Cloudflare can spot Turnstile widgets with no backend check
Serguey Asael Shinder2 min readCloudflare launched Turnstile Spin on 25 September: a way to have an AI agent carry out the whole Turnstile installation instead of doing it by hand. The manual flow has always had two halves - render the widget in the frontend so Cloudflare can run the client-side challenge and issue a token, then POST that token to the Siteverify API from the backend and act on the verdict. Spin does both, migrates sites off other CAPTCHA providers, and can be started from the dashboard, from Wrangler, or by pasting a public skill URL into an agent. Cloudflare puts current volume at roughly three billion verifications on a typical weekday, with more than 23,000 accounts creating a new widget in a single recent week.
Buried in the announcement is a more interesting capability than the automation itself. Open the Turnstile page in an account and, in Cloudflare's own words, if a widget has served traffic without backend validation you will see a "Fix with Spin" action.
What it means
That button is a statement about the installed base. It can only be offered if Cloudflare can observe a widget issuing tokens while no corresponding Siteverify calls arrive - meaning the visible half of the defence is running and the half that actually decides anything was never wired up. A site in that state looks protected to its owner and to its visitors, shows the challenge, and gates nothing. It is the security equivalent of a lock with no bolt, and Cloudflare evidently sees enough of them to build a remediation flow and put it on the page by default.
The second-order point is about where the failure comes from, and the post is candid about it: Turnstile's two-step shape was designed for a world where somebody wrote the frontend and the backend by hand, and prompt-driven building does not reliably produce the second step. That is a general pattern worth naming beyond this product. When a control is split across two systems and only one of them is visible, whatever generates the code will tend to produce the visible half and stop, because the result looks correct. The useful lesson is not "use an agent to install it" but "check for the invisible half explicitly" - which, for anyone running Turnstile today, means opening that page and looking for the button rather than trusting that the widget on the login form is doing work.