hCaptcha vs. Turnstile: Which One Actually Protects You in 2026?

Cloudflare offers Turnstile in Free and Enterprise plans. Both return a token after a browser check at a specific checkpoint.

Turnstile Enterprise adds device identifiers and management controls, but not full-session fraud detection.

Continuous session analysis requires Precursor, a separate Enterprise Bot Management feature.

hCaptcha brings together humanity verification, bot detection, and fraud prevention. hCaptcha Enterprise can analyze the full session and increase challenge difficulty.

Accounts, payments, and regulated online services need protection across sessions, accounts, and transactions.

Cloudflare Turnstile vs hCaptcha Overview

How Does Turnstile Work?

Turnstile runs small JavaScript tests when a protected page loads. Most visitors do not see a visual puzzle.

Cloudflare lists these tests:

• Proof of work: The browser completes a small computational task.
• Proof of space: The browser completes a memory-based task.
• Web API probing: Turnstile checks APIs such as canvas, WebGL, and audio context.
• Browser tests: Turnstile looks for differences in rendering, events, input, and timing.

Turnstile also checks browser and network signals, including TLS fingerprints, HTTP/2 behavior, Client Hints, and browser properties.

Cloudflare uses these signals in machine learning models for bot detection. A successful challenge creates a one-time token.

Your server must validate the token through the Siteverify API. Turnstile's decision stops at that checkpoint.

What Does Turnstile Enterprise Add?

Paid Turnstile Enterprise adds operational controls and device-level signals to the free widget.

Cloudflare lists bot detection and device fingerprinting for high-volume applications.

The plan includes unlimited widgets, up to 200 hostnames per widget, 30-day analytics, and custom branding.

Enterprise customers can enable Ephemeral IDs, short-lived identifiers that can link attempts from one device when an attacker changes IP addresses.

Ephemeral IDs can help detect credential stuffing and fake account creation, but do not provide a full-session risk model.

For continuous client-side signals, Cloudflare provides Precursor as a separate, optional part of Enterprise Bot Management.

Cloudflare states that Turnstile provides limited visibility into the rest of an application. Precursor collects those additional signals.

What are the Limitations of Turnstile?

Turnstile makes its standard decision at one checkpoint. It does not analyze the complete user journey by itself.

Reports on blackhat forums and our tests indicate that Turnstile apparently fails to detect modern anti-detect browsers. These browsers imitate legitimate browser signals.

Unlike hCaptcha, Turnstile has no fallback visual challenge mechanism to raise attacker costs. It relies on energy-inefficient proof-of-work tests.

In our tests, proof of work did not materially change attacker cost or difficulty.

Turnstile alone does not provide full-session detection for credential stuffing, account takeover, card testing, or transaction fraud.

Turnstile also does not include native modules for multi-accounting, synthetic identities, incentive abuse, clickfarms, and paid solving services.

Cloudflare lists standalone Turnstile as unsupported in mainland China. When required verification fails, legitimate users cannot complete protected logins, registrations, or checkouts.

Residential proxy abuse further reduces the value of IP reputation. Attackers can rotate clean residential IP addresses at a low cost.

What Are the Risks of Turnstile?

No public Turnstile-specific SLA

Cloudflare does not publish a Turnstile-specific SLA on its plan page. Enterprise buyers must confirm agreement terms during procurement.

Independent outage history

Downflare's Turnstile component history records 11 incidents and 6,074 minutes of reported downtime from August 13, 2025, through August 13, 2026.

Downflare reports duration based on Cloudflare's status data and notes that status pages can miss localized incidents.

Mainland China availability

Cloudflare's China Network documentation lists standalone Turnstile as unsupported in mainland China and warns of issues for mainland visitors to both China Network and global zones. Auth0's June 2026 support guidance also identifies its Turnstile-powered Auth Challenge as unavailable there.

A developer reported Turnstile verification loops and network failures in China in an August 2026 Logto issue requesting alternative CAPTCHA providers. When required verification cannot produce a valid token, legitimate users cannot complete login, registration, or checkout.

For services replacing Turnstile to reach users in China, hCaptcha Enterprise offers regional endpoints and First-Party Hosting. These delivery options support low-latency verification across China and the rest of the world. Test widget loading, challenge completion, and server-side verification from mainland networks during migration.

Cloudflare service dependencies

On November 18, 2025, a Bot Management configuration file caused a major Cloudflare outage and prevented Turnstile from loading.

Cloudflare uses Turnstile on its dashboard login, so users without active sessions could not log in during the outage.

Cloudflare reported two dashboard impact events. The first continued for 100 minutes, and the second continued for 50 minutes.

A second Cloudflare network outage occurred on December 5, 2025. It affected 28% of hosted applications for approximately 25 minutes.

Cloudflare then started its Code Orange: Fail Small program. Cloudflare stated that circular dependencies made its incident response slower.

How hCaptcha stayed up during the Cloudflare outage

How Does hCaptcha Differ From Turnstile?

1. Detection that scales with the threat

Turnstile uses direct browser and network detection; Enterprise adds device correlation through Ephemeral IDs.

hCaptcha uses behavioral machine learning and Private Learning, and can increase challenge difficulty when confidence is low.

A fallback challenge makes the attacker complete a task that is difficult to automate. Proof of work cannot provide the same test.

2. Integrated session and fraud protection

Cloudflare separates continuous session signals into Precursor and Enterprise Bot Management. Turnstile remains the checkpoint component.

hCaptcha Enterprise includes session risk, bot defense, and fraud protection in one platform. It does not require a separate product.

3. Independent infrastructure

Turnstile works without Cloudflare CDN, but the service still depends on Cloudflare's Challenge Platform and related control systems.

hCaptcha is separate from Cloudflare, Google, and any CDN provider. It works on any supported infrastructure and in every country.

4. Privacy and compliance controls

hCaptcha provides privacy controls for regulated workloads:

• Data minimization: hCaptcha supports pre-blinded data and IP blinding.
• First-Party Hosting: Customers can serve verification from their own subdomain.
• Certifications: SOC 2 Type II, ISO 27001, ISO 27701, PCI DSS 4.0 L1, and EU-US Data Privacy Framework.

hCaptcha supports Zero PII deployments for sensitive workloads. Turnstile does not publish a similar pre-blinded processing mode.

5. Protection beyond the widget

hCaptcha Enterprise covers account takeover, fraud protection, credential stuffing, card testing, multi-accounting, and synthetic identities.

It also covers transaction fraud, Safer MFA, incentive abuse, and paid solver activity. Turnstile does not include these native fraud modules.

Why Do Larger Services Use hCaptcha Enterprise?

Risk scores

hCaptcha Enterprise returns a numeric risk score for each session. Customers can set rules and actions for different risk levels.

Turnstile returns a success token. Enterprise can also return an Ephemeral ID, but it does not return a similar session risk score.

Custom threat models

Private Learning trains a customer-specific machine learning model on pre-blinded traffic. The model learns the customer's normal traffic and specific attacks.

Clickfarm and solver detection

Paid solver traffic can come from real people, so a checkpoint may receive valid human interaction during coordinated abuse. Advanced Threat Signatures group solver activity across devices and IP addresses, exposing coordination that checkpoint detection can miss.

APT detection and mitigation

Advanced Persistent Threats can rotate IP addresses and keep request rates low. Advanced Threat Signatures group related activity across devices and sessions.

Zero PII

hCaptcha supports GDPR, CCPA, HIPAA, PCI, LGPD, and PIPL requirements through pre-blinded data and IP blinding.

hCaptcha can detect fraud without direct access to user PII.

Explore hCaptcha Enterprise

Choosing Between Cloudflare Turnstile and hCaptcha

Choose hCaptcha for integrated protection

hCaptcha Enterprise combines bot and AI-agent detection, account defense, transaction fraud protection, and configurable responses across websites, apps, and APIs. User Journeys connects risk across sessions and devices. Zero PII deployment options and CDN independence give teams control over data and infrastructure.

Use hCaptcha Pro for low-friction forms and logins

hCaptcha Pro provides adaptive bot protection for forms, logins, and registrations. Its 99.9% Passive mode selectively challenges traffic while aiming to show visual challenges to fewer than 0.1% of real users. Pro also supports Invisible mode, custom themes, and shared account management for growing teams.

Use hCaptcha Enterprise for high-risk services

Payments, e-commerce, gaming, financial services, and regulated services need session risk, fraud protection, and strong compliance controls.

hCaptcha Enterprise includes these capabilities under a published SLA. Start an Enterprise pilot.

Switch from reCAPTCHA or Turnstile

hCaptcha is API-compatible with reCAPTCHA v2. The standard reCAPTCHA change uses two lines of code and works on any platform.

Review the migration guide.

See pricing

Still evaluating a replacement? Compare reCAPTCHA alternatives on privacy, verification experience, protection scope, and cost.

Why Doesn't "Direct Detection" of Bots Work Reliably?

Direct detection checks browser and network signals against expected human traffic. Attackers can copy or hide many of these signals.

Browsers also remove or restrict browser fingerprinting signals, leaving detection systems with less data.

Anti-detect browsers imitate common browser profiles. Residential proxies give each session a clean IP address.

TLS fingerprints and HTTP/2 behavior can stop simple scrapers. They are weaker against real browsers, slow attacks, and distributed proxy traffic.

Modern AI agents can operate inside real browsers and follow normal execution paths. This reduces the difference between human and automated traffic and makes browser fingerprinting alone less reliable.

Humanity verification tests what browser signals cannot. Private Learning and behavioral analysis review intent rather than only browser properties.

Why Doesn't "Proof of Work" Stop Many Attacks?

Proof of work makes a browser solve a computational task. The task consumes CPU time and energy.

Credential stuffing attacks often use compromised devices, rented botnets, or low-cost cloud infrastructure. The attacker does not own the affected device.

The device owner or cloud provider covers the energy cost. The attacker has little or no marginal cost.

Proof of work adds overhead but does not materially change attack difficulty. It also does not stop paid human solvers or clickfarms.

Frequently Asked Questions

What's the difference between Cloudflare Turnstile and hCaptcha?

Turnstile checks browser and network signals at a specific checkpoint. hCaptcha brings together checkpoint verification, session risk, fraud protection, and account defense.

Is hCaptcha better than Turnstile?

hCaptcha Enterprise is the recommended platform for bot and AI-agent defense, account takeover prevention, and transaction fraud protection. It combines risk across sessions with configurable responses and Zero PII deployment options, independently of the CDN.

What does Turnstile Enterprise add?

Turnstile Enterprise adds unlimited widgets, more hostnames, 30-day analytics, custom branding, and Ephemeral IDs. Pricing requires contact with Cloudflare sales.

How effective is Cloudflare Turnstile?

Turnstile can filter simple automated traffic with low user friction. It is weaker against anti-detect browsers, residential proxies, paid solvers, and session-level fraud.

What is the difference between Cloudflare WAF and Turnstile?

A WAF filters network-edge traffic using rules and reputation data. Turnstile protects specific client-side checkpoints. They operate at different layers, so many deployments use both.

Does Turnstile work without Cloudflare?

Turnstile works without the Cloudflare CDN. Some features, such as WAF pre-clearance, require a domain in a Cloudflare account.

Does Cloudflare Turnstile work in China?

Cloudflare lists standalone Turnstile as unsupported in mainland China. Its October 28, 2026 update provides locally hosted widgets for Challenge Pages on China Network zones. That update is scoped to China Network Challenge Pages.

Why switch from Turnstile to hCaptcha for users in China?

A required verification step that fails can prevent legitimate users in China from signing in or submitting forms. hCaptcha Enterprise offers regional endpoints and First-Party Hosting for low-latency access across China and the rest of the world. Validate the complete verification flow from mainland networks before rollout.

Can I switch from Turnstile to hCaptcha?

Replace the widget script, widget tag, sitekey, and server verification endpoint. See the hCaptcha migration guide.