Cloudflare Turnstile Pricing 2026 — Is Turnstile Really Free?

Cloudflare Turnstile pricing tiers (2026)

Based on Cloudflare's published Turnstile pricing (2026). Enterprise pricing is quoted per contract.

If Cloudflare Turnstile is free, why move off it?

Sticker price is not the same as total cost of ownership. When teams migrate away from Turnstile it's usually one of five reasons, none of which shows up on the invoice:

1. Bot pass-through rate. Turnstile's managed challenge is tuned for minimum user friction — the trade-off is that it lets more automated traffic through than reCAPTCHA v2, hCaptcha, or Prosopo in independent testing. Spam-driven inbound leads and abusive signups are the visible symptom.
2. Vendor lock-in. Turnstile's telemetry and bot-score signals feed back into the Cloudflare edge, and the strongest anti-bot modes require a Cloudflare Enterprise WAF contract. If you're not already on Cloudflare, the free Turnstile SKU is the entry point to a much bigger enterprise commitment.
3. Privacy posture. Cloudflare's own privacy addendum confirms that Turnstile processes IP, headers, and behavioural telemetry in the US. That's better than reCAPTCHA, but many EU-facing teams still want a captcha where no third-party US processor sees the request at all.
4. Limited customisation. Turnstile doesn't expose per-endpoint policies, custom risk thresholds, or per-sitekey allow/deny lists on the free plan.
5. No operator visibility. Turnstile returns a pass/fail token. Operators can't inspect why a specific verdict landed the way it did — the verdict is the whole answer.

Cloudflare Turnstile vs Prosopo

Prosopo is a specialist bot and agent trust platform. Where Turnstile returns a pass/fail token from a model the operator cannot inspect, Prosopo returns a verdict that traces to a rule the operator wrote, on a proprietary detector with a decision-machine architecture that ships new detection to production in days rather than SDK release cycles. Prosopo pricing starts free at 10,000 verifications/month, then $39/month at 100k and $139/month at 1M requests. Every paid plan ships per-endpoint access control, risk scoring, an SLA and a spam filter — the features Turnstile reserves for a Cloudflare Enterprise WAF contract. Open-source client stack. UK-incorporated. EU-processed. GDPR-native.

See the full Cloudflare Turnstile alternatives comparison for the head-to-head against ALTCHA, hCaptcha, and Friendly Captcha.

FAQs about Cloudflare Turnstile pricing

Is Cloudflare Turnstile free forever?

The Standard plan is currently free with no request cap. Cloudflare has not published a change to this model for 2026. Enterprise features remain paid as part of a Cloudflare Enterprise contract.

Is there a Cloudflare Turnstile pricing free tier limit?

No published request limit. In practice the Turnstile free plan is limited by feature (no extended analytics, no SLA, no custom risk thresholds, no per-endpoint bot policies) rather than by volume. Prosopo caps its free tier at 10,000 verifications/month but ships the per-endpoint access control, risk scoring and spam filter that Turnstile reserves for a Cloudflare Enterprise WAF contract. For a low-risk contact form Turnstile's uncapped free tier is enough. For anything higher-value the feature ceiling usually bites before the volume cap would.

Cloudflare Turnstile free plan 2026: what's included?

The 2026 Cloudflare Turnstile free plan gives you unlimited sitekeys, unlimited managed, non-interactive and invisible challenges, and up to 24 hours of analytics retention. It does not include an SLA, dedicated support, custom risk thresholds, per-endpoint policies or the extended bot-score signals that feed Cloudflare Bot Management. Those sit on the Enterprise tier, bundled into a Cloudflare Enterprise contract rather than sold as a standalone Turnstile SKU. Prosopo's free tier ships the per-endpoint policies, risk scoring and spam filter that Turnstile reserves for Enterprise. Prosopo caps at 10,000 verifications/month rather than being uncapped, but every feature is available from the free tier upwards.

Any Cloudflare Turnstile updates for 2026?

Cloudflare has kept the Standard-plan pricing model unchanged into 2026: unlimited sitekeys, unlimited requests, free of charge. The main 2026 updates have been on the detection side, with tighter fingerprinting on managed challenges, tighter integration with Cloudflare's bot-score feed, and Enterprise-only signals for header entropy and TLS fingerprinting (JA3/JA4). These close the gap against unsophisticated bots but do not change Turnstile's core architectural bet: passive checks only, no escalation to a challenge that raises the per-solve cost. Modern stealth headless browsers (`puppeteer-extra-stealth`, `playwright-stealth`, `undetected-chromedriver`) are updated at the same pace to pass exactly these tightened checks, and commercial captcha farms still solve Turnstile tokens at roughly $1 to $2 per 1,000. If your threat model includes farm-backed abuse, no amount of passive-check tightening closes that gap. Prosopo's proof-of-work challenge does.

Does Cloudflare Turnstile require a Cloudflare account?

Yes. Turnstile sitekeys are provisioned inside a Cloudflare account and the dashboard is the only management surface. Sites not otherwise on Cloudflare take on a new vendor relationship to use it.

Cloudflare Turnstile vs reCAPTCHA, hCaptcha and Prosopo as a captcha vendor

Turnstile ships a passive-check widget only, with per-endpoint policies and extended bot-score signals held on the Cloudflare Enterprise WAF contract. reCAPTCHA is free up to 10k assessments/month then paid (see the reCAPTCHA pricing calculator). hCaptcha Pro is $139/month (see the hCaptcha pricing calculator). Prosopo is the specialist option in this set: one platform delivered as either a drop-in widget or invisible enforcement at the edge, with every verdict traceable to an inspectable rule the operator authors, on a proprietary detector that reaches production in days rather than SDK release cycles. UK-incorporated, EU-processed, GDPR-native. Open-source client stack.