---
title: "Agents can now set up your website’s security with Turnstile Spin"
description: "Cloudflare launched Turnstile Spin, an agent-mediated implementation of its Turnstile CAPTCHA alternative that AI coding agents use to set up security on any website. The two-step Turnstile flow requires a frontend widget and a backend Siteverify call, but many sites skip the backend validation, leaving them exposed to bots. Spin uses the user’s AI coding agent to find frontend and backend code, propose a plan, and after approval automatically embed the widget and wire up the Siteverify call without sending code to Cloudflare. It also fixes improperly installed widgets detected by monitoring Siteverify calls and handles migrations from other CAPTCHA providers. Since its July release over 65,000 widgets have been created via Spin and the generated prompt has been copied more than 30,000 times, and the service remains free."
---

# Agents can now set up your website’s security with Turnstile Spin

[Cloudflare](https://yomu.fyi/company/cloudflare) · Jules Lemee · Sep 25, 2026

**Type:** Announcement

## Summary

Cloudflare launched Turnstile Spin, an agent-mediated implementation of its Turnstile CAPTCHA alternative that AI coding agents use to set up security on any website. The two-step Turnstile flow requires a frontend widget and a backend Siteverify call, but many sites skip the backend validation, leaving them exposed to bots. Spin uses the user’s AI coding agent to find frontend and backend code, propose a plan, and after approval automatically embed the widget and wire up the Siteverify call without sending code to Cloudflare. It also fixes improperly installed widgets detected by monitoring Siteverify calls and handles migrations from other CAPTCHA providers. Since its July release over 65,000 widgets have been created via Spin and the generated prompt has been copied more than 30,000 times, and the service remains free.

## Context

Turnstile is Cloudflare’s privacy-first CAPTCHA alternative that never asks visitors to solve puzzles. It requires a two-step setup: embedding a widget on the frontend and calling the Siteverify API from the backend. Many sites skip the backend validation, leaving them exposed to bots. With the rise of AI coding agents, Cloudflare launched Turnstile Spin to let agents complete the full integration automatically.

## Approach / What changed

Turnstile Spin allows users to deploy or fix Turnstile by instructing their AI coding agent (e.g., Claude Code, Cursor, Codex) to handle both frontend widget embedding and backend Siteverify integration. The agent proposes changes for user approval, then applies them locally. It detects missing backend validation as ‘widget recovery’, handles fresh installs, and migrates from other CAPTCHA providers. Users start from the dashboard, Wrangler CLI, or a skill URL.

## Takeaways

- Turnstile Spin integrates with AI coding agents like Claude Code, Cursor, and Codex to automate the full Turnstile two-step setup without sending application code to Cloudflare.
- It detects widgets without backend Siteverify validation and offers a ‘Fix with Spin’ action from the Cloudflare dashboard, adding the missing step while traffic continues.
- Since its July 2025 release, over 65,000 widgets have been created via Spin and the generated prompt has been copied over 30,000 times.

## FAQ

### How does Spin install Turnstile on my website?

Spin uses your AI coding agent to find the relevant frontend and backend code, propose a plan for embedding the widget and wiring up Siteverify, and after your approval applies the changes locally without sending code to Cloudflare.

### What happens if my widget is missing backend validation?

Cloudflare monitors Siteverify calls for each widget. A widget with no server-side validation gets a 'Fix with Spin' banner in your dashboard. The agent adds the missing step to your backend using the same secret while traffic continues.

### How do I start using Turnstile Spin?

You can start Spin from the Cloudflare dashboard, from the Wrangler CLI, or by pasting a public skill URL into your AI agent. Typically, you start from the dash and paste the skill into your agent, which uses Wrangler to facilitate the steps.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Security](https://yomu.fyi/topic/security), [Turnstile](https://yomu.fyi/topic/turnstile)

- Source: [Cloudflare](https://blog.cloudflare.com/turnstile-spin)
- Source URL: https://blog.cloudflare.com/turnstile-spin
- Ingested by Yomu: 2026-09-25T15:00:08.761Z

[Read original post](https://blog.cloudflare.com/turnstile-spin)