Cloudflare offers Turnstile in Free and Enterprise plans. Both return a token after a browser check at a specific checkpoint.
Turnstile Enterprise adds device identifiers and management controls, but not full-session fraud detection.
Continuous session analysis requires Precursor, a separate Enterprise Bot Management feature.
hCaptcha brings together humanity verification, bot detection, and fraud prevention. hCaptcha Enterprise can analyze the full session and increase challenge difficulty.
Turnstile works for low-risk forms. Accounts, payments, and regulated online services need broader protection.
Cloudflare Turnstile vs hCaptcha Overview
| hCaptcha | Cloudflare Turnstile | |
|---|---|---|
| Built by | Intuition Machines, Inc. (independent) | Cloudflare |
| Best for | Enterprise bot, ATO, and fraud defense at scale | Checkpoint bot screening; Enterprise adds device signals and management features |
| Scope of analysis | Full session and user journey | Widget checkpoint; continuous signals require separate Precursor |
| Detection approach | Selective humanity verification + behavioral ML + Private Learning | Browser and network signals + proof of work + proof of space |
| Free tier | Free up to 10,000 requests/month | Free (unlimited) |
| Paid plans | Pro and Enterprise | Enterprise; pricing requires contact with sales |
| SLA | 99.99% (Enterprise) | No public Turnstile-specific SLA |
| Privacy posture | Zero PII, IP blinding, GDPR / CCPA / LGPD / PIPL / HIPAA fit | Processes browser and network signals; Enterprise adds short-lived device identifiers |
| Certifications | SOC 2 Type II, ISO 27001, ISO 27701, PCI DSS 4.0 L1, Data Privacy Framework | Covered by Cloudflare's certifications |
| Infrastructure | Works on any infrastructure | Works without Cloudflare CDN; WAF pre-clearance requires a Cloudflare zone |
| Global access | Every country, including markets where Google is blocked | Tied to Cloudflare network availability |
| Beyond CAPTCHA | Fraud protection, ATO defense, MFA, Private Learning, Account Defense | Enterprise Ephemeral IDs; continuous signals require separate Precursor |
| Migration from reCAPTCHA | Two lines of code; hundreds of plugins | Standalone widget; requires script, sitekey, and server verification changes |
| Cost vs reCAPTCHA | Up to 50% more cost-effective, per customer-reported data | Free plan; Enterprise price is not public |
How Does Turnstile Work?
Turnstile runs small JavaScript tests when a protected page loads. Most visitors do not see a visual puzzle.
Cloudflare lists these tests:
- Proof of work: The browser completes a small computational task.
- Proof of space: The browser completes a memory-based task.
- Web API probing: Turnstile checks APIs such as canvas, WebGL, and audio context.
- Browser tests: Turnstile looks for differences in rendering, events, input, and timing.
Turnstile also checks browser and network signals, including TLS fingerprints, HTTP/2 behavior, Client Hints, and browser properties.
Cloudflare uses these signals in machine learning models for bot detection. A successful challenge creates a one-time token.
Your server must validate the token through the Siteverify API. Turnstile's decision stops at that checkpoint.
What Does Turnstile Enterprise Add?
Paid Turnstile Enterprise adds operational controls and device-level signals to the free widget.
Cloudflare lists advanced bot detection and device fingerprinting for high-volume applications.
The plan includes unlimited widgets, up to 200 hostnames per widget, 30-day analytics, and custom branding.
Enterprise customers can enable Ephemeral IDs, short-lived identifiers that can link attempts from one device when an attacker changes IP addresses.
Ephemeral IDs can help detect credential stuffing and fake account creation, but do not provide a full-session risk model.
For continuous client-side signals, Cloudflare provides Precursor as a separate, optional part of Enterprise Bot Management.
Cloudflare states that Turnstile provides limited visibility into the rest of an application. Precursor collects those additional signals.
What are the Limitations of Turnstile?
Turnstile makes its standard decision at one checkpoint. It does not analyze the complete user journey by itself.
Reports on blackhat forums and our tests indicate that Turnstile apparently fails to detect modern anti-detect browsers. These browsers imitate legitimate browser signals.
Unlike hCaptcha, Turnstile has no fallback visual challenge mechanism to raise attacker costs. It relies on energy-inefficient proof-of-work tests.
In our tests, proof of work did not materially change attacker cost or difficulty.
Turnstile alone does not provide full-session detection for credential stuffing, account takeover, card testing, or transaction fraud.
Turnstile also does not include native modules for multi-accounting, synthetic identities, incentive abuse, clickfarms, and paid solving services.
Residential proxy abuse further reduces the value of IP reputation. Attackers can rotate clean residential IP addresses at a low cost.
What Are the Risks of Turnstile?
No public Turnstile-specific SLA
Cloudflare does not publish a Turnstile-specific SLA on its plan page. Enterprise buyers must confirm agreement terms during procurement.
Independent outage history
Downflare's Turnstile component history records 11 incidents and 6,074 minutes of reported downtime from August 13, 2025, through August 13, 2026.
Downflare reports duration based on Cloudflare's status data and notes that status pages can miss localized incidents.
Cloudflare service dependencies
On November 18, 2025, a Bot Management configuration file caused a major Cloudflare outage and prevented Turnstile from loading.
Cloudflare uses Turnstile on its dashboard login, so users without active sessions could not log in during the outage.
Cloudflare reported two dashboard impact events. The first continued for 100 minutes, and the second continued for 50 minutes.
A second Cloudflare network outage occurred on December 5, 2025. It affected 28% of hosted applications for approximately 25 minutes.
Cloudflare then started its Code Orange: Fail Small program. Cloudflare stated that circular dependencies made its incident response slower.
How hCaptcha stayed up during the Cloudflare outage
How Does hCaptcha Differ From Turnstile?
1. Detection that scales with the threat
Turnstile uses direct browser and network detection; Enterprise adds device correlation through Ephemeral IDs.
hCaptcha uses behavioral machine learning and Private Learning, and can increase challenge difficulty when confidence is low.
A fallback challenge makes the attacker complete a task that is difficult to automate. Proof of work cannot provide the same test.
2. Integrated session and fraud protection
Cloudflare separates continuous session signals into Precursor and Enterprise Bot Management. Turnstile remains the checkpoint component.
hCaptcha Enterprise includes session risk, bot defense, and fraud protection in one platform. It does not require a separate product.
3. Independent infrastructure
Turnstile works without Cloudflare CDN, but the service still depends on Cloudflare's Challenge Platform and related control systems.
hCaptcha is separate from Cloudflare, Google, and any CDN provider. It works on any supported infrastructure and in every country.
4. Privacy and compliance controls
hCaptcha provides privacy controls for regulated workloads:
- Data minimization: hCaptcha supports pre-blinded data and IP blinding.
- First-Party Hosting: Customers can serve verification from their own subdomain.
- Certifications: SOC 2 Type II, ISO 27001, ISO 27701, PCI DSS 4.0 L1, and EU-US Data Privacy Framework.
hCaptcha supports Zero PII deployments for sensitive workloads. Turnstile does not publish a similar pre-blinded processing mode.
5. Protection beyond the widget
hCaptcha Enterprise covers account takeover, fraud protection, credential stuffing, card testing, multi-accounting, and synthetic identities.
It also covers transaction fraud, Safer MFA, incentive abuse, and paid solver activity. Turnstile does not include these native fraud modules.
Why Do Larger Services Use hCaptcha Enterprise?
Risk scores
hCaptcha Enterprise returns a numeric risk score for each session. Customers can set rules and actions for different risk levels.
Turnstile returns a success token. Enterprise can also return an Ephemeral ID, but it does not return a similar session risk score.
Custom threat models
Private Learning trains a customer-specific machine learning model on pre-blinded traffic. The model learns the customer's normal traffic and specific attacks.
Clickfarm and solver detection
Paid solver traffic can come from real people, so a checkpoint may receive valid human interaction during coordinated abuse. Advanced Threat Signatures group solver activity across devices and IP addresses, exposing coordination that checkpoint detection can miss.
APT detection and mitigation
Advanced Persistent Threats can rotate IP addresses and keep request rates low. Advanced Threat Signatures group related activity across devices and sessions.
Zero PII
hCaptcha supports GDPR, CCPA, HIPAA, PCI, LGPD, and PIPL requirements through pre-blinded data and IP blinding.
hCaptcha can detect fraud without direct access to user PII.
Choosing Between Cloudflare Turnstile and hCaptcha
Use Turnstile Free for a low-risk checkpoint
Turnstile Free can filter simple bot traffic on websites, contact forms, and small forums. It provides unlimited verification requests.
Use hCaptcha Enterprise for high-risk services
Payments, e-commerce, gaming, financial services, and regulated services need session risk, fraud protection, and strong compliance controls.
hCaptcha Enterprise includes these capabilities under a published SLA. Start an Enterprise pilot.
Switch from reCAPTCHA or Turnstile
hCaptcha is API-compatible with reCAPTCHA v2. The standard reCAPTCHA change uses two lines of code and works on any platform.
Why Doesn't "Direct Detection" of Bots Work Reliably?
Direct detection checks browser and network signals against expected human traffic. Attackers can copy or hide many of these signals.
Browsers also remove or restrict browser fingerprinting signals, leaving detection systems with less data.
Anti-detect browsers imitate common browser profiles. Residential proxies give each session a clean IP address.
TLS fingerprints and HTTP/2 behavior can stop simple scrapers. They are weaker against real browsers, slow attacks, and distributed proxy traffic.
Modern AI agents can operate inside real browsers and follow normal execution paths. This reduces the difference between human and automated traffic and makes browser fingerprinting alone less reliable.
Humanity verification tests what browser signals cannot. Private Learning and behavioral analysis review intent rather than only browser properties.
Why Doesn't "Proof of Work" Stop Many Attacks?
Proof of work makes a browser solve a computational task. The task consumes CPU time and energy.
Credential stuffing attacks often use compromised devices, rented botnets, or low-cost cloud infrastructure. The attacker does not own the affected device.
The device owner or cloud provider covers the energy cost. The attacker has little or no marginal cost.
Proof of work adds overhead but does not materially change attack difficulty. It also does not stop paid human solvers or clickfarms.
Frequently Asked Questions
What's the difference between Cloudflare Turnstile and hCaptcha?
Turnstile checks browser and network signals at a specific checkpoint. hCaptcha brings together checkpoint verification, session risk, fraud protection, and account defense.
Is hCaptcha better than Turnstile?
Use Turnstile for low-risk forms. Use hCaptcha Enterprise for payments, accounts, regulated workloads, and organized attacks.
What does Turnstile Enterprise add?
Turnstile Enterprise adds unlimited widgets, more hostnames, 30-day analytics, custom branding, and Ephemeral IDs. Pricing requires contact with Cloudflare sales.
How effective is Cloudflare Turnstile?
Turnstile can filter simple automated traffic with low user friction. It is weaker against anti-detect browsers, residential proxies, paid solvers, and session-level fraud.
What is the difference between Cloudflare WAF and Turnstile?
A WAF filters network-edge traffic using rules and reputation data. Turnstile protects specific client-side checkpoints. They operate at different layers, so many deployments use both.
Does Turnstile work without Cloudflare?
Turnstile works without the Cloudflare CDN. Some features, such as WAF pre-clearance, require a domain in a Cloudflare account.
Can I switch from Turnstile to hCaptcha?
Replace the widget script, widget tag, sitekey, and server verification endpoint. See the hCaptcha migration guide.
