Companies Using Cloudflare Turnstile

Over the past several years of analysing web technology data, I've watched Cloudflare Turnstile evolve in ways the headline numbers don't capture. Two things changed since I last wrote this page: we widened the detection behind these figures, and the customer profile that emerged is close to the opposite of what I described before.

1. Growth Trajectory: From One Domain to 187K in Under Four Years

Turnstile's curve is the steepest we track in this category. The first domain appeared in October 2022, shortly after Cloudflare's Birthday Week beta. Adoption then sat under 100 domains for nearly a year until the September 2023 general availability launch, when the count went from 80 domains in September to 4,169 in October 2023, a 52x jump in a single month. Our earlier records took it to a peak of 49,749 domains in June 2025.

Our current crawl now puts Turnstile at 187,176 domains, up from 137,332 in June 2026. Some of that gap is a year of real growth, but a good part of it is measurement. Turnstile is identified from a JavaScript global that only exists once the page runs, so any crawler reading raw HTML undercounts it badly. That is the same property that made Akamai Bot Manager look five times larger in our earlier records than it does now, working in the opposite direction.

Sales Signal: Growth is still running but decelerating: our own series went 137,332 to 181,592 to 187,176 across June, July and August 2026. Even in the slowest of those months, 5,374 arrivals came directly from reCAPTCHA. These are active decision-makers who changed a security control recently, which is the best possible timing for an adjacent conversation.

2. Customer Profile: Small, Young, and Global

I described this base as enterprise-heavy before. The enriched data says otherwise, and the correction matters for anyone prospecting from it. 59.6% of Turnstile companies have 1-10 employees and 85.9% have 50 or fewer. Only 0.18% employ more than 10,000, against 6.9% for Akamai Bot Manager. What misled me earlier was reading the notable-companies list as if it were the distribution; it is the tail, not the shape.

Company age reinforces it. 37.27% were founded in the 2010s and 21.64% in the 2020s, so roughly 59% are under 16 years old, and only 4.07% predate 1960. By company type, 56.55% are privately held and just 9.77% are public.

This is what a free product with a one-line install looks like once you measure it properly: overwhelmingly small, young, independent businesses. Large organisations are present, the University of California, Carrefour, GE Healthcare, TransUnion, Cedars-Sinai, the State of Ohio, but they are the exception.

Sales Signal: Do not sell this list like an enterprise list. The volume is in small businesses and agencies buying on price and ease, where the winning motion is self-serve and low-touch. If you need enterprise accounts in bot protection, Akamai Bot Manager and Cloudflare Bot Management are where they are concentrated; Turnstile's 0.18% enterprise band is 208 companies.

3. Industry and Geographic Concentration

Turnstile is the most horizontal product in the category, and unusually so: no industry exceeds 5.2%. Real Estate leads at 5.11%, then IT Services and IT Consulting (4.74%), Construction (4.19%), Software Development (4.1%), Advertising Services (3.3%), Business Consulting (3.08%), Technology and Internet (3.05%) and Retail (2.93%).

Look at what the leaders have in common and the pattern is not industry at all, it is forms. Real estate enquiries, construction quote requests and agency contact pages are the highest-value spam targets on the small-business web, and they are exactly what a free challenge widget is bought to protect.

Geographically this is the most international base we track in the category, spanning 208 countries. The United States accounts for only 32.2% of enriched companies, against 63.5% for Akamai Bot Manager, followed by the United Kingdom (9.3%), Germany (5.7%), France (5.0%), the Netherlands (4.6%), Australia (4.4%), Canada (4.2%) and Spain (3.2%). English-speaking markets are just 50.1% of the base.

Sales Signal: Western Europe is over-represented here relative to its share of the web, and that is the most actionable geographic fact on this page. A German or Dutch small business choosing Turnstile over reCAPTCHA is usually making a data-protection decision, not a performance one, so compliance-led messaging lands where feature comparisons do not.

4. Migration Patterns: Turnstile Is the Category's Net Winner

Since tracking began in March 2026 we have observed 10,512 domains arrive and 3,572 leave, a net gain of 6,940 and the largest in the category by a wide margin. Nearly all of it is a single corridor: 9,451 domains moved from reCAPTCHA against 2,011 going back, a 4.7:1 ratio, with 5,374 arriving in the last 30 days. Nothing else in this category takes ground from reCAPTCHA at that rate.

The one meaningful outflow runs to Cloudflare Bot Management, 759 gained against 1,364 lost. I read that as movement up Cloudflare's own product range rather than a loss, since both ends are the same vendor and the destination is the paid enterprise tier.

Against hCaptcha, the nearest direct competitor and the product with the most similar pitch, the flow is surprisingly quiet: 257 gained, 160 lost. The two are not fighting over the same sites. They are both taking from Google, and Turnstile is taking far more.

Sales Signal: The reCAPTCHA-to-Turnstile corridor is the live event in this market, and it is dated and identifiable domain by domain. Sites that moved in the last 30 days have just revisited their bot-protection assumptions for the first time in years, which is when adjacent security, privacy and compliance tooling gets evaluated.

5. The Cloudflare Turnstile technology stack

Cloudflare's CDN sits under 63.46% of Turnstile domains, so most adopters were already customers for whom enabling it is a dashboard toggle. WordPress follows at 48.17%, and the plugins beneath it show what is actually being protected: Contact Form 7 at 25.51%, Gravity Forms at 4.86%, WPForms at 2.42%.

The ecommerce numbers confirm the same read from the other side. WooCommerce appears on 10.49% but Shopify on just 0.72%, because Shopify ships hCaptcha in its own checkout. Turnstile is a contact-form and login-form product, not a checkout one.

I previously reported that reCAPTCHA co-occurs on 49.8% of Turnstile sites and called it a mid-migration goldmine. On our own measurement the figure is 12.9%. The interpretation survives, roughly one site in eight is running both, which usually means a migration that stalled, but it is a much smaller segment than I claimed.

Sales Signal: The dual-running 12.9% is still the sharpest segment on this page, 25,591 domains carrying two challenge widgets on the same pages. That is measurable user friction and duplicated integration surface, and it is an easy opening for anyone selling consolidation, performance or migration work.

What Reviewers Say

I've cross-referenced our crawl data with user reviews across Capterra and developer forums, and the signals are clear. Users consistently praise frictionless verification and free pricing, which aligns with the adoption curve we track across more than 187,000 sites. The main pain points? VPN and proxy blocking flags legitimate users as suspicious, and reviewers report a lower bot detection rate than paid alternatives, meaning some automated traffic gets through. For teams evaluating Cloudflare Turnstile, those tradeoffs between user experience and security depth are worth weighing against alternatives like hCaptcha or reCAPTCHA.

Key Takeaways

Turnstile has gone from one domain to 187,176 in under four years and now ranks #3 in the category with a 3.68% share. Its base is small, young, privately held and globally distributed, not the enterprise roster the notable-companies list suggests: 85.9% of these companies have 50 or fewer employees and only 32.2% are in the United States.

The competitive fact that matters is the 4.7:1 gain ratio against reCAPTCHA. Cloudflare's advantage is that Turnstile is free, requires no CDN migration, installs in one line, and sends no visitor data to an advertising company, at a moment when that last point carries real weight in Europe. The constraint is the same as the advantage: a free product adopted by very small businesses is a large domain count attached to a small amount of revenue.

Sales Applications

Prospecting template: "Hi [Name], I noticed [Company] recently deployed Cloudflare Turnstile on [detected subdomain]. Based on our data at TechnologyChecker.io, about one in eight Turnstile sites still has reCAPTCHA running alongside it. Are you planning to fully migrate, or running both in parallel? We help companies like [similar company] simplify their security stack."

Targeting strategy: On TechnologyChecker.io, filter for companies running both Cloudflare Turnstile and reCAPTCHA. That 12.9% overlap, 25,591 domains, is carrying two challenge widgets at once and is the segment most open to consolidation. Weight your outreach toward Western Europe, where 50% of this base sits and where privacy compliance drives the decision.

Competitive angle: The 9,451 reCAPTCHA-to-Turnstile migrations since March 2026 are companies that just re-evaluated a control they had left alone for years. They respond well to concrete before-and-after comparisons on completion rates and page weight rather than feature matrices.

Explore the full dataset at TechnologyChecker.io and filter by industry, company size, geography and tech stack across 187,176 Cloudflare Turnstile domains with 126,517 enriched company profiles.