Glossary · Security and access
Cloudflare Turnstile
Cloudflare's third-party challenge service for assessing whether a website request appears automated or abusive.
Also called: Turnstile
Definition
Cloudflare Turnstile runs browser checks and returns a short-lived token that a website must validate on the server. A valid token supports an abuse-control decision; it does not prove the visitor's identity or the truth of submitted information.
Why it matters
Forms need abuse controls that are actually connected to server-side validation without making unsupported claims about perfect bot prevention.
Common misunderstanding
Embedding the widget is not sufficient by itself; the server must validate the token and bind the expected hostname and action where configured.
Related terms
Related system family: Secure Integrations & Custom Tools
Sources
- Cloudflare Turnstile overview (opens in a new tab) · Cloudflare Developers
Last reviewed July 16, 2026