--- title: "Edge Shield vs Cloudflare Turnstile" description: "A founder’s comparison of Edge Shield and Cloudflare Turnstile: same siteverify shape, a 1–100 score, no per-visitor data, and a drop-in migration." url: https://edge.network/latest/edge-shield-vs-cloudflare-turnstile/ --- # Edge Shield vs Cloudflare Turnstile [Back to Latest](https://edge.network/latest) Product August 31, 2026 # Edge Shield vs Cloudflare Turnstile A founder’s comparison of Edge Shield and Cloudflare Turnstile: same siteverify shape, a 1–100 score, no per-visitor data, and a drop-in migration. Most “Turnstile alternative” pages are either Cloudflare’s own docs, a self-hosted proof-of-work project, or a vendor explaining why neither Turnstile nor hCaptcha is enough and you should buy them instead. I built [Edge Shield](https://edge.network/shield) because I wanted the other option: the same embed you’d actually ship in a form, without routing traffic through someone else’s CDN, without a fingerprint store, and with a score I can write a policy against. It went live on 26 July 2026. This is the comparison I would have wanted before we shipped it. If you need a DDoS product, this is the wrong page. Shield is a CAPTCHA-class widget. Same job as Turnstile. ## Same shape on purpose Turnstile’s contract is the one developers already know: a sitekey in the page, a secret on the server, a short-lived token, a `siteverify` POST. Their docs are clear that the widget can sit on any site; you do not have to put the hostname behind Cloudflare. Shield copies that contract. Three modes, mapped one-to-one: Managed, Non-Interactive, Invisible. Client script is `https://shield.edge.network/api.js`. Markup is a `div` with `data-sitekey`. The token is a 5-minute, single-use JWT. Server check is `POST https://shield.edge.network/siteverify`. Error names match Turnstile’s (`timeout-or-duplicate`, `invalid-input-secret`, and the rest). If you already have Turnstile in production, set `data-compat="turnstile"` and the widget also fills `cf-turnstile-response`. Field names, callbacks, the siteverify body: we wrote a [migration guide](https://edge.network/docs/shield/turnstile-migration) so this is a swap, not a rewrite. Full behaviour is in the [Shield docs](https://edge.network/docs/shield). We did not invent invisible proof-of-work. Turnstile already runs small non-interactive challenges (proof-of-work, proof-of-space, API probes, behaviour checks) and tries not to show a puzzle. Shield’s challenge is SHA-256 in a Web Worker, difficulty adaptive, typically tens of milliseconds on a phone. The interesting differences are what happens after that work is done. ## Binary answers are a blunt instrument Turnstile’s siteverify is pass or fail. That is fine for a newsletter form. It is awkward the moment you have more than one policy. Shield returns the same success fields, plus a humanity **score from 1 to 100**. 1 is confirmed automation. 100 is confirmed human. The bands we actually use: - 70–100: allow - 40–69: step up (Managed can show a challenge; you can route to a slower path) - 1–39: block, or send it to the agent path That is the post I have not seen on the comparison blogs. They argue catch rate and farm prices. Operators argue thresholds. A score lets you treat a login, a checkout, and a contact form as different risk, on the same widget. ## Agents are not failed humans The comparison pages still frame the problem as human vs bot. A lot of the traffic we see now is neither: signed crawlers, retrieval agents, tools that should be allowed on a docs site and thrown off a password reset. Shield understands [Web Bot Auth](https://edge.network/docs/shield), reverse-DNS confirmation for known crawlers, and per-widget agent policy. Siteverify can include an `agent` field. There is a separate `agentverify` API for paths that never render a widget. If your “bot problem” is actually “I need a policy for machines that identify themselves,” pass/fail CAPTCHA is the wrong primitive. ## Privacy is an architecture, not an addendum Turnstile’s docs say they process only what is necessary, do not read your form fields, and point at a Privacy Addendum. They also document a Pre-clearance **cookie** for SPAs. I am not going to invent the rest of Cloudflare’s data practices. Read their addendum. What I will say about Shield, because it is how we built it: - No cookies, no local storage - No fingerprint database - No per-visitor record, not even an anonymised one - Coarse environment signals are scored in memory and discarded - Interaction noise (the stuff that separates a motor cortex from a script) stays on the device; we never ship raw movement or keystroke streams - The only thing we persist is **hourly aggregate counters**: challenge counts, average score There is nothing to put in a consent banner for the widget itself. GDPR and CCPA are the default, not a region flag. The client is open source. Accessibility target is WCAG 2.2 AA, same bar Turnstile publishes. If your constraint is “no third-party cookie and nothing stored about this visitor,” that is a design choice, not a policy PDF. ## Offline verify, tarpit, size Three other deltas that matter in production: **JWKS.** Tokens are Ed25519-signed JWTs. You can verify them locally with our public keys and never call siteverify. Useful in CI, useful when you do not want a runtime dependency on our API for every POST. **Tarpit.** Repeat offenders get exponentially harder proof-of-work. Most hosted widgets either pass you or bounce you. Making the cheap attack expensive is the older, boring defence, and it is documented. **Payload.** The widget is under 15KB, no dependencies. Turnstile’s overview does not publish a size; we do because form pages feel it. Core protection is free forever: unlimited widgets, unlimited verifications, all three modes, score included. No card, no “analytics is on the paid plan.” I am not going to pretend Cloudflare’s free Turnstile is a trap. It is a good product. I am saying we did not hold the useful bits back for a WAF bundle. ## When I would still use Turnstile Use Turnstile if you already live in Cloudflare’s dashboard, you want their bot/WAF/DDoS stack on the same account, or you want their analytics and pre-clearance cookie as part of that world. Their challenge platform is battle-tested. I am not competing with that bundle. Use Shield if you want the widget without the rest of the network, a score you can branch on, an agent policy, local JWT verification, and a privacy model that does not keep a visitor around. Embed it on any origin. Your traffic does not come to us. ## Swap it - Create a widget, get `es_…` / `es_secret_…` from the console or `edge shield create`. - Point the script at `https://shield.edge.network/api.js`. - Keep your existing `siteverify` flow; change the URL and secrets. Or verify the JWT yourself. - Put `data-compat="turnstile"` on the div if you need the old field name for a release or two. - Start in shadow/report-only, look at scores, then enforce. How-to with copy-paste markup: [Bot protection with Edge Shield](https://edge.network/academy/bot-protection-shield). Product page: [edge.network/shield](https://edge.network/shield). Launch note: [Introducing Edge Shield](https://edge.network/latest/introducing-edge-shield). I did not write this to dunk on Cloudflare. I wrote it because the SERP for “Turnstile alternative” currently offers you a self-hosted puzzle or a plugin bake-off, and the thing we actually shipped is neither. ### Edge Digest A weekly wrap-up of what's happening in tech — frontiers, trends, and exclusive offers delivered to your inbox. No spam. Unsubscribe anytime.