Security
Turnstile review
Score: 8/10The CAPTCHA replacement the web needed. Mostly.
The breakdown explains the score. It is not an average. How to read these.
Last updated
Turnstile is what a CAPTCHA should be: free, privacy-preserving, and invisible to most users. Integration needs a script tag and a server-side siteverify call. It can replace reCAPTCHA in an existing form within an afternoon.
The free tier is absurdly generous (effectively unlimited for most use), and not feeding user behavior into an ad company’s dataset is worth a lot on its own.
The failure mode costs it points. Some privacy-hardened browsers, unusual VPNs, and old devices get stuck in challenge loops, with little information about why. A support ticket saying Turnstile will not pass for one customer is painful to resolve. Give those users another way through.
Status page incidents
Published under Turnstile, plus incidents whose title names it.
- Last 3 years
- 30
- 8 from the title
- Major or critical
- 2
- Median time open
- 1.1 h
- Since January 2023
- 43
Counts what Cloudflare published, not what broke: time open is how long the status entry stayed open, and nothing before January 2023 is tracked at all. Incidents Cloudflare tagged against nothing but named in the title are counted too. The caveats in full.