Turnstile and WAF security baseline

Separate human verification from request filtering, with mandatory server validation and narrowly scoped rules.

SECURITYINTERMEDIATE22 minutesVerified 2026-08-26

Turnstile requires server-side validation

A successful browser widget is not authorization evidence. The backend must submit the token to Siteverify; tokens are single-use and expire, so never cache or replay them.

Two different gates

Capability	Evaluates	Good fit
Turnstile	A token produced by one user interaction	Registration, login, and form submission
WAF Custom Rule	An expression over request properties	Known malicious paths, sources, or behavior patterns

WAF rules combine a match expression with an action and run in order. An earlier terminating action such as Block prevents later rules from running, so order is security configuration.

Safe rollout order

Protect the backend action

After receiving a form, call Siteverify on the server. Reject missing tokens, failed verification, timeouts, and reused tokens; hiding the button is not enforcement.

Start WAF rules narrowly

Begin with one narrow path and an explainable condition. Prefer observation or Managed Challenge before Block. If a plan does not offer the Log action, that is not a reason to widen Block.

Test allow and deny

Confirm a normal request is unaffected, then send a safe test that should trigger the control. Retain Ray ID, rule ID, and time.

server-side pseudo flow

if (!token) return Response.json({ error: 'turnstile_required' }, { status: 400 });
const result = await verifyWithSiteverify(token, clientIp);
if (!result.success) return Response.json({ error: 'turnstile_failed' }, { status: 403 });
return performProtectedAction();

This shows control flow only. A real secret comes from a binding, and errors must never echo the Siteverify secret or internal response.

Rollback boundaries

If Turnstile fails, sensitive writes default to fail closed with a human support path.
If a WAF rule causes false positives, disable the newest rule rather than clearing all protection.
Export expressions and ordering before a change so the previous state is recoverable.