Bot rejection for contact forms. Better UX than reCaptcha.”
“it sure works well enough to annoy anyone with a "bad ASN" IP with 80 captchas a day.”
“Obviously this is terrible, but I think there's a possibility it's the least terrible option?”
“If you use Turnstile you can skip all the Cloudflare captchas.”
“but of course that means Cloudflare owns even more of the web”
“Turnstile feels bad as a user. Every site that I've seen it long will lock up Safari hard while it's doing whatever it's doing.”
“Cloudflare turnstile is handy for bots which aren't smart but any smart bots are okay with Cloudflare tunstile”
“It's been a lot more effective.”
“these companies are spending 10s of millions of dollars on these products and considering what OpenAI is boasting about security, they are worthless.”
“Turnstile is a reasonable solution in its normal form, though the 'invisible' option still lets a lot of them through.”
“Sophisticated ones like Turnstile analyze a lot of data, likely using LLMs to detect pseudorandom keyboard input as well”
“Putting turnstile in front fixed problem.”
“Pair that with a Turnstile challenge on any endpoint you actually need to protect”
“They allow you to still use it when it would almost certainly be better for cloudflare”
“Cloudflare is really good at network bot detection.”
“Fail-open with Turnstile works for us because we have other bot mitigations that are sufficient to fall back on”
“Cloudflare turnstile (captcha verification system) often fails unless your browser version is latest and cutting edge”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.