The Cloudflare Turnstile Alternative. Independent, EU-hosted, invisible.

Turnstile alternative — side by side

Turnstile is a strong invisible option tied to Cloudflare's ecosystem. TrustSig delivers the same invisibility as an independent EU vendor — the cloudflare turnstile alternative compared on residency, vendor dependency and verify path.

Why teams move off Turnstile

Turnstile is genuinely good. The friction is structural — it assumes Cloudflare, and many teams want their bot protection decoupled from a CDN and a US vendor.

Turnstile replacement in 5 minutes

The turnstile replacement path: remove the Turnstile widget and siteverify call; add the invisible scan and a local verify. Two npm packages, no infrastructure changes, no account elsewhere.

1. 01
   Frontend — remove the widget

   // Before — Cloudflare Turnstile
   // <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" />
   // <div className="cf-turnstile" data-sitekey={SITE_KEY} />
   
   // After — TrustSig (no element, no Cloudflare account)
   import { useTrustSig } from "@trustsig/react"
   
   function ActionForm() {
     const { scan } = useTrustSig()
   
     const handleSubmit = async () => {
       const response = await scan()
       await fetch("/api/action", {
         headers: { "X-TrustSig-Response": response?.token || "" },
       })
     }
   }

2. 02
   Backend — replace the verify call

   // Before — Turnstile (round-trip to Cloudflare)
   // await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", ...)
   
   // After — TrustSig (verified locally, zero latency)
   import { TrustSig } from "@trustsig/server"
   
   const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY })
   
   app.post("/api/action", async (req, res) => {
     const token = req.headers["x-trustsig-response"]
   
     const result = ts.verifyLocal(token)
   
     if (result.action === "BLOCK")
       return res.status(403).json({ error: "Blocked" })
   })

Turnstile migration questions