skills.rest
jpmoya
jpmoyaCOMMUNITY
Explore all skills by this author →
GitHub

turnstile-spin

Set up Cloudflare Turnstile bot verification end to end with server-side siteverify validation.

Updated Sep 1, 2026
Search Tags:#cloudflare#form security#turnstile#bot protection#setup wizard#siteverify#captcha
One-click install
npx skills add https://github.com/jpmoya/claude-agents --skill turnstile-spin-jpmoya
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/jpmoya/claude-agents/tree/main/skills/turnstile-spin
Command: npx skills add https://github.com/jpmoya/claude-agents --skill turnstile-spin-jpmoya

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Adding bot protection to forms and endpoints requires coordinating widget creation, frontend embeds, backend siteverify calls, and secret handling across many frameworks, which is error-prone when done manually. ## Core Features & Use Cases - Guided setup wizard: Probes Cloudflare API token scope, creates the Turnstile widget, embeds it at chosen surfaces, and wires canonical server-side siteverify into the existing backend handler. - Framework-specific snippets: Provides ready integration references for vanilla HTML, Next.js App Router, Next.js Pages Router, Astro, SvelteKit, and Hugo. - Migration and recovery: Migrates existing reCAPTCHA or hCaptcha integrations to Turnstile and retrieves existing widget secrets through a guarded, confirmation-gated flow. - Use Case: Ask the agent to protect a signup form from bots; it scans the codebase, creates the widget, gates the existing handler on siteverify success, and validates with a real token including replay rejection. ## Quick Start Ask the agent to set up Cloudflare Turnstile bot protection on your signup form and follow the guided wizard prompts.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to a form?▼

Run the guided wizard: it probes your API token, creates a widget for your domains, embeds the cf-turnstile div in your form, and adds a siteverify check inside your existing backend handler. It finishes by validating with a real token and confirming replay rejection.

How do I migrate from reCAPTCHA to Cloudflare Turnstile?▼

The skill detects reCAPTCHA or hCaptcha during its codebase scan and switches to a migration plan. It swaps script tags and div classes, renames the token field to cf-turnstile-response, points the backend at the Turnstile siteverify URL, and replaces the old secret env var with TURNSTILE_SECRET.

Does Turnstile work with Next.js, Astro, and SvelteKit?▼

Yes. The skill ships framework references for Next.js App Router, Next.js Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML, each showing the widget embed plus the matching server-side siteverify snippet for that framework's route or action pattern.

Can Turnstile protect a static site with no backend?▼

No. Siteverify is server-side by design, so the skill exits if the form has no backend handler. You would need a Cloudflare Pages Function, a Worker, or a form host with a server-side hook before Turnstile validation can run.

Why does siteverify return invalid-input-secret after setup?▼

The secret did not reach the backend. Re-check that TURNSTILE_SECRET is set in your environment or secret manager, and for Workers run wrangler secret list to confirm the secret is bound to the correct script and environment.

Related Skills

Explore More Software Engineering Skills→
Aki2022Aki2022

turnstile-spin

Sets up Cloudflare Turnstile end-to-end with widget creation, frontend embeds, and server-side siteverify validation.

Community
Advanced
evolv3aievolv3ai
3

cloudflare-turnstile

Integrate Cloudflare Turnstile with client-side widgets and Siteverify API validation.

Community
Advanced
AgentiveCityAgentiveCity
2

cloudflare-security-hardening

Configure WAF rules, rate limiting, IP lists, and secure headers for Cloudflare Workers APIs.

Official
Advanced
sota411sota411
1

turnstile-spin

Automates end-to-end Cloudflare Turnstile setup including widget creation, Worker deployment, and frontend integration.

Community
Advanced