Correction, October 13, 2026: Turnstile is free, but agent setup can use your coding-tool allowance. Code edits happen in the environment where the agent runs.
What happened
Cloudflare has launched Turnstile Spin, a way to set up Turnstile, its free alternative to CAPTCHA (the “click all the traffic lights” puzzles sites use to block bots), by handing the whole job to your coding agent instead of doing it yourself.
You can start Spin three ways: from the Cloudflare dashboard, from Wrangler (Cloudflare’s command-line tool for managing your account from a terminal), or by pasting Cloudflare’s public Turnstile Spin skill directly into an agent like Claude Code, Cursor, or Codex. A skill here is just a packaged set of instructions that tells the agent exactly how to do this one task, so you don’t have to write the setup prompt yourself.
Once started, the agent edits your codebase directly. Cloudflare says Spin “does not send your application code to Cloudflare or ask Cloudflare to change it remotely.” The changes happen in the environment where your agent is working.
Why it matters
Turnstile has always required two separate pieces of work. First, your frontend (the part of your site that runs in a visitor’s browser) has to display the widget, which runs a quiet background check and hands back a token if the visitor looks legitimate. Second, your backend (the part running on your own server) has to send that token to Cloudflare’s Siteverify API, a specific web address Cloudflare’s servers check requests against. That second check is the only step that actually confirms whether the visitor passed.
That second step is easy to skip, and skipping it is not a small bug. If your backend never calls Siteverify, the widget still shows up and still looks like it’s working, but nothing is stopping a bot from submitting your form or login regardless of whether it passed the check. The widget becomes decoration.
Cloudflare built Spin’s “fix” mode around exactly this gap. It watches Siteverify traffic for every widget on your account, and if a widget has been serving traffic without a matching backend check, the Turnstile page in your dashboard shows a “Fix with Spin” action. Approve it, and the agent adds the missing backend call without touching the widget that’s already live.
Spin also handles migration: if it detects you’re running Google reCAPTCHA or a similar CAPTCHA, it proposes a plan to swap it for Turnstile and applies it once you approve.
Turnstile itself is not new. Cloudflare says it handles about three billion verification checks on a typical weekday, with more than 23,000 accounts creating a new widget in a single recent week. Spin is newer: Cloudflare says it has recorded more than 65,000 successful widget setups through Spin since its release in July, and developers have copied its generated setup prompt more than 30,000 times.
Who should care
Check this if you have a Turnstile widget but are unsure whether its backend calls Siteverify, especially if an agent set it up. For a new setup, Spin can handle the frontend and backend together.
It matters less if you’re not using Turnstile at all, or if you already have a verified working implementation with no plans to touch it.
What builders should do next
Open the Turnstile page in your Cloudflare dashboard and check whether any of your existing widgets show a “Fix with Spin” banner. The banner reports widget traffic without matching Siteverify checks. Review the proposed backend change before approving the fix.
If you’re setting up Turnstile for the first time, paste the Spin skill URL into your coding agent and let it walk through both the frontend widget and the backend Siteverify call together, rather than doing the two steps in separate sessions where one half is easy to forget.
Either way, don’t take “the widget is showing up” as proof your site is protected. The browser widget alone does not verify the token on your server. Confirm your backend is actually calling Siteverify and rejecting requests when it fails, since that’s the half doing the real work.
Turnstile itself is free. Agent setup can still consume your coding-tool allowance. Review the backend diff and confirm that failed validation blocks the protected action.
End of article