Most “Turnstile alternative” pages are either Cloudflare’s own docs, a self-hosted proof-of-work project, or a vendor explaining why neither Turnstile nor hCaptcha is enough and you should buy them instead.

I built Edge Shield because I wanted the other option: the same embed you’d actually ship in a form, without routing traffic through someone else’s CDN, without a fingerprint store, and with a score I can write a policy against. It went live on 26 July 2026. This is the comparison I would have wanted before we shipped it.

If you need a DDoS product, this is the wrong page. Shield is a CAPTCHA-class widget. Same job as Turnstile.

Same shape on purpose

Turnstile’s contract is the one developers already know: a sitekey in the page, a secret on the server, a short-lived token, a siteverify POST. Their docs are clear that the widget can sit on any site; you do not have to put the hostname behind Cloudflare.

Shield copies that contract. Three modes, mapped one-to-one: Managed, Non-Interactive, Invisible. Client script is https://shield.edge.network/api.js. Markup is a div with data-sitekey. The token is a 5-minute, single-use JWT. Server check is POST https://shield.edge.network/siteverify. Error names match Turnstile’s (timeout-or-duplicate, invalid-input-secret, and the rest).

If you already have Turnstile in production, set data-compat="turnstile" and the widget also fills cf-turnstile-response. Field names, callbacks, the siteverify body: we wrote a migration guide so this is a swap, not a rewrite. Full behaviour is in the Shield docs.

We did not invent invisible proof-of-work. Turnstile already runs small non-interactive challenges (proof-of-work, proof-of-space, API probes, behaviour checks) and tries not to show a puzzle. Shield’s challenge is SHA-256 in a Web Worker, difficulty adaptive, typically tens of milliseconds on a phone. The interesting differences are what happens after that work is done.

Binary answers are a blunt instrument

Turnstile’s siteverify is pass or fail. That is fine for a newsletter form. It is awkward the moment you have more than one policy.

Shield returns the same success fields, plus a humanity score from 1 to 100. 1 is confirmed automation. 100 is confirmed human. The bands we actually use:

  • 70–100: allow
  • 40–69: step up (Managed can show a challenge; you can route to a slower path)
  • 1–39: block, or send it to the agent path

That is the post I have not seen on the comparison blogs. They argue catch rate and farm prices. Operators argue thresholds. A score lets you treat a login, a checkout, and a contact form as different risk, on the same widget.

Agents are not failed humans

The comparison pages still frame the problem as human vs bot. A lot of the traffic we see now is neither: signed crawlers, retrieval agents, tools that should be allowed on a docs site and thrown off a password reset.

Shield understands Web Bot Auth, reverse-DNS confirmation for known crawlers, and per-widget agent policy. Siteverify can include an agent field. There is a separate agentverify API for paths that never render a widget. If your “bot problem” is actually “I need a policy for machines that identify themselves,” pass/fail CAPTCHA is the wrong primitive.

Privacy is an architecture, not an addendum

Turnstile’s docs say they process only what is necessary, do not read your form fields, and point at a Privacy Addendum. They also document a Pre-clearance cookie for SPAs. I am not going to invent the rest of Cloudflare’s data practices. Read their addendum.

What I will say about Shield, because it is how we built it:

  • No cookies, no local storage
  • No fingerprint database
  • No per-visitor record, not even an anonymised one
  • Coarse environment signals are scored in memory and discarded
  • Interaction noise (the stuff that separates a motor cortex from a script) stays on the device; we never ship raw movement or keystroke streams
  • The only thing we persist is hourly aggregate counters: challenge counts, average score

There is nothing to put in a consent banner for the widget itself. GDPR and CCPA are the default, not a region flag. The client is open source. Accessibility target is WCAG 2.2 AA, same bar Turnstile publishes.

If your constraint is “no third-party cookie and nothing stored about this visitor,” that is a design choice, not a policy PDF.

Offline verify, tarpit, size

Three other deltas that matter in production:

JWKS. Tokens are Ed25519-signed JWTs. You can verify them locally with our public keys and never call siteverify. Useful in CI, useful when you do not want a runtime dependency on our API for every POST.

Tarpit. Repeat offenders get exponentially harder proof-of-work. Most hosted widgets either pass you or bounce you. Making the cheap attack expensive is the older, boring defence, and it is documented.

Payload. The widget is under 15KB, no dependencies. Turnstile’s overview does not publish a size; we do because form pages feel it.

Core protection is free forever: unlimited widgets, unlimited verifications, all three modes, score included. No card, no “analytics is on the paid plan.” I am not going to pretend Cloudflare’s free Turnstile is a trap. It is a good product. I am saying we did not hold the useful bits back for a WAF bundle.

When I would still use Turnstile

Use Turnstile if you already live in Cloudflare’s dashboard, you want their bot/WAF/DDoS stack on the same account, or you want their analytics and pre-clearance cookie as part of that world. Their challenge platform is battle-tested. I am not competing with that bundle.

Use Shield if you want the widget without the rest of the network, a score you can branch on, an agent policy, local JWT verification, and a privacy model that does not keep a visitor around. Embed it on any origin. Your traffic does not come to us.

Swap it

  1. Create a widget, get es_… / es_secret_… from the console or edge shield create.
  2. Point the script at https://shield.edge.network/api.js.
  3. Keep your existing siteverify flow; change the URL and secrets. Or verify the JWT yourself.
  4. Put data-compat="turnstile" on the div if you need the old field name for a release or two.
  5. Start in shadow/report-only, look at scores, then enforce.

How-to with copy-paste markup: Bot protection with Edge Shield. Product page: edge.network/shield. Launch note: Introducing Edge Shield.

I did not write this to dunk on Cloudflare. I wrote it because the SERP for “Turnstile alternative” currently offers you a self-hosted puzzle or a plugin bake-off, and the thing we actually shipped is neither.