Cloudflare Turnstile Pricing 2026 — Is Turnstile Really Free?

Cloudflare Turnstile pricing tiers (2026)

Plan	Cost	Included	What's excluded
Standard	Free	Unlimited sitekeys, unlimited requests, managed / non-interactive / invisible modes.	Analytics beyond 24 h, SLA, custom bot-score rules, dedicated support.
Enterprise	Contact sales — bundled with a Cloudflare Enterprise contract.	Higher accuracy modes, extended analytics, SLA, integration with Cloudflare Bot Management.	Standalone purchase — requires committing to Cloudflare's WAF/Enterprise stack.

Based on Cloudflare's published Turnstile pricing (2026). Enterprise pricing is quoted per contract.

If Cloudflare Turnstile is free, why switch?

Free is not the same as low-cost. When teams migrate away from Turnstile it's usually one of five reasons, all of which cost money in ways that don't show up on the invoice:

Bot pass-through rate. Turnstile's managed challenge is tuned for minimum user friction — the trade-off is that it lets more automated traffic through than reCAPTCHA v2, hCaptcha, or Procaptcha in independent testing. Spam-driven inbound leads and abusive signups are the visible symptom.
Vendor lock-in. Turnstile's telemetry and bot-score signals feed back into the Cloudflare edge, and the strongest anti-bot modes require a Cloudflare Enterprise WAF contract. If you're not already on Cloudflare, the "free" Turnstile is the cheap end of a much bigger enterprise commitment.
Privacy posture. Cloudflare's own privacy addendum confirms that Turnstile processes IP, headers, and behavioural telemetry in the US. That's better than reCAPTCHA, but many EU-facing teams still want a captcha where no third-party US processor sees the request at all.
Limited customisation. Turnstile doesn't expose per-endpoint policies, custom risk thresholds, or per-sitekey allow/deny lists on the free plan.
Support. Turnstile's free plan has no SLA and no dedicated support channel. When an incident hits production, community forum posts are the escalation path.

Cloudflare Turnstile pricing vs Prosopo

Prosopo's pricing starts free at 10,000 verifications/month, then $39/month at 100k and $139/month at 1M requests. The tier above free costs less than the average revenue lost to a single day of Turnstile letting bot signups through, and buys you GDPR-compliant cookieless verification, per-endpoint policies, an SLA, and a spam filter Turnstile doesn't ship. Turnstile's price tag is $0; the total cost of running it in production — leaked signups, missed abuse, Cloudflare lock-in — is not.

See the full Cloudflare Turnstile alternatives comparison for the head-to-head against ALTCHA, hCaptcha, and Friendly Captcha.

FAQs about Cloudflare Turnstile pricing

Is Cloudflare Turnstile free forever?

The Standard plan is currently free with no request cap. Cloudflare has not published a change to this model for 2026. Enterprise features remain paid as part of a Cloudflare Enterprise contract.

Is there a Cloudflare Turnstile pricing free tier limit?

No published request limit. In practice the Turnstile free plan is limited by feature (no extended analytics, no SLA, no custom bot-score policies) rather than by volume.

Does Cloudflare Turnstile require a Cloudflare account?

Yes. Turnstile sitekeys are provisioned inside a Cloudflare account and the dashboard is the only management surface. Sites not otherwise on Cloudflare take on a new vendor relationship to use it.

Cloudflare Turnstile pricing vs reCAPTCHA and hCaptcha

Turnstile undercuts both on sticker price — and misses both on catch rate and control. reCAPTCHA is free up to 10k assessments/month then paid (see the reCAPTCHA pricing calculator). hCaptcha Pro starts at $139/month (see the hCaptcha pricing calculator). Prosopo starts at the same $0 as Turnstile and is the only one of the four with no third-party tracking cookies, no US-only data processing, and a spam filter shipped in the box.