What happened
Cloudflare has launched Turnstile Spin, a way to set up Turnstile, its free alternative to CAPTCHA (the “click all the traffic lights” puzzles sites use to block bots), by handing the whole job to your coding agent instead of doing it yourself.
You can start Spin three ways: from the Cloudflare dashboard, from Wrangler (Cloudflare’s command-line tool for managing your account from a terminal), or by pasting Cloudflare’s public Turnstile Spin skill directly into an agent like Claude Code, Cursor, or Codex. A skill here is just a packaged set of instructions that tells the agent exactly how to do this one task, so you don’t have to write the setup prompt yourself.
Once started, the agent edits your codebase directly. Cloudflare says Spin “does not send your application code to Cloudflare or ask Cloudflare to change it remotely.” The changes happen on your machine, the same way any other agent edit would.
Why it matters
Turnstile has always required two separate pieces of work. First, your frontend (the part of your site that runs in a visitor’s browser) has to display the widget, which runs a quiet background check and hands back a token if the visitor looks legitimate. Second, your backend (the part running on your own server) has to send that token to Cloudflare’s Siteverify API, a specific web address Cloudflare’s servers check requests against. That second check is the only step that actually confirms whether the visitor passed.
That second step is easy to skip, and skipping it is not a small bug. If your backend never calls Siteverify, the widget still shows up and still looks like it’s working, but nothing is stopping a bot from submitting your form or login regardless of whether it passed the check. The widget becomes decoration.
Cloudflare built Spin’s “fix” mode around exactly this gap. It watches Siteverify traffic for every widget on your account, and if a widget has been serving traffic without a matching backend check, the Turnstile page in your dashboard shows a “Fix with Spin” action. Approve it, and the agent adds the missing backend call without touching the widget that’s already live.
Spin also handles migration: if it detects you’re running Google reCAPTCHA or a similar CAPTCHA, it proposes a plan to swap it for Turnstile and applies it once you approve.
Turnstile itself is not new. Cloudflare launched it in 2023 and says it now handles about three billion verification checks on a typical weekday, with more than 23,000 accounts creating a new widget in a single recent week. Spin is newer: Cloudflare says it has recorded more than 65,000 successful widget setups through Spin since its release in July, and developers have copied its generated setup prompt more than 30,000 times.
Who should care
This matters most if you’ve already added a Turnstile widget to a site, sign-up form, or login page and aren’t fully sure the backend half was wired up correctly, especially if a coding agent handled the original setup without you checking its work. It also matters if you’re about to add bot protection for the first time and would rather hand the two-step process to your agent than track down both halves in Cloudflare’s docs yourself.
It matters less if you’re not using Turnstile at all, or if you already have a verified working implementation with no plans to touch it.
What builders should do next
Open the Turnstile page in your Cloudflare dashboard and check whether any of your existing widgets show a “Fix with Spin” banner. That banner is Cloudflare telling you, based on real traffic, that a widget on your site has no backend validation behind it. Approve the fix if you see one.
If you’re setting up Turnstile for the first time, paste the Spin skill URL into your coding agent and let it walk through both the frontend widget and the backend Siteverify call together, rather than doing the two steps in separate sessions where one half is easy to forget.
Either way, don’t take “the widget is showing up” as proof your site is protected. The widget is the part a bot never sees checked. Confirm your backend is actually calling Siteverify and rejecting requests when it fails, since that’s the half doing the real work.
Turnstile itself is free, per Cloudflare, so there’s no cost tradeoff here to weigh against the setup time an agent saves you. The real decision is whether you trust an agent to touch backend request-handling code unsupervised. It’s worth a quick look at exactly which lines it changed before you approve, the same way you’d review any other agent-generated change to code that decides who gets in.
End of article