The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To solve Cloudflare Turnstile for a protected form or application action, render its widget on the page, send the resulting token to your backend, and validate that token with Cloudflare’s Siteverify API before allowing the action. A completed browser challenge alone does not prove the token is valid. Keep the secret key on your server. Turnstile can also be used on sites that are not proxied through Cloudflare.
How the Turnstile integration works
A Turnstile widget uses two keys: a public sitekey that identifies the widget in browser code and a private secret key used for server-side validation. Configure the widget’s mode, allowed hostnames and appearance, then place it on the page where the protected action happens.
As an Amazon Associate I earn from qualifying purchases.
Cloudflare’s getting-started guide puts the essential boundary plainly: “Regardless of how you create and manage your widgets, you will still need to embed the widget on your webpage and validate the token on your server.” Cloudflare Turnstile getting started.
- Create a widget in the Cloudflare dashboard and configure its hostnames and mode.
- Embed the widget on the form or page where the user takes the protected action.
- Send the token from the browser to your application backend along with the form submission.
- From the backend, submit the token and secret to Siteverify and allow the action only if validation succeeds and the response meets your application’s checks.
Choose how the widget renders and runs
Implicit or explicit rendering
Implicit rendering is the straightforward choice for a static page: the Turnstile script scans for an element with the cf-turnstile class and renders the widget there. Choose explicit rendering when your JavaScript needs to control where or when the widget is created, such as in a dynamic form or a flow that displays the protected action later.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Automatic or manual execution
Automatic execution begins verification when the page loads. With manual execution, your application calls turnstile.execute() at the point in its flow where verification should begin. Manual execution is useful when the user has not yet reached the protected action or when you want to avoid starting verification immediately.
Managed, non-interactive or invisible mode
Choose the widget mode in its configuration to suit the interaction you want users to encounter. The mode is a widget-level choice; it does not replace backend validation.
Default form field or custom token handling
By default, a rendered widget can add a hidden form field named cf-turnstile-response containing the token. That can simplify ordinary form submissions. If your application uses a custom submission flow, you can rename or disable the field and pass the token through your own handling instead. In either case, the backend still needs to validate it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Validate each token on the backend
Call Cloudflare’s Siteverify API from your backend for every protected submission. The secret key must never appear in browser JavaScript or be sent to the user’s device. The browser should send the token to your own application; only the backend should hold the secret and call Siteverify.
Use the Siteverify response as a security decision, not merely a diagnostic. Require successful validation before carrying out the protected action. If your widget configuration and application policy use them, also check response fields such as hostname and action against the expected values. Use HTTPS for the integration, set a timeout for the validation request, and define what the application does when the API is unavailable. Log enough non-secret context to diagnose failures, but do not log the secret.
Cloudflare’s getting-started guide describes Turnstile tokens as up to 2,048 characters long. Treat the token as an opaque value and pass it through without truncating it.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Account for token expiry and one-time use
A token expires after five minutes and can be redeemed only once. A delayed submission, a duplicate request, or a retry that resubmits the same token can therefore fail validation. When a user retries, obtain a fresh token from the widget rather than replaying the old one. Cloudflare Turnstile documentation.
Prepare hostnames and browser security policy
- In the widget’s Hostname Management settings, authorize the domain where it will run. A sitekey-domain mismatch can prevent the widget from working.
- If your Content Security Policy restricts script or connection origins, allow the required
challenges.cloudflare.comorigin as applicable to your policy and integration. - Keep the secret in secure backend configuration, not in page markup, client-side environment variables, or browser-delivered bundles.
- Do not allow local hostnames in production. For Turnstile Spin deployments, verify the deployment-specific hostname returned by Siteverify.
Test predictably before production
Automated browsers can be detected as bots, which makes tests that rely on a real challenge unpredictable. Cloudflare provides dummy test sitekeys and matching test secrets for controlled pass, fail, interactive, and already-spent-token scenarios. Use the matching test credentials in a non-production environment. A dummy token will not validate with a production secret, and production credentials should not be substituted for test credentials in automated runs. See Cloudflare’s testing documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose common client-side errors
Use the specific error code to narrow the next check rather than treating every failed challenge as the same problem. Cloudflare’s client-side error documentation maps these codes to configuration and browser checks:
Rank #4
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
| Error code | What to check |
|---|---|
110100 or 110110 |
Confirm the sitekey and the widget’s dashboard configuration. |
110200 |
Authorize the current domain in Hostname Management. |
110600 or 110620 |
Check the visitor’s clock and interaction timing; retry or reset the interaction timeout as appropriate. |
200100 |
Check the visitor’s clock and whether an intermediary has cached the challenge. |
200500 |
Check whether challenges.cloudflare.com is blocked or cannot load. |
400070 |
Check the dashboard: the sitekey is disabled. |
Generic 300* or 600* |
Cloudflare classifies these as generic challenge failures; consult its current troubleshooting guidance because the code family alone does not identify one root cause. |
For errors that may be temporary, give the user a clear way to retry and obtain a fresh token. An error callback can provide a useful recovery path, while backend timeouts and API failures should have defined handling rather than silently authorizing the protected action. Log the error code and relevant request context without exposing secret keys.
What Turnstile Spin does—and does not do
Turnstile Spin can guide developers through creating a widget and provide a prompt for embedding it and wiring Siteverify into an existing backend. It does not deploy infrastructure on the developer’s behalf. The backend integration, including validation of the deployment-specific hostname returned by Siteverify, remains necessary. See Cloudflare Turnstile Spin documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
