Agents can now set up your website’s security with Turnstile Spin

Cloudflare has introduced Turnstile Spin, an agent-mediated way to implement its Turnstile bot protection end to end. The company announced the launch alongside the product, which follows its 2023 debut of Turnstile, a privacy-first client-side challenge that is free to use, runs on any site without proxying traffic through Cloudflare, and never asks a visitor to solve a puzzle.

Turnstile normally takes two steps: render the widget in frontend code so Cloudflare can run client-side challenges and issue a token, then POST that token to the Siteverify API, which returns metadata on whether the visitor passed or failed. Developers can then act on the result, such as gating a login button. Spin automates that work with a coding agent. The agent finds the relevant frontend and backend code, proposes a plan, and waits for approval before completing both halves of the integration. Spin does not send application code to Cloudflare or ask Cloudflare to change it remotely; the agent the user already runs, such as Claude Code, Cursor, or Codex, makes approved changes inside the codebase. Validation stays in the backend, and the only new Cloudflare resource is the Turnstile widget.

Spin handles three situations. In a fresh install, with no CAPTCHA in place, the agent embeds the widget and wires Siteverify from scratch. In widget recovery, Cloudflare monitors Siteverify calls per widget, and any widget serving traffic without server-side validation gets a "Fix with Spin" banner in the dashboard; the agent adds the missing backend step using the same secret while the widget keeps serving. For migration, it detects existing CAPTCHA markers, proposes a substitution plan, and applies it after approval. Spin can be started from the Cloudflare dashboard, from Wrangler, or by pasting a public skill URL into an agent.

Cloudflare reported about three billion Turnstile verifications on a typical weekday and more than 23,000 accounts creating a new widget in one recent week. Since Spin reached the dashboard in July, it recorded over 65,000 successful widget creations, and developers copied the generated prompt more than 30,000 times.

Why it matters: developers without backend experience can now complete a correct Turnstile setup, while experienced engineers can avoid repetitive work and catch missing steps. Spin also gives teams a dashboard path to fix existing widgets that lack server-side validation and to migrate off other CAPTCHA providers.