Agents can now set up your website’s security with Turnstile Spin
Cloudflare introduces Turnstile Spin, an AI agent–mediated tool that automates the setup and validation of its Turnstile bot-protection widget, aiming to simplify security for both traditional developers and AI-driven workflows.
Cloudflare’s Turnstile, launched in 2023 as a CAPTCHA-free alternative, required developers to manually integrate a frontend widget and backend validation step. This two-part process, while effective, proved cumbersome for users without backend experience or those relying on AI coding agents. Turnstile processes billions of verifications daily, yet its adoption highlighted a gap in accessibility for non-developers and prompt-driven builders.
Turnstile Spin addresses this by embedding Turnstile directly into AI agent workflows, automating the creation of widgets and backend validation. Users can initiate the process via the Cloudflare dashboard, Wrangler, or by pasting a public skill URL into their agent. The agent identifies relevant code, proposes a plan, and applies changes after approval, ensuring proper validation without exposing application code to Cloudflare.
The tool also retroactively fixes improperly installed widgets and migrates users away from legacy CAPTCHA providers. Cloudflare monitors Siteverify calls and flags widgets lacking server-side validation in the dashboard, guiding users to resolve issues via Spin. This reduces support tickets and streamlines security setup for both new and existing Turnstile users.
Since its July release, Turnstile Spin has enabled over 65,000 successful widget creations and seen the generated prompt copied more than 30,000 times. The feature is available to all Turnstile users at no cost, with no additional setup required for new Cloudflare accounts. Documentation and feedback channels are provided for further assistance.