cloudflare-turnstile
Cloudflare Turnstile provides CAPTCHA-alternative bot protection for modern web applications. Set up the widget on your frontend, validate tokens server-side via the Siteverify API, and choose between managed, non-interactive, or invisible modes based on your security and UX needs.
Cloudflare Turnstile lets you add bot protection to web forms with server-side token validation across Workers, React, Next.js, and Hono.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-25
Cloudflare Turnstile lets you add bot protection to web forms with server-side token validation across Workers, React, Next.js, and Hono. Cloudflare Turnstile provides CAPTCHA-alternative bot protection for modern web applications. Set up the widget on your frontend, validate tokens server-side via the Siteverify API, and choose between managed, non-interactive, or invisible modes based on your security and UX needs.
Use it when
- Cloudflare Turnstile error 300030 typically indicates a token validation failure on the server side.
- Cloudflare Turnstile tokens are validated using the Siteverify API.
Verify before relying
Read SKILL.md below before installing (19 files). Open directory: indexed for reading, not audited.
Install
secondsky/claude-skills/cloudflare-turnstile · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I add Turnstile to my website?
Cloudflare Turnstile provides CAPTCHA-alternative bot protection for modern web applications. To add Turnstile, first create a site in the Cloudflare dashboard to obtain your Site Key and Secret Key. Then embed the Turnstile widget on your frontend by including the Cloudflare script and rendering the widget container. On form submission, retrieve the token and validate it server-side using the Siteverify API with your Secret Key. Choose between managed (interactive), non-interactive, or invisible modes based on your security and UX needs.
What does Turnstile error 300030 mean and how do I fix it?
Cloudflare Turnstile error 300030 typically indicates a token validation failure on the server side. This occurs when the Siteverify API rejects the token, often due to an expired token (valid for 5 minutes), an incorrect Secret Key, or a mismatch between the Site Key used on the frontend and the one configured in your Cloudflare dashboard. Verify your keys match, ensure tokens are validated immediately after submission, and check that your server is sending the correct token and Secret Key to the Siteverify endpoint.
How do I validate Turnstile tokens securely on the server side?
Cloudflare Turnstile tokens are validated using the Siteverify API. After the user completes the challenge and your frontend receives a token, send a POST request from your server to the Siteverify endpoint with your Secret Key and the token. The API returns a success boolean and metadata. Never expose your Secret Key on the frontend; always validate server-side. Store your Secret Key as an environment variable and use it only in your backend code to prevent unauthorized token validation.
How do I integrate Turnstile with React or Next.js?
Cloudflare Turnstile integrates with React and Next.js by including the Turnstile script in your HTML head and rendering the widget container in your component. For React, use the useEffect hook to initialize the widget after the script loads. For Next.js, add the script in your _document.js or layout file and render the widget in your form component. On form submission, retrieve the token from the widget's callback and send it to your backend for validation via the Siteverify API.
What is the Cloudflare Turnstile CSP error 200500?
Cloudflare Turnstile CSP error 200500 occurs when your Content Security Policy (CSP) headers block the Turnstile widget script or resources. To fix this, add Cloudflare's Turnstile domain to your CSP directives: allow `https://challenges.cloudflare.com` in script-src and frame-src. If using a strict CSP, also allow the Turnstile API endpoint. Update your CSP headers in your web server or application configuration to permit Cloudflare's resources.
Can I migrate from reCAPTCHA or hCaptcha to Cloudflare Turnstile?
Cloudflare Turnstile is a modern CAPTCHA alternative designed as a replacement for reCAPTCHA and hCaptcha. Migration involves obtaining your Turnstile Site Key and Secret Key from the Cloudflare dashboard, replacing your existing CAPTCHA script and widget with Turnstile's, and updating your server-side token validation to use the Siteverify API instead of your previous provider's endpoint. The integration process is similar, making migration straightforward for most applications.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Cloudflare Turnstile
Status: Production Ready ✅ | Last Verified: 2025-11-26
Dependencies: None (optional: @marsidev/react-turnstile for React)
Contents: [Quick
(truncated - see the full file via the links below)
File tree — 15 files
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/SKILL.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/advanced-topics.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/browser-support.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/common-patterns.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/error-codes.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/migration-guide.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/mobile-implementation.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/react-integration.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/setup-checklist.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/testing-guide.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/references/widget-configs.md
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/scripts/check-csp.sh
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/templates/turnstile-hono-route.ts
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/templates/turnstile-react-component.tsx
plugins/cloudflare-turnstile/skills/cloudflare-turnstile/templates/turnstile-server-validation.ts
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Implement Cloudflare Turnstile bot protection on a web form or application”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill solves Cloudflare Turnstile CAPTCHA challenges by submitting a site key and page URL to AceDataCloud's API, returning a valid token for form submission. It supports both synchronous blocking and asynchronous polling modes, with tokens valid for approximately 120 seconds.
turnstile-spin automates the complete Turnstile integration workflow: it scans your codebase, creates a widget via the Cloudflare API, embeds it at your chosen protection points (forms, endpoints, downloads), and wires server-side siteverify into your backend. The skill handles authentication, domain registration, framework detection, and validates the full flow before confirming success.
Turnstile Spin orchestrates a complete Cloudflare Turnstile deployment in one workflow. It handles authentication, scans your codebase for insertion points, creates the widget via API, deploys a managed siteverify Worker, wires frontend snippets, and validates the integration before completion.
better-auth is a production-ready authentication framework for TypeScript applications, supporting Next.js, Nuxt, Cloudflare Workers, and 15+ other frameworks. It handles email/password login, OAuth providers, two-factor authentication, passkeys, and role-based access control with built-in D1, PostgreSQL, MongoDB, and MySQL adapters. Deploy in minutes with a CLI, migrations, and pre-built plugins for organizations, SSO, and API keys.
Navigate Cloudflare's full platform—from serverless compute and data storage to AI inference and edge security. This skill maps your use case to the right product via decision trees, then points you to authoritative references for APIs, limits, and configuration. Always retrieves current docs over cached knowledge.
This skill provides structured guidance for building across Cloudflare's full platform—from edge compute with Workers and Pages to data storage, AI inference, and security. Decision trees route you to the right product for your use case, while retrieval-first design ensures you get current API details, limits, and pricing from official docs rather than stale knowledge.
More skills cloudflare-deploy (Apache-2.0)