thefullstackciso.com
Security, shipped
Vol. I — No. 7Falls Church, Va.Thursday, July 16, 2026Price: free, always

The Full Stack CISOStrategyPage A2June 20, 2026
Strategy

Your CAPTCHA is free (and other Cloudflare cost myths)

Turnstile is genuinely unlimited and free. The catch isn’t the price — it’s knowing where your bill actually comes from.

Every few weeks someone tells me a CAPTCHA is a tax on users and a line item on an invoice. They are half right. Cloudflare Turnstile is free, with no per-solve fee. The real limits are prosaic: a cap on how many widgets you can register and about a week of analytics retention. That is it.

The reframe

A CAPTCHA is a cost saver, not a cost. It stops bots before they reach the surfaces that actually bill you: the endpoint that sends an authentication email, the route that calls a language model, the CDN egress on a large file. Money leaves through those specific doors. Turnstile is a cheap lock on them.

The invoice never comes from the CAPTCHA. It comes from what the CAPTCHA was standing in front of.

So the question is never “can I afford the CAPTCHA.” It is “which of my endpoints spend real money per request, and is anything cheap standing between a bot and them.” Put the free lock on the expensive door and the myth dissolves.

letters to the editor

Loading the letters…

sign in with your email · your CertScore shows on your letter