A Turnstile alternative without Cloudflare
Updated
Turnstile is free and very good. This page is for people who want no script from a US CDN on their forms and no Cloudflare account.
Where Turnstile is better
Turnstile costs nothing and has no limit on challenges or verifications. It uses the risk level of each visitor to decide whether it shows a checkbox. It is not necessary for your site to use the Cloudflare CDN. You manage widgets in the dashboard, with the API or with Terraform. If a Cloudflare account and a Cloudflare script on your forms are fine for you, use Turnstile.
Where Bot403 is better
Bot403 is for the other case. The browser loads one 6 KB script from Bot403 and connects to nothing else. You sign in with an email address. You do not create a Cloudflare account. Bot403 sets no cookie and never stores visitor IP addresses. It runs on one server in Germany. One person in the EU operates it. 5,000 checks a month are free, and 50,000 checks cost €3 a month.
Side by side
The facts come from the public pages of Turnstile (https://developers.cloudflare.com/turnstile/plans/, https://developers.cloudflare.com/turnstile/, https://developers.cloudflare.com/turnstile/get-started/, https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/, https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/), checked on 2026-10-23. "Not stated" means the page does not say. If something changed, email me. Then I will correct it.
| Capability | Bot403 | Turnstile |
|---|---|---|
| Price | free for 5,000 a month, then €3 a month | free, Enterprise on request |
| Free plan | 5,000 checks, 2 sites, no card | unlimited challenges, 20 widgets, 10 hostnames for each widget |
| Account you need | an email address | a Cloudflare account |
| Script on your page | 6 KB, from Bot403 | api.js from challenges.cloudflare.com |
| What visitors see | nothing | a checkbox when Managed mode asks for one. Non-interactive and Invisible modes also exist |
| Cookies | none | cf_clearance when pre-clearance is on (off by default) |
| Statistics kept | 30 days | 7 days on Free, 30 days on Enterprise |
| Who runs it | one person in the EU, server in Germany | Cloudflare |
Switch in 10 minutes
Remove the Turnstile script and widget from the page. Add one script tag with your public key. On the server, replace the Turnstile verify call with a POST to /api/v1/verify. The verify page has the request for Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby. The form fields stay as they are.