Cloudflare Turnstile Alternatives 2026: 4 Options Compared

What is the best Cloudflare Turnstile alternative?

It depends on why you want to leave Turnstile. If the reason is data protection, choose a CAPTCHA from an EU company that processes data in the EU and sets no cookies: TrustCaptcha does this on every plan, Friendly Captcha from its Advanced plan. If you mainly want a risk score and already run on Google Cloud, reCAPTCHA fits. If price is all that matters, Turnstile’s free plan is hard to undercut, and you may not need an alternative at all.

The table compares Turnstile with the four options most teams shortlist.

reCAPTCHA and hCaptcha prices in USD, Friendly Captcha and TrustCaptcha prices in EUR per month. TrustCaptcha prices exclude VAT.

What Cloudflare Turnstile does well

Turnstile is Cloudflare’s replacement for puzzle CAPTCHAs, and it is a good one. Visitors never get images or text to decipher. In the background it runs small JavaScript checks, among them proof-of-work, proof-of-space and probes of browser APIs, and decides from the results whether a visitor looks human.

You can choose between three modes. Managed mode decides per visitor whether a check without interaction is enough or whether to show a checkbox. Non-interactive mode never asks the visitor to do anything, and invisible mode does not show a widget at all.

Two common assumptions about Turnstile are wrong. You do not need to route your site through Cloudflare: Turnstile works on any website and needs no other Cloudflare service. And accessibility is not a weak spot, since Cloudflare states that Turnstile meets WCAG 2.2 AA.

Why teams look for a Turnstile alternative

Most teams that move away from Turnstile do it for one of four reasons:

• Data protection. Cloudflare is a US company, transfers to it need a legal review, and it uses the signals to improve Turnstile as a controller in its own right.
• The cookie notice. Cloudflare does not document clearly which cookies, if any, the widget sets on your pages.
• Control. In managed mode Cloudflare decides who sees the checkbox, and you cannot see why a given visitor got one.
• Plan limits. The free plan stops at 20 widgets and 10 hostnames per widget, keeps analytics for 7 days, and only Enterprise removes the Cloudflare branding.

None of these makes Turnstile a bad product. They make it a product from a US vendor with fixed free-plan limits, and for some teams that is the deciding factor.

Cloudflare Turnstile pricing

Turnstile has two plans. The free plan has no limit on challenges, which is unusual: reCAPTCHA stops being free after 10,000 assessments a month. The limits are on setup instead.

• Free: unlimited challenges, up to 20 widgets, 10 hostnames per widget and 7 days of analytics.
• Enterprise, priced on request: unlimited widgets, up to 200 hostnames per widget, widgets that work on any hostname, ephemeral IDs, 30 days of analytics and the option to remove the Cloudflare branding.

For a single company website or shop, the free plan is usually enough. Agencies that look after many client sites reach the widget and hostname limits sooner.

Is Cloudflare Turnstile GDPR compliant?

That depends on your setup, and Cloudflare leaves the open points with you. Cloudflare, Inc. is based in San Francisco and transfers data from the EU to the US under the EU-U.S. Data Privacy Framework.

The Turnstile privacy addendum lists the signals: the visitor’s IP address, TLS fingerprint, user agent, and the sitekey with its origin. Cloudflare processes them as your processor to protect your site. It also uses them to improve Turnstile, and for that purpose it is a controller, not your processor. Cloudflare describes the signals as strictly necessary and says Turnstile never harvests data for ad retargeting.

If you use Turnstile, your privacy policy has to name it. Under Art. 13 GDPR that means who processes the data, for what purpose, on which legal basis, whether data goes to countries outside the EU and how long it is stored. We deliberately give no template, because the wording depends on your setup. This section is not legal advice; clear the wording, and the question of consent, with your data protection officer.

If you would rather not depend on the Data Privacy Framework, an EU-hosted CAPTCHA removes the transfer question altogether. That is the idea behind a GDPR-compliant CAPTCHA.

The alternatives in detail

TrustCaptcha: invisible CAPTCHA from the EU

TrustCaptcha is an invisible CAPTCHA made by Trustcaptcha GmbH in Munich. It checks visitors with proof-of-work and bot scoring: the browser solves a small computation, and the difficulty rises with the risk of the request, so a suspicious bot pays more than a regular visitor. There is no puzzle and no checkbox. TrustCaptcha sets no cookies, processes data in EU data centers and includes a Data Processing Agreement for every customer.

It suits EU companies that want the transfer and cookie questions answered by design. Plans start at €8 a month for 1,000 verifications; bot detection and risk scoring come with the Solo plan at €36 a month. Non-commercial websites can use it for free with 500 verifications a month. What to watch for: unlike Turnstile, there is no free plan for commercial sites, only the 14-day trial.

Friendly Captcha

Friendly Captcha GmbH is based in Wörthsee, Germany, and is the closest peer to TrustCaptcha. It also uses proof-of-work, sets no cookies and hashes IP addresses. Friendly Captcha says it is certified to WCAG 2.2 AA by TÜV.

Plans start at €9 a month for one domain and 1,000 requests, and there is a free plan for non-commercial sites with low traffic. What to watch for: by default requests go to a global endpoint that may be served from outside the EU. The EU-only endpoint, hosted in Germany, requires the Advanced plan (€200 a month) or Enterprise. We compare the two in detail in TrustCaptcha vs Friendly Captcha.

Google reCAPTCHA

reCAPTCHA is now part of Google Cloud Fraud Defense. Since 2 April 2026 Google acts as a data processor under its Cloud Data Processing Addendum, and website operators are the sole controllers; Google says the product is GDPR compliant on that basis. A necessary cookie (_GRECAPTCHA) remains, and because reCAPTCHA data goes to Google, international transfers still need a legal review.

The first 10,000 assessments a month are free per organization. Between 10,001 and 100,000 there is a flat $8 a month, above that $1 per 1,000 assessments. v2 shows a checkbox and, when it is unsure, image grids; v3 returns a score from 0.0 to 1.0 and never shows a challenge. It suits teams already on Google Cloud. For everyone else, our overview of reCAPTCHA alternatives goes further.

hCaptcha

hCaptcha is run by Intuition Machines, Inc., a US company. On the free Basic plan visitors get image challenges. The 99.9% passive mode starts with Pro at $99 a month billed yearly ($139 billed monthly), which includes 100,000 evaluations and then costs $0.99 per 1,000. Enterprise adds a fully passive mode and risk scores.

hCaptcha says it processes most data on regional servers and stores analytics data in the EU, but data may be processed in any country where it has facilities, including the US, under the Data Privacy Framework and standard contractual clauses. Its cookies are labeled strictly necessary. It suits teams that accept a visible challenge on the free plan or pay for Pro. More options are in hCaptcha alternatives.

Switching from Turnstile

Switching takes three steps on most sites. Remove the Turnstile script, the widget container and the code that reads the Turnstile token. Add the TrustCaptcha widget to the form with your sitekey. Then replace the server-side check with TrustCaptcha’s validation call. The Turnstile migration guide in the TrustCaptcha docs walks through each step with code.

Test it on one form first, such as the contact form, and compare the submissions you get before and after.

Try TrustCaptcha

Every TrustCaptcha plan starts with a 14-day free trial. Start your free trial and run it next to Turnstile on one form to see how it handles your own traffic.