Addressing Incomplete Setup and Bot Exposure

Cloudflare originally declared itself free from CAPTCHAs with the launch of Turnstile, its privacy-first client-side challenge. Turnstile is designed to work on any site without forcing visitors to solve puzzles, processing about three billion verifications on a typical weekday.

However, misconfiguring Turnstile by skipping backend validation leaves sites exposed to automated abuse. Because Turnstile requires a two-step implementation involving both frontend rendering and backend Siteverify API calls, incomplete setups frequently occur among users who do not write backend code daily.

Introduction of Turnstile Spin

To fix incomplete setups and streamline security workflows, Cloudflare is launching Turnstile Spin. This agent-mediated implementation uses a preferred AI coding agent to wire up server-side verification automatically.

The tool can create widgets, embed them on sites, and integrate Siteverify into relevant backend functions just like a manual setup. Furthermore, Spin fixes improperly installed widgets and handles migrations from other CAPTCHA providers.

Adapting to the Era of AI Coding Agents

The shift toward prompt-driven building means that more creators are spinning up functional sites quickly, but traditional security workflows do not always align with AI development. Turnstile Spin bridges this gap by offering native support for AI agent workflows.

Users can check their setup by visiting the Cloudflare dashboard. If a widget has served traffic without backend validation, a "Fix with Spin" action will appear.

How Turnstile Spin Operates in Codebases

Turnstile Spin turns a two-part setup into a guided workflow. After choosing a protected area, the coding agent finds the relevant frontend and backend code, proposes a plan, and waits for approval before completing both sides of the integration.

Crucially, Spin does not send application code to Cloudflare or request remote changes. Instead, the user's existing coding agent makes the approved changes directly inside the codebase.

Contexts and Integration Methods

Spin adapts to three distinct contexts found within a codebase: situations with no CAPTCHA in place, widgets missing server-side validation that feature a dashboard banner, and existing CAPTCHA migrations that require a substitution plan.

Users can initiate Spin from the Cloudflare dashboard, Cloudflare Wrangler, or directly through an agent via a public skill URL.

Early Adoption and Documentation

Since reaching the dashboard, the tool has recorded substantial activity, with tens of thousands of successful Spin widget creations and prompt copies. Developers can consult the official documentation for further implementation details.

Sources

• Cloudflare BlogAgents can now set up your website’s security with Turnstile Spin