Heretic and Cloudflare Turnstile

What Turnstile does

Turnstile runs a set of browser challenges, including a proof-of-work step and a battery of JavaScript probes, and issues a token. Your server exchanges that token at Cloudflare's siteverify endpoint and gets back whether it was valid. Most visitors see nothing. It is free, it does not require a Cloudflare-proxied zone, and it was built explicitly to stop making people label traffic lights.

For its intended job it is good, and if your problem is drive-by scripted form submissions it will handle them without an accessibility cost. We are not going to argue otherwise.

What a passed token lets you conclude

That some browser, somewhere, completed the challenge and Cloudflare was satisfied. That is the whole statement, and it is worth being precise about the three things it does not include.

It does not tie the solving browser to the submitting one. Token farming exists because those are separable: pass the challenge in a real browser, harvest the token, use it elsewhere inside its validity window.

It does not identify a device. Turnstile is anonymous by design, which is a real privacy feature and also means it cannot tell you that this is the eleventh account from the same machine.

It does not establish that the machine is what it claims. A real Chrome on a real Windows box driven by an operator passes comfortably, because from the challenge's point of view it is a real Chrome on a real Windows box.

What Heretic returns instead

A verdict of contradicted, refused or uncontradicted, and every finding that produced it under a stable ID with its tier.

The findings come from measurements the page cannot write. The TCP SYN options the kernel set, so a session claiming macOS over a connection built by a Linux kernel is stack.os-contradiction. The GREASE values and extension ordering in the TLS ClientHello, so a client claiming Chromium that sends no GREASE is tls.no-grease. A browser that advertises HTTP/3 and never sends a QUIC Initial packet is reach.no-quic-attempt. A handshake round trip faster than light could cross the distance the claimed timezone implies is geo.rtt-below-vacuum.

When a measurement is not enough for your policy, the escalation is a device ceremony rather than a puzzle. Hold a phone level, hold it steady under load, turn it sideways, confirm with a passkey that signs the readings. It ends passed, contradicted or not_completed with the step named, and the outcome carries the device it ruled on, so you can record it and recognise the same hardware next time.

The integration is the same shape

Deliberately. Heretic's widget takes a script tag and a div with a site key, renders in auto or challenge-only mode, and returns an opaque single-use token in a hidden form field. Your backend posts it to POST /v1/siteverify and gets back a success flag on Turnstile's contract, plus the verdict, whether the visitor was challenged, and the outcome.

There is no DNS delegation and no proxy in front of your traffic. The script loads from our origin and talks to our sensor from inside the browser. If you have wired up Turnstile, you have already done the work.

Which one you want

If the problem is volume spam on a low-value form, Turnstile is free and sufficient, and adding a second vendor buys you nothing.

If the problem is a hundred accounts run from an anti-detect browser on residential proxies, or automation that harvests tokens, or anything where you need to say afterwards which device this was, a challenge token is not the instrument. It answers a question you were not asking.

They also compose. Turnstile in front of the form and Heretic reading the session behind it is a reasonable arrangement, and the two do not contend for anything.