Cloudflare Turnstile is Cloudflare's CAPTCHA alternative — a free widget that verifies a visitor using Cloudflare's own bot-management signals instead of an image puzzle, usually passing silently with no visible challenge at all. It's the human-verification layer on a large and growing share of Cloudflare-protected sites.
Turnstile runs a non-interactive JavaScript challenge that evaluates the same kind of signals Cloudflare's edge already sees — browser environment consistency, request patterns, and Cloudflare's own IP and bot-score data — without sending anything to Google, which is the explicit selling point for privacy-conscious sites. Most real visitors never see a puzzle at all; the widget just returns a pass token silently in the background.
Because it's free and integrates directly with Cloudflare's existing edge infrastructure, Turnstile has spread quickly across sites that previously used reCAPTCHA or hCaptcha purely for the login-form and comment-spam use case, not necessarily as part of a broader anti-bot posture.
Turnstile issues a cf-turnstile-response token that a form submission must include to be accepted — the token comes from running the widget's JavaScript in a real browser context, so a plain HTTP client that never executes JavaScript can't produce one at all. A scraper hitting a Turnstile-protected form without a JS-capable browser fails silently at submission, which can look like a different bug entirely if you're not specifically checking for a missing token.
As with any invisible check, the goal for legitimate automation is the same as elsewhere: a real, consistent browser environment that Turnstile's evaluation scores as ordinary, rather than trying to fabricate a token outside a browser context.
How Crawlora handles this
Crawlora's browser-rendering tier executes Turnstile's challenge the same way a real visitor's browser does — a genuine environment producing a genuine token — rather than attempting to replay or forge the token separately from the rest of the request.
Related reading
Glossary
FAQ
It serves the same purpose — telling humans and bots apart — but it's usually invisible, with no image puzzle for most visitors, and it doesn't share data with Google the way reCAPTCHA does. It's Cloudflare's own implementation, built on its existing bot-management signals.
Turnstile requires a token generated by running its JavaScript in a real browser context. A plain HTTP client that doesn't execute JavaScript never produces that token, so the form submission is rejected without necessarily returning an obvious error.
Yes, for site owners — it's included with Cloudflare's platform, which is a large part of why adoption has grown quickly among sites that previously paid for or self-hosted reCAPTCHA or hCaptcha.
Beyond Cloudflare Turnstile, Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.