Cloudflare Turnstile
Real Turnstile widget in managed mode, with server-side token verification.
What's measured on this page
- Turnstile widget mode — managed; Cloudflare decides whether to challenge.
- Server-side verification — the token is POSTed to
/api/turnstile/verify, which calls Cloudflare's siteverify with the secret. The token is single-use; the secret never reaches the browser.