Cloudflare Turnstile

Scale plan Last reviewed March 5, 2026

Cloudflare Turnstile is a CAPTCHA alternative that blocks bots without asking visitors to solve a visual challenge, and it works without routing your traffic through Cloudflare. On ShortStack it runs as the campaign page first loads, stopping bots before they interact with the page, while Google reCAPTCHA validates the entry form at submission.

Overview

"Turnstile is Cloudflare’s smart CAPTCHA alternative. It can be embedded into any website without sending traffic through Cloudflare and works without showing visitors a CAPTCHA."

How Cloudflare Turnstile works on ShortStack

ShortStack incorporates Cloudflare Turnstile and Google reCaptcha for bot prevention.

Cloudflare Turnstile: Runs when the campaign page first loads to block bots before they interact with the page.

Google reCaptcha: Activates during entry form submission to validate user actions.

Default behavior

Turnstile is automatically active on all landing pages. Turnstile is automatically disabled for embeds but can be re-enabled in the Campaign Builder Settings.

Cloudflare Turnstile settings

To configure Cloudflare Turnstile for your campaign:

Steps to access settings

Open your campaign in the Campaign Builder.
Click the gear icon at the top to access Campaign Settings.
In the pop-up, navigate to the Security section.
Use the dropdown menu to select your desired Turnstile setting.

Turnstile options

Invisible:

Default setting.
Uses an invisible challenge that does not require user interaction.
Best for embedded campaigns.

Visible:

An interactive challenge may appear based on visitor information.
Prompts visitors to check a box when necessary.
Best for stand-alone landing pages.

Disable:

Completely disables Cloudflare Turnstile.
Not recommended due to increased risk of fraudulent entries.

Enabling Turnstile for embedded campaigns

To activate Turnstile for embedded campaigns check the box labeled Enable if my campaign is embedded.

Why is my campaign loading Slower?

Cloudflare Turnstile works like a physical turnstile at an event, ensuring orderly and secure access. Similar to scanning tickets at a concert, visitors are verified before accessing the campaign. This process can slightly increase load time to filter out bots.

If the load time is unsatisfactory, you can disable Turnstile in the Security settings as described above.

Learn more about Cloudflare Turnstile

For additional details about Cloudflare Turnstile and its functionality, refer to Cloudflare’s official documentation.

How to View and Manage Entries (Video)

7 Essential Security Features to Prevent Cheating (Blog)

Was this helpful?