Agents can now set up your website’s security with Turnstile Spin
- ID
- 28509
- Status
- summarized
- Published
- 25 Sep 2026, 9:00 PM
- Fetched
- 25 Sep 2026, 9:53 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/turnstile-spin/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 6.5
- Created
- 25 Sep 2026, 9:53 PM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
Cloudflare launched Turnstile Spin, an agent-mediated way to implement its CAPTCHA-free Turnstile challenge end to end: the agent creates the widget, embeds it on the frontend, and wires the Siteverify call into backend functions, plus repairs misconfigured widgets and migrates sites off other CAPTCHA providers. Normally Turnstile is a two-step manual job (render the widget, POST the token to Siteverify), and Cloudflare says it now handles roughly 3 billion verifications on a typical weekday, with more than 23,000 accounts creating a new widget in one recent week. Spin can be started from the Cloudflare dashboard, from Wrangler, or by pasting a public skill URL into an agent.
Why it matters
If you ship sites with a coding agent and skip bot protection because the backend Siteverify step is fiddly, this removes that step - and it also fixes already-broken widget installs and migrates away from reCAPTCHA/hCaptcha. The decision to make deliberately: pasting a public skill URL lets an agent modify backend code and security config on your behalf, so decide whether that happens on a branch with review or directly against production before you point an agent at it.
Discussion angle
The 'paste a public skill URL into your agent' install pattern is the interesting part - would you let an agent write Siteverify calls into your backend unreviewed, and how do you verify a vendor's skill URL actually does what it claims?