Cloudflare Turnstile

Cloudflare Turnstile is a CAPTCHA alternative: a challenge widget that verifies a visitor's browser is behaving like a real browser, usually without showing a puzzle at all. Instead of asking humans to prove themselves by clicking traffic lights, Turnstile runs a rotating set of non-interactive browser checks in the background and issues a token when they pass. Most visitors see a brief checkmark, or nothing.

The token is the important part. The widget places it in a form field, and the receiving server presents it to Cloudflare's verification endpoint to confirm it is genuine, unexpired, and issued for the right site. A submission without a valid token did not pass the challenge, whatever its other fields claim.

Turnstile positions itself as friendlier than image-grid CAPTCHAs on two fronts: friction, since most humans are never interrupted, and privacy, since it does not depend on tracking identity across sites. It still adds a script tag and an external dependency to the page, which is why services that already run layered defenses tend to offer it as an optional escalation for forms under sustained attack rather than a mandatory gate.

In SheetLink Forms, Turnstile is exactly that: an optional layer you can enable per form, on top of the standard stack of honeypot, rate limits, origin allowlist, and content heuristics. When enabled, the widget's token travels in the reserved cf-turnstile-response field, and a submission that fails the challenge is refused with a 403. Everything else behaves as usual - suspicious-but-plausible submissions still go to quarantine for one-click review.

Where the challenge sits in the stack is shown on the security page; the reserved field and error codes are in the docs.