FCaptcha vs Cloudflare Turnstile

FCaptcha vs Cloudflare Turnstile: a self-hosted, open-source CAPTCHA against Cloudflare's hosted one. Same siteverify API, so switching is a URL change.

Cloudflare Turnstile and FCaptcha both replace the image-grid CAPTCHA with a check most visitors never notice. The difference is where it runs and who can see how it decides. Turnstile is a hosted service on Cloudflare’s network with a closed scoring model. FCaptcha is open source (MIT) and runs on your own server.

At a glance

Where they differ

Who sees your visitors

Every Turnstile check sends the visitor’s browser data to Cloudflare. For many sites that’s fine. For sites with strict GDPR requirements, procurement reviews, or a policy of no third-party processors, it can be the deciding factor. FCaptcha has no third party: the widget, the signals and the verdict stay on infrastructure you control.

Knowing why a visitor was blocked

Turnstile returns pass or fail. FCaptcha returns a score along with the detections that produced it, each with a human-readable reason. When a real customer is blocked, you can see why and tune it.

Accessibility

Neither shows a puzzle. FCaptcha also checks its widget against WCAG 2.2 AA in CI, and runs a benchmark of screen-reader, keyboard-only, motor-tremor and elderly users with a false-positive budget that fails the build when it’s exceeded.

Running it

Turnstile is zero operations: Cloudflare runs it. FCaptcha is a service you run. It’s a single container with no database, and Redis is optional for running more than one replica, but it’s still something you have to operate.

Migrating from Turnstile

The backend is a URL change. FCaptcha answers the Turnstile siteverify contract on the same path:

- https://challenges.cloudflare.com/turnstile/v0/siteverify
+ https://your-fcaptcha-server.com/turnstile/v0/siteverify

The request fields (secret, response, remoteip, idempotency_key) and the response shape (success, challenge_ts, hostname, action, cdata, error-codes) are the same. FCaptcha adds one field, score, which you can ignore.

On the frontend, swap the Turnstile script and container for FCaptcha’s widget:

<form method="post" action="/signup">
  <div data-fcaptcha="your-site-key" data-endpoint="https://your-fcaptcha-server.com"></div>
  <button>Sign up</button>
</form>
<script src="https://your-fcaptcha-server.com/fcaptcha.js"></script>

Your backend then reads the token from the form field fcaptcha_token instead of cf-turnstile-response. From v1.45.0 the widget adds that field itself; on earlier versions, set it from the widget’s callback.

Try it

• Live demo
• Source and documentation on GitHub