---
type: "raw_signal"
id: "misconfiguring-turnstile-by-skipping-backend-validation-leaves-sites-eea943"
slug: "misconfiguring-turnstile-by-skipping-backend-validation-leaves-sites-eea943"
title: "Misconfiguring Turnstile by skipping backend validation leaves sites exposed to bots."
description: "Cloudflare has launched Turnstile Spin, an agent-mediated setup flow for its Turnstile bot-protection product."
retrieval_nugget: "Cloudflare has launched Turnstile Spin, an agent-mediated setup flow for its Turnstile bot-protection product."
observed_at: "2026-09-25"
record_date: "2026-09-25"
date_kind: "observed_at"
why_it_matters: "Cloudflare states that application code is not sent to or remotely changed by Cloudflare. The selected agent makes approved changes in the user’s codebase, while the new Cloudflare-side resource is the Turnstile widget. Source: https://blog.cloudflare.com/turnstile-spin"
novelty: "notable"
verification_level: "source-linked"
signal_type: "release"
source_platform: "blog.cloudflare.com"
topics: []
entities: []
related_patterns: []
source_url: "https://blog.cloudflare.com/turnstile-spin"
source_urls: ["https://blog.cloudflare.com/turnstile-spin"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:misconfiguring-turnstile-by-skipping-backend-validation-leaves-sites-eea943"
status: "published"
visuals: []
routes: {"html":"https://newruntime.com/signals/misconfiguring-turnstile-by-skipping-backend-validation-leaves-sites-eea943/","markdown":"https://newruntime.com/signals/misconfiguring-turnstile-by-skipping-backend-validation-leaves-sites-eea943.md","json":"https://newruntime.com/signals/misconfiguring-turnstile-by-skipping-backend-validation-leaves-sites-eea943.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Misconfiguring Turnstile by skipping backend validation leaves sites exposed to bots.

## Retrieval answer

Cloudflare has launched Turnstile Spin, an agent-mediated setup flow for its Turnstile bot-protection product.

Cloudflare has launched Turnstile Spin, an agent-mediated setup flow for its Turnstile bot-protection product. Spin guides a coding agent through both required halves of an integration: rendering the client-side widget and sending its token to the backend Siteverify API.

The product also targets existing incomplete deployments. Cloudflare says a widget that has served traffic without server-side validation receives a “Fix with Spin” action in the dashboard; the workflow can add the missing backend verification while the widget continues serving traffic. It also supports fresh installs and migrations from other CAPTCHA providers.

Cloudflare states that application code is not sent to or remotely changed by Cloudflare. The selected agent makes approved changes in the user’s codebase, while the new Cloudflare-side resource is the Turnstile widget. Source: https://blog.cloudflare.com/turnstile-spin

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)