Turnstile vs Nolgard

Turnstile checks that a signup is human. Nolgard checks for linked repeat accounts and tells your backend how many credits to give. Use both when a repeat trial costs you money.

What Turnstile is good at

• Free, with unlimited verification requests. The free plan covers 20 widgets, 10 hostnames per widget and 7 days of analytics. Cloudflare plans
• Invisible, non-interactive and managed challenge modes. You can check browsers without asking visitors to solve an image puzzle. Turnstile docs
• Standalone. The widget plus siteverify works on any stack; you do not have to move DNS or traffic to Cloudflare.
• A dedicated browser challenge with server-side token verification. Keep that check before account creation.
• Enterprise adds Ephemeral IDs: a short-lived device identifier returned in siteverify as metadata.ephemeral_id, with no cookie or localStorage. It is scoped to one Cloudflare account, expires in days, and is aimed at IP-rotating fake signups. It cannot be self-activated on the free plan. Ephemeral ID docs

Plan and feature details are Cloudflare's own documentation, read 2026-10-23. Turnstile is a separate product from Cloudflare's paid Bot Management and WAF.

What Turnstile does not decide

A Turnstile pass means a browser solved a challenge. It carries no opinion about the account behind it.

• Same person again. One person with a fresh inbox passes Turnstile on every trial. Nothing in a free-plan response links the new signup to the four accounts already on that device.
• How many credits to give. The response is pass or fail. Your backend still has to pick a number, so in practice everyone who passes gets the full trial.
• What happens after signup. Turnstile sits on the form. It sees nothing about the 40,000 tokens the account burns in its first hour.
• Referral self-dealing. Both sides of a self-referral are real humans in real browsers. Both pass.
• Login takeover. A challenge on the login form slows credential stuffing, but it does not say whether this is a known device for this account or a first sighting from a new country.

Row by row

Turnstile column from Cloudflare's plan and feature docs, read 2026-10-23. Nolgard column matches the shipped API docs.

Use both

Run Turnstile first and drop the scripts. Then ask Nolgard what the survivor is worth. That is two network calls in one signup route.

const cf = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { method: 'POST',
  body: new URLSearchParams({ secret: TURNSTILE_SECRET, response: cfToken, remoteip }) }).then(r => r.json());
if (!cf.success) return reject();                       // challenge failed: stop here
const nf = await fetch('https://nolgard.com/v1/verify', { method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ secret: NOLGARD_SECRET, token: nfToken, remoteIp: remoteip, action: 'signup', account: { id, email } }) }).then(r => r.json());
if (nf.success) grantCredits(nf.grant.credits ?? Math.floor(nf.grant.share * FULL_TRIAL));

Example server-side flow. Both tokens come from the browser; secrets stay on your server. Handle network failures and failed verifies before granting anything, and grant only once per account. Under the default enforcing policy, a linked fourth account can receive 20 of 100 credits instead of a full trial. Follow the Clerk integration for error handling and grant.requires step-up handling.

• Keep the Turnstile widget where it is. Add Nolgard's client.js to collect its separate browser token.
• Start Nolgard in Observe mode. Decisions are not enforced; inspect repeat signals and proposed decisions before changing grants.
• If you already have Enterprise Ephemeral IDs, keep them. They are a useful extra device signal; they are not per-site account clusters, email intelligence or credit grants.

If you use Clerk

Clerk's bot protection is a Turnstile challenge on suspicious sign-ups, on by default, plus automation and proxy checks. Corporate VPNs and iCloud Private Relay are exempted, and the feature does not challenge sign-in. Changing its setting requires Clerk's Business plan. (Clerk's own documentation, read 2026-10-23.)

So a Clerk app already has the human check. What it still lacks is the account-level answer: whether this new user is the same person as three existing ones, and what the trial should be worth. Keep Clerk's sign-up and bot protection exactly as is, verify a Nolgard token in your onboarding route, and write the grant to user metadata.

When Turnstile alone is enough

Turnstile alone is often enough when your only decision is whether to accept a form submission:

• Contact forms, newsletter sign-ups and comment boxes. An abusive submission costs you spam rather than compute.
• Free tiers with nothing expensive behind them: no inference, no outbound SMS or email, no third-party API spend per user.
• Login forms where you only want to slow brute force and already have lockout and leaked-password checks.
• Static marketing sites and downloads, where you care about volume rather than identity.
• Any budget where $0 wins. Turnstile is free with unlimited verifications; do not pay for identity you will not act on.

If a repeat signup costs you real money, pass/fail is not enough. If it only costs you a database row, it is.

Related

• Clerk
• Supabase
• reCAPTCHA migration
• Repeat accounts
• Trial grants
• Bot detection
• Trial abuse calculator