Agents can now set up your website’s security with Turnstile Spin
Source
blog.cloudflare.com
Author
Jules Lemee
Date
Context
Cloudflare's Turnstile Spin addresses an incomplete bot-protection setup: a site can display a challenge widget while omitting the server-side check that validates its result. Spin guides a coding AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → through both parts of the integration, including adding the Siteverify call to the application's backend.
The agent finds the relevant code, proposes a plan and makes changes after approval. Cloudflare also describes a recovery flow for widgets receiving traffic without backend validation. The useful change is connecting the visible challenge to the application logic that decides whether a request may proceed.
Key takeaways · AI-distilled
Turnstile setup has two halves: render the widget on the frontend to obtain a tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition →, then POST that token to the Siteverify API from the backend. Spin hands both halves to a coding agent, which proposes a plan and waits for approval before editing.
Cloudflare says Spin never sends application code to Cloudflare. The developer's own agent, such as Claude Code, Cursor or Codex, makes the approved edits locally; the only new Cloudflare resource is the widget, and validation stays in the app's backend.
Cloudflare monitors Siteverify calls per widget. A widget serving traffic with no server-side validation gets a "Fix with Spin" action, and the agent adds the missing backend check with the same secret while the widget keeps serving.
Spin also handles migration from other CAPTCHA providers: the agent detects existing markers, proposes a substitution plan and applies it after approval. It can be started from the dashboard, from Wrangler, or by pasting a public agent skillA reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.Full definition → URL into an agent.
Cloudflare reports more than 65,000 successful Spin widget creations and over 30,000 copies of its generated prompt since the July release. Turnstile overall processes about three billion verifications on a typical weekday, per the post.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
agent skill — A reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.
