skills.rest
filippolmt
filippolmtCOMMUNITY
Explore all skills by this author →
GitHub

turnstile-spin

Set up Cloudflare Turnstile bot verification end-to-end in existing frontend and backend codebases.

1|Updated Jul 2, 2026
Search Tags:#migration#cloudflare#form security#turnstile#bot protection#siteverify#captcha
One-click install
npx skills add https://github.com/filippolmt/skills --skill turnstile-spin-filippolmt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/filippolmt/skills/tree/main/skills/turnstile-spin
Command: npx skills add https://github.com/filippolmt/skills --skill turnstile-spin-filippolmt

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Adding bot protection to a web form requires coordinating widget creation, frontend embeds, server-side siteverify calls, secret handling, and validation across many frameworks, which is error-prone when done manually. ## Core Features & Use Cases - Guided setup wizard: Probes Cloudflare API token scope, creates the Turnstile widget, embeds it at chosen form surfaces, and wires canonical server-side siteverify into the existing backend handler. - Framework-specific snippets: Provides ready integration references for vanilla HTML, Next.js App Router, Next.js Pages Router, Astro, SvelteKit, and Hugo. - CAPTCHA migration: Detects existing reCAPTCHA or hCaptcha integrations and converts them to Turnstile, including token field and siteverify endpoint changes. - Use Case: Ask the agent to protect a signup form from bots; it scans the codebase, creates the widget, gates the existing handler on siteverify success, and validates with a real token including replay rejection. ## Quick Start Ask the agent to set up Cloudflare Turnstile bot protection on your signup or contact form and confirm each step of the wizard.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to an existing form?▼

Run the wizard: it probes your API token, creates a widget for your domains, embeds the cf-turnstile div at each form surface, and adds a siteverify check inside your existing backend handler. The handler logic stays unchanged, gated on success, action, and hostname.

How do I migrate from reCAPTCHA or hCaptcha to Turnstile?▼

The codebase scan detects reCAPTCHA or hCaptcha and switches to a migration plan: swap the script tag, replace the widget div class with cf-turnstile, rename the token field to cf-turnstile-response, and point the backend at the Turnstile siteverify endpoint.

Does Turnstile work with Next.js, Astro, SvelteKit, and Hugo?▼

Yes. The skill ships framework references for Next.js App Router and Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML, each with widget embed snippets and a canonical server-side siteverify example.

What Cloudflare API token permissions does Turnstile setup need?▼

The token needs the Account.Turnstile:Edit permission with the target account included in Account Resources. The auth-probe script verifies this scope and reports missing_token, missing_scope, or account mismatch statuses.

Why does Turnstile validation fail with invalid-input-secret?▼

The secret did not reach the backend. Check that TURNSTILE_SECRET is set in your environment or secret manager, and for Workers run wrangler secret list to confirm the binding targets the correct script.

Can Turnstile protect a static site with no backend?▼

No. Siteverify must run server-side, so the skill exits if the form has no backend handler. A Cloudflare Pages Function or Worker can serve as that backend for static sites like Hugo.

Related Skills

Explore More Software Engineering Skills→
Aki2022Aki2022

turnstile-spin

Sets up Cloudflare Turnstile end-to-end with widget creation, frontend embeds, and server-side siteverify validation.

Community
Advanced
emersoftwareemersoftware
1

turnstile-spin

Deploys Cloudflare Turnstile bot protection with widget creation and managed Worker siteverify.

Community
Advanced
smammadov1994smammadov1994

captcha-solve

Detect CAPTCHAs on job application pages and auto-solve via 2Captcha.

Community
Advanced
nodefonynodefony

nodefony-load-test

Runs HTTP and WebSocket load, stress, and capacity benchmarks against Nodefony servers with validity controls.

Official
Advanced