Cloudflare Turnstile is free: unlimited challenges on the standard plan, and up to 20 widgets. For most small sites it is the first answer, and it is a good one. This article is for the sites that want something else: no Cloudflare account, a check they run from their own server, or a second layer on top of Turnstile. We offer three tools for that, and we say below where Turnstile is the better buy.
What we offer instead of Turnstile
• osec Captcha: the form check. Invisible proof-of-work, a siteverify call with your secret.
• osec Signup Checks: an API for breached passwords (Have I Been Pwned, k-anonymity) and disposable or role email addresses.
• osec Bot Gate: a small middleware on your own server. One invisible check per visitor per week, search engines allowed. For scrapers hitting pages that have no form.
Five reasons to use osec instead
1. No Cloudflare account. The widget, the check and the console all run from osec.one. You don't need Cloudflare's DNS or proxy for any of it.
2. Your server holds the verdict. The siteverify call is yours to log, rate-limit and retry. Nothing about the check depends on a vendor's dashboard.
3. No tracking cookies from the widget. osec Captcha sets none.
4. One console for the check and the password checks. Captcha, Signup Checks and Login Protection share a site-key console, so a signup form can use two tools with one account.
5. Bot Gate for the pages without forms. Turnstile protects a widget. Bot Gate slows scrapers on every page of a small site, on your server, with no DNS move.
Pricing
• Cloudflare Turnstile: free on the standard plan, with unlimited challenges and no monthly cap. Up to 20 widgets and 10 hostnames per widget. Enterprise is a sales quote.
• osec Captcha: $0 for 500 checks a day on each account. $5 for 10 credits, $10 for 20, $50 for 100. Each credit adds 500 a day for 30 days.
• osec Signup Checks and Bot Gate: free to start on the same site-key console. Their limits are on each tool's page.
On price alone, Turnstile wins at any volume. Our free tier is capped; theirs isn't. Credits make our tools cost something once you grow, and that is the trade.
Where Turnstile is the better choice
• Price: Turnstile is free with no request cap. osec Captcha is free up to 500 checks a day, then credits.
• Scale and backing: Cloudflare runs Turnstile across its whole network. osec runs on one shared server.
• You already use Cloudflare: if your DNS is on Cloudflare, Turnstile costs you nothing to add. The reason to switch is the lack of a Cloudflare dependency, not the feature list.
• Bot scores: Cloudflare's bot signals are deeper than the proof-of-work check we run.
Swap it in
1. Create a site key at osec.one → Console → Site keys. List your hostnames.
2. Copy the secret. It's shown once.
3. In your form: <div class="osec-captcha" data-sitekey="osk_…"></div>
4. Load https://osec.one/assets/osec-captcha/osec-captcha.js.
5. On your server: POST secret and response to https://api.osec.one/tools/captcha/siteverify.
6. Accept the form only when success is true.
Compare Turnstile with osec Captcha, Signup Checks and Bot Gate on one page.
Compare the alternativesSources
• Cloudflare Turnstile plans: https://developers.cloudflare.com/turnstile/plans/
• Prices checked 5 October 2026. Check Cloudflare's page before you buy.