Content Gate vs Cloudflare Turnstile

At a glance

Turnstile figures read 2026-10-11 from Cloudflare's developer docs: server-side validation, the Turnstile overview, widget modes, plans and client-side rendering. If something here is out of date, email hi@siftfy.io and we'll fix it.

The response your backend acts on

With Content Gate, a blocked automated session reaches your server as a decision you can branch on, with the score and the reasons beside it for your logs. A monitor-mode site gets the same score without the block, so you can watch it for a week before enforcing.

{
  "challenge_valid": true,
  "decision": "block",
  "reason": "bot",
  "bot": {
    "score": 100,
    "reasons": ["automation"],
    "rules_version": "bot-rules-v2"
  }
}

Turnstile's documented response has no field like bot. If you want a per-form threshold or a reason to log, you would build it from your own signals.

What we measured on Content Gate

On 2026-10-11 we drove 290 browser sessions against the live demo in production, at the default threshold of 90:

• 149 of 149 Playwright Chromium sessions with the automation flags removed and a real Chrome User-Agent were blocked, headless and in a visible window. Before widget v1.4, the same recipe was blocked 0 times in 75.
• 20 of 20 default headless Chromium sessions were blocked.
• 0 of 120 human-paced sessions in Chromium, Firefox, WebKit and a mobile profile were blocked. They scored 0 or 10.

How to read this: the “human” sessions are real browser engines driven at human pace, not people, so they show the checks don't misfire on ordinary browsers but don't measure the real false-positive rate. 149 of 149 puts the block rate above 95% with 95% confidence for that recipe. We did not run the same browsers against Turnstile and make no claim about its detection rate.

Where Turnstile is the better choice

• Price at volume. Turnstile's free plan has unlimited challenges. Content Gate's challenges are free, but each verification that reaches the spam model counts against your plan.
• Your form text never leaves your server. Turnstile doesn't read form entries. Content Gate must receive the text to judge it. Verification keeps none of it; the text is stored, for 30 days, only when evaluation collection is enabled for your site.
• Scale and maturity. Turnstile runs on Cloudflare's network and sees far more traffic than we do. Content Gate is in private beta and its bot rules are weeks old.
• The hardest bots. Neither product proves a visitor is human. A real Chrome driven over the DevTools protocol, with a normal window and real key presses, can still score low on Content Gate today.

When Content Gate is the right call

• You want a number and a reason to log on every submission, not only pass or fail.
• You want to block harder on one form than another, such as 70 on a sign-in link request and the default 90 on a contact form, without writing scoring logic yourself.
• Your spam comes from people or real browsers typing junk, which passes any visitor check. The same call also judges the text.
• You want to pin the exact script you ship with an SRI hash.

You can also run both: Turnstile in front of everything, Content Gate on the forms where a wrong message costs you something.

Questions