Cloudflare has released Turnstile Spin, a workflow that lets a coding agent install the company's bot protection across both the frontend and backend of a website. The tool addresses a common security mistake: displaying a Turnstile widget without validating its token on the server.
A user chooses where protection is needed, then the agent examines the local codebase, proposes a plan and waits for approval. It can create a new widget, add the Siteverify call to relevant backend functions, repair an existing widget that never validates server-side, or migrate an application from another CAPTCHA provider. Spin can start from the Cloudflare dashboard, the Wrangler command-line tool or a public skill URL pasted into an agent.
Cloudflare says the code remains with the user's chosen agent, such as Claude Code, Cursor or Codex; Spin does not send the application code to Cloudflare for remote editing. The only new Cloudflare resource is the Turnstile widget, while the site's own backend continues deciding what to do with the verification result.
Turnstile is free and does not require a site to proxy traffic through Cloudflare. The company says its dashboard has recorded more than 65,000 successful Spin widget creations since the feature first appeared in July. Developers should still review the proposed changes and test both successful and failed verification paths rather than treating agent installation as proof that the protection works.