cloudflare-turnstile

SKILL.md

Bot protection with Turnstile CAPTCHA alternative for forms, login, and signup flows.

Supports implicit (auto-render) and explicit (programmatic) rendering modes, plus React integration via @marsidev/react-turnstile

Mandatory server-side validation via Siteverify API; tokens expire in 5 minutes and are single-use only

Prevents 15 documented issues including CSP blocking, Safari Hide IP failures, Chrome/Edge first-load errors, token reuse bugs, and Jest incompatibility

Includes testing keys, error handling patterns, Hono/Next.js examples, and troubleshooting for error codes 100*/200*/300*/400*/600*

Cloudflare Turnstile

Status: Production Ready ✅
Last Updated: 2026-01-21
Dependencies: None (optional: @marsidev/react-turnstile for React)
Latest Versions: @marsidev/react-turnstile@1.4.1, turnstile-types@1.2.3

Recent Updates (2025):

December 2025: @marsidev/react-turnstile v1.4.1 fixes race condition in script loading

August 2025: v1.3.0 adds rerenderOnCallbackChange prop for React closure issues

March 2025: Upgraded Turnstile Analytics with TopN statistics (7 dimensions: hostnames, browsers, countries, user agents, ASNs, OS, source IPs), anomaly detection, enhanced bot behavior monitoring

January 2025: Brief remoteip validation enforcement (resolved, but highlights importance of correct IP passing)

2025: WCAG 2.1 AA compliance, Free plan (20 widgets, 7-day analytics), Enterprise features (unlimited widgets, ephemeral IDs, any hostname support, 30-day analytics, offlabel branding)

Quick Start (5 Minutes)