Skip to content
Cloudflare Docs

FAQ

General

What features are available for Free or Enterprise users?

Refer to Availability for more information on features available per tier.

What languages does Turnstile support?

Refer to the list of supported languages for more information.

Does Turnstile conform to WCAG 2.1 Level AA accessibility standard?

Yes, Turnstile is WCAG 2.1 Level AA compliant.

Where can I get additional support for Turnstile?

Refer to the Cloudflare Community ↗ or join the Cloudflare Developers Discord server ↗.

Can I use Turnstile in websites not proxied by Cloudflare?

Turnstile can be embedded into any website without sending traffic through Cloudflare and works without showing visitors a CAPTCHA.

What is Turnstile's data privacy policy?

For information on Turnstile's data privacy policy, refer to the Turnstile Privacy Addendum ↗.

Troubleshooting

What happens if the user takes longer than five minutes?

The Turnstile widget needs to be refreshed to generate a new token. This can be done using the turnstile.reset function.

Can the front end use Siteverify?

The Siteverify API must not be called by the front end as this may reveal the secret key used to authenticate. An attacker may simply modify the front end to not perform the siteverify check at all, rendering Turnstile ineffective.

What is challenges.cloudflare.com, and why does my application connect to this origin?

Turnstile is hosted under challenges.cloudflare.com.

I am seeing a 401 error in your console during a Turnstile security check, is this a problem?

You can safely ignore the error. It is requesting a Private Access Token (PAT) that your device or browser does not support yet.

How can I obtain the Ray ID or QR code for troubleshooting?

You will need to provide a Ray ID or QR code when debugging issues. The Ray ID is found at the end of the challenge page. You can obtain the QR code by clicking the success/failure/spinner logo on the widget four times.

Can I use Turnstile on URI schemes such as file://?

No, Turnstile only works on http:// and https:// URI schemes. Other protocols such as file:// are not supported.

Why do I see a challenge on my proxied hostnames?

If your hostname is proxied through Cloudflare, visitors may experience challenges on your webpages.

Cloudflare issues challenges through the Challenge Platform, which is the same underlying technology powering Turnstile.

In contrast to our Challenge page offerings, Turnstile allows you to run challenges anywhere on your site in a less-intrusive way without requiring the use of Cloudflare's CDN.