Bot Protection vs Cloudflare Turnstile

Turnstile proves, at one form, that a browser passed Cloudflare's checks, for free. Bot Protection tells your server who is behind the request, a person or a bot and why, at every action you protect, with nothing for the visitor to see. They solve different halves: many sites use Turnstile as the challenge Bot Protection asks for.

At a glance

	Bot Protection	Cloudflare Turnstile
How it works	A tag on your pages reads how the browser behaves; before a sign-up, sign-in or checkout your server makes one call and gets a decision.	A widget on the page runs small non-interactive checks (proof of work, browser APIs); your server verifies its token at Cloudflare's siteverify endpoint.
What your visitor sees	Nothing.	The widget: in managed mode a checkbox when the visitor looks risky; non-interactive and invisible modes show none.
In your request path	No. Your server calls it with your own timeout.	No. The browser loads the widget from Cloudflare; your server calls siteverify.
What your server gets	A class (human high to bot high), a bot score, the reasons, and an action: allow, challenge or block.	Success or failure, the hostname, an action and custom data. No score. A token is valid for 5 minutes and can be checked once.
When it is down	Your server lets the visitor through: fail open.	Not stated. The docs ask for a fallback, retries and a timeout; their example treats a failed call as a failed check.
Watch before it blocks	Yes: in monitor mode every answer is allow, with what block mode would have done.	No such mode: analytics show the challenges afterwards, and test keys always pass or always fail.
Price to start	A 14-day free trial with 10,000 decisions, then $29 a month for 1 million.	Free, with unlimited challenges and up to 20 widgets. The only paid plan is Enterprise, through sales, with no public price.
Integration	The tag, and one call from your server; a prompt for your coding agent does both.	The widget in each form, and a server-side check of its token.
Where it runs	Servers in Germany (EU); IPs and tokens are kept only as keyed hashes.	Cloudflare's network; your site does not need to be on Cloudflare.

When Cloudflare Turnstile is the better choice

You want a free, proven challenge on a form, and a yes or no is enough.
Your visitors may see a checkbox now and then, and that is fine for you.
You already run on Cloudflare and want everything in one dashboard.

When Bot Protection is the better choice

You want to know why: the class, the score and the reasons, to log, review or tune.
You protect sign-up, sign-in and checkout without adding anything the visitor sees, and start in monitor mode to see what would be blocked.
You want farms caught: groups of sessions that share a network, a device or a rhythm, which one widget at one form cannot see.

Using both

Bot Protection's challenge action is where a challenge belongs. Ask Bot Protection first; for the few visitors it answers challenge, show Turnstile, and let the rest through untouched.

Questions

Is Turnstile a CAPTCHA?

It is Cloudflare's alternative to one: most visitors never solve anything, and the widget decides on its own when to show a checkbox.

Can Bot Protection replace Turnstile?

For most sign-ups, yes: it decides without a widget. When you want a visible proof for the doubtful few, keep Turnstile as the challenge.

Sources

Checked on the vendors' own pages on 17 October 2026; prices change, so check theirs before you decide.

Bot Protection: the quickstart, pricing, and every comparison.