Cloudflare launches Turnstile Spin: AI coding agents can now help install website bot protection

What happened

On September 25, 2026, Cloudflare announced Turnstile Spin on its official blog. As Cloudflare describes it, Turnstile is a privacy-focused client-side challenge it launched in 2023. It is a check that runs in the visitor's browser to tell humans apart from automated programs, doing the job a CAPTCHA does. A CAPTCHA is the familiar test that tries to separate people from bots. The company says Turnstile is free to use, works on any website (traffic does not need to be proxied through Cloudflare) and never asks visitors to solve puzzles. Spin is an agent-assisted, end-to-end way to install it.

Cloudflare explains that Turnstile requires a two-step installation. The first step happens on the frontend, the part of the site that visitors see. There you add the widget, a small Turnstile element on the page, which obtains a token: a one-time pass showing the check was run. The second step happens on the backend, the server-side code visitors never see. The backend sends that token to the Siteverify API, Cloudflare's checking service, to verify whether the visitor passed the challenge. The company says Turnstile handles about three billion verifications on a typical weekday, and in one recent week more than 23,000 accounts created new widgets. However, it was originally built for developers, and far more people need simple bot protection than those who write backend code every day.

Read the full description

Sources are collected, independently checked, then reviewed by Jev.

How Turnstile Spin works

According to Cloudflare, the user first chooses what needs protecting. The agent then locates the relevant frontend and backend code, proposes a plan and waits for approval before completing the integration on both sides. Spin can be launched from the Cloudflare dashboard or from Wrangler, Cloudflare's command-line tool. It can also be started by pasting a public skill URL into the agent, which is a web link containing instructions the agent can follow.

Cloudflare stresses that Spin does not send application code to Cloudflare, and Cloudflare does not modify it remotely. The actual changes are made inside the user's own codebase by whatever agent they already use (for example Claude Code, Cursor, Codex or others). The company says the only new resource added to the account is the Turnstile widget, and verification stays on the user's own backend.

What it means for everyday users and website owners

Cloudflare notes that AI is helping more people build applications while also giving attackers more ways to automate abuse. Spin aims to let people without backend experience complete the setup correctly, while experienced developers can skip repetitive work and catch missed steps. For individuals or small teams building sites quickly with AI tools, this means the barrier to adding bot protection to forms such as login and sign-up may be lower.

• Before approving, read the agent's proposed change plan carefully and confirm it only touches the frontend and backend files you expect.
• After installation, confirm the backend actually performs Siteverify validation rather than only having the frontend widget added.
• If you currently use another CAPTCHA, consult the tool-specific migration guides in Cloudflare's documentation before migrating.

Early usage figures and caveats

Cloudflare says that since Spin arrived in the dashboard in July, more than 65,000 widgets have been successfully created with Spin. It also says developers have copied the generated prompts more than 30,000 times. The post's author, Jules Lemee, says Spin was a project developed during their internship. These figures and feature descriptions all come from Cloudflare itself. Turnstile, according to Cloudflare, is free for everyone; whether to adopt it depends on your site's own needs.

Browse the latest news in this topic

• Tech news