CloudflareJules LemeeAnnouncement
Cloudflare launched Turnstile Spin, an agent-mediated implementation of its Turnstile CAPTCHA alternative that AI coding agents use to set up security on any website. The two-step Turnstile flow requires a frontend widget and a backend Siteverify call, but many sites skip the backend validation, leaving them exposed to bots. Spin uses the user’s AI coding agent to find frontend and backend code, propose a plan, and after approval automatically embed the widget and wire up the Siteverify call without sending code to Cloudflare. It also fixes improperly installed widgets detected by monitoring Siteverify calls and handles migrations from other CAPTCHA providers. Since its July release over 65,000 widgets have been created via Spin and the generated prompt has been copied more than 30,000 times, and the service remains free.
Turnstile is Cloudflare’s privacy-first CAPTCHA alternative that never asks visitors to solve puzzles. It requires a two-step setup: embedding a widget on the frontend and calling the Siteverify API from the backend. Many sites skip the backend validation, leaving them exposed to bots. With the rise of AI coding agents, Cloudflare launched Turnstile Spin to let agents complete the full integration automatically.
Turnstile Spin allows users to deploy or fix Turnstile by instructing their AI coding agent (e.g., Claude Code, Cursor, Codex) to handle both frontend widget embedding and backend Siteverify integration. The agent proposes changes for user approval, then applies them locally. It detects missing backend validation as ‘widget recovery’, handles fresh installs, and migrates from other CAPTCHA providers. Users start from the dashboard, Wrangler CLI, or a skill URL.
Turnstile Spin integrates with AI coding agents like Claude Code, Cursor, and Codex to automate the full Turnstile two-step setup without sending application code to Cloudflare.
It detects widgets without backend Siteverify validation and offers a ‘Fix with Spin’ action from the Cloudflare dashboard, adding the missing step while traffic continues.
Since its July 2025 release, over 65,000 widgets have been created via Spin and the generated prompt has been copied over 30,000 times.
Spin uses your AI coding agent to find the relevant frontend and backend code, propose a plan for embedding the widget and wiring up Siteverify, and after your approval applies the changes locally without sending code to Cloudflare.
Cloudflare monitors Siteverify calls for each widget. A widget with no server-side validation gets a 'Fix with Spin' banner in your dashboard. The agent adds the missing step to your backend using the same secret while traffic continues.
You can start Spin from the Cloudflare dashboard, from the Wrangler CLI, or by pasting a public skill URL into your AI agent. Typically, you start from the dash and paste the skill into your agent, which uses Wrangler to facilitate the steps.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
A five-step readiness checklist for teams whose sites are increasingly visited by AI agents: expose callable functions, verify bot traffic, measure real-user speed, and control crawler load.
Bot management is an architecture, not a rule list: classify traffic, score it with continuously retrained models, enforce with challenges or blocks, then feed the outcomes back into the model.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
