The Cloudflare Turnstile Alternative. Independent, EU-hosted, invisible.

Turnstile alternative, side by side

Turnstile is a strong invisible option tied to Cloudflare's ecosystem. These rows cover residency, vendor dependency and the verify path.

Turnstile assumes you run on Cloudflare

These are the reasons teams give for keeping bot defense separate from their CDN.

Turnstile replacement in 5 minutes

Remove the Turnstile widget and its siteverify call, then add the scan and one verify call. Two npm packages, and no account anywhere else.

1. 01
   Frontend: remove the widget

   // Before: Cloudflare Turnstile
   // <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" />
   // <div className="cf-turnstile" data-sitekey={SITE_KEY} />
   
   // After: TrustSig (no element, no Cloudflare account)
   import { useTrustSig } from "@trustsig/react"
   
   function ActionForm() {
     const { getResponse } = useTrustSig()
   
     const handleSubmit = async () => {
       const response = await getResponse()
       await fetch("/api/action", {
         headers: { "X-TrustSig-Response": response?.token || "" },
       })
     }
   }

2. 02
   Backend: replace the verify call

   // Before: Turnstile (round-trip to Cloudflare)
   // await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", ...)
   
   // After: TrustSig (one verify call at the edge)
   import { TrustSig } from "@trustsig/server"
   
   const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY })
   
   app.post("/api/action", async (req, res) => {
     const token = req.headers["x-trustsig-response"]
   
     const result = await ts.verifyRemote(token)
   
     if (result.action !== "ALLOW")
       return res.status(403).json({ error: "Blocked" })
   })

Turnstile migration questions