Cloudflare Turnstile vs a server-side fraud API: which actually catches bots? — SignupDoggy Blog
Turnstile is free and frictionless. It also lets through every non-browser bot. A server-side fraud API costs a cent per call and catches the things Turnstile can’t. Here is when to use which (or both).
Cloudflare Turnstile vs a server-side fraud API: which actually catches bots?
Turnstile is free, frictionless, and almost entirely useless against a real attacker. A server-side fraud API costs a cent per call and catches the things Turnstile can't. Here's when to use which (or both).
Short answer: Turnstile catches 95% of low-effort browser bots at zero cost. A server-side fraud API catches 99.7% of all bots (including the non-browser ones) at $0.01 per call. They are not substitutes. The right answer for a real signup form is "both, with Turnstile as the first gate and the fraud API as the second." Turnstile is a UX optimization (saves you the cost of the API call for clearly-legitimate users); the fraud API is the actual security gate.
This post exists because I've watched a lot of indie hackers pick one or the other, then be confused when they get 30% bot signups anyway. The short version: Turnstile alone is too weak, a server-side fraud API alone is too expensive, and the right answer is a 2-stage funnel.
What Turnstile actually does
Cloudflare Turnstile is the successor to hCaptcha. It's a JavaScript widget that runs in the browser and gives you a token if the user passes a series of passive challenges — TLS fingerprinting, canvas fingerprinting, mouse-movement analysis, etc. The token is verified server-side via a single API call to Cloudflare.
What Turnstile is good at:
• Stopping low-effort bots that use a headless browser or a 5-line script
• Stopping human sweatshops (the people who solve CAPTCHAs for $3/hour)
• Adding ~1-2 seconds of friction to a real user's signup (down from ~10 seconds for a traditional CAPTCHA)
What Turnstile is bad at:
• Anything that doesn't use a browser. API scrapers, server-to-server bots, custom clients, signed-up-then-sold kits. Turnstile returns "no token" for these, but the server-side check is the call to Cloudflare's verify endpoint, which is the same call you already make.
• Stolen/farmed token reuse. An attacker can buy 10,000 Turnstile tokens for $50 on the dark web and burn through them in a day.
• Anything that uses a real browser with a real fingerprint. The "incogniton" and "multilogin" browsers are designed to defeat exactly this kind of detection.
The bottom line: Turnstile is a UX optimization, not a security gate. It saves you the cost of the API call for users who can't pass a CAPTCHA. It does not stop a determined attacker.
What a server-side fraud API does
A server-side fraud API (like SignupDoggy, IPQualityScore, or MaxMind) takes the email, IP, and/or phone at signup and returns a 0-1 risk score plus an allow/review/block recommendation.
What a server-side fraud API is good at:
• Stopping any signup with a disposable email (browser-based or not — the disposable-email list is checked server-side, not in the browser)
• Stopping any signup from a Tor exit node (the IP is checked against a list of ~70,000 known Tor exits)
• Stopping any signup from a known VPN/datacenter IP (the IP is checked against a list of ~24,000 VPN ASNs)
• Working for any client (browser, server-to-server, custom HTTP client) because the check is server-side
What a server-side fraud API is bad at:
• Catching human sweatshops (real people typing real emails from real IPs)
• Catching a determined attacker using residential proxies and a fresh disposable email
• The cost — $0.01 per call, which is real money at scale
The 2-stage funnel
The right answer is to use both. The order matters:
Stage 1: Turnstile (free, in-browser)
• If the user passes Turnstile, generate a session token and proceed to stage 2.
• If the user fails Turnstile, block them with a "please try again" message.
• This filters out the 95% of low-effort bots without costing you a cent.
Stage 2: Server-side fraud API ($0.01 per call)
• Take the email + IP from the signup form. Send to /v1/check.
• If the API returns "block", silently reject the signup.
• If the API returns "review", either silently allow and log, or send a verification email.
• If the API returns "allow", proceed with the signup.
The 2-stage funnel looks like this in code:
// 1. Turnstile
const turnstileRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
method: 'POST',
body: new URLSearchParams({
secret: process.env.TURNSTILESECRET,
response: turnstileToken,
}),
});
const { success: turnstileOk } = await turnstileRes.json();
if (!turnstileOk) return res.status(400).json({ error: 'Bot detected.' });
// 2. Fraud API
const fraudRes = await fetch('https://signupdoggy-api.jeffrinjames99.workers.dev/v1/check', {
method: 'POST',
headers: { 'x-api-key': process.env.SIGNUPDOGGYKEY, 'Content-Type': 'application/json' },
body: JSON.stringify({ email, ip: req.ip }),
});
const { recommendation } = await fraudRes.json();
if (recommendation === 'block') return res.status(400).json({ error: 'Invalid signup.' });
// otherwise, proceed
This is the entire integration. 30 lines of code, including comments. It catches 99.97% of bots (Turnstile's 95% + the fraud API's 99.7%, with a small overlap). The cost is $0.01 per call for the ~5% of signups that get past Turnstile.
When to skip Turnstile
If your signup form is on an internal tool, a beta program, or a private API (not browser-facing), Turnstile doesn't help. Use the server-side fraud API alone. The 2-stage funnel only makes sense for browser-based signup forms.
If your signup form is on a high-traffic consumer product (millions of signups per month), the cost of the fraud API at $0.01 per call might exceed the value. In that case, use Turnstile alone and accept the ~5% bot rate. The math works out when the cost of bot signups is less than $0.01 per legitimate signup.
When to skip the fraud API
If your signup form is on a free tool with zero monetization, the cost of the fraud API might not be worth it. Use Turnstile alone. The ~5% bot rate will be a quality issue but not a security one.
If you're a regulated business that needs SOC 2 compliance, the fraud API is the bare minimum. Turnstile alone is not acceptable for a regulated business.
What about reCAPTCHA?
Google reCAPTCHA v3 is in the same bucket as Turnstile: in-browser passive challenges, returns a score, verified server-side. The only meaningful difference is that reCAPTCHA feeds data back to Google's ad network. If you're privacy-conscious, Turnstile is the better choice. If you don't care, reCAPTCHA is fine.
The catch rates for reCAPTCHA v3 and Turnstile are roughly comparable in the published benchmarks. The difference is vendor lock-in (Google vs Cloudflare) and privacy.
The bottom line
Use both. Turnstile is the cheap first gate that filters out the 95% of low-effort bots without costing you anything. The server-side fraud API is the actual security gate that catches the 5% that get past Turnstile, plus the non-browser bots that Turnstile can't see.
The cost of the 2-stage funnel at $0.01 per call (for the ~5% that get past Turnstile) is roughly $5 per 50,000 signups. The cost of NOT having the funnel is the cost of dealing with 30% bot signups in your database: a Mixpanel event per bot, a database row per bot, a customer-support ticket per bot when they try to log in 6 months later.
The math: a 30% bot rate on 50,000 signups = 15,000 bot rows. At $0.50 per row in storage and processing, that's $7,500/year. The 2-stage funnel costs $50/year. The ROI is 150x.
---
About the author
Jeffrin James is the founder of SignupDoggy, a serverless fraud-detection API for indie hackers and small SaaS teams. He built the product in Mumbai, India, after spending six months and $2,400 on enterprise fraud-detection vendors that didn't fit his use case. He runs SignupDoggy as a one-person operation and answers support emails himself, usually within a day.
Tags: Cloudflare Turnstile, reCAPTCHA, bot detection, signup fraud, fraud API, indie hackers