Turnstile stops bots. Doorman stops what people type.

Messages that pass a bot check: real submissions and how Doorman judged them

  1. Specimen · Contact formNº 006858 8675

    From growth@rankwise.io

    “Your restaurant isn't showing on page one of Google. We can fix your local SEO in 30 days, guaranteed. Can I send a proposal?”

    Sales pitch

    1% chance it’s real · 82 ms

    Void

  2. Specimen · Contact formNº 008536 6294

    From zara@quill.example

    “I run Quill Legal. We use Xero today. Half our clients are in the UK. Can we get a demo this week?”

    91% chance it’s real · 87 ms

    Genuine

  3. Specimen · Contact formNº 010214 3913

    From hello@pixelcraft.agency

    “We build stunning websites for architects. Your current site feels dated. 15 minute call to show you some concepts?”

    Sales pitch

    2% chance it’s real · 84 ms

    Void

  4. Specimen · Contact formNº 011892 1532

    From kofi@proton.me

    “I run Brightline Dental. Clients keep asking to pay by card and we can't take it. Does it import from what we use now?”

    81% chance it’s real · 78 ms

    Genuine

  5. Specimen · Contact formNº 013569 9151

    From hello@scaleleads.co

    “Are you accepting guest posts? I have a well researched article on small business cash flow that fits your audience.”

    pitch

    2% chance it’s real · 83 ms

    Void

  6. Specimen · Contact formNº 015247 6770

    From claire.m@gmail.com

    “Hi, my son chipped a front tooth at football. Do you have anything this week for children? He's 11.”

    95% chance it’s real · 90 ms

    Genuine
Start free
Paste a pitch you got

Sound familiar?

Turnstile is free and mostly invisible, and it's good at stopping scripted form floods. It doesn't read the message, so a salesperson or a paid spammer typing into your contact form passes. Doorman reads every submission and tells you why it kept one out.

14 days of Pro free, no card. Then free for 100 submissions a month, or Pro from $29.

  1. The pitches still arriveSEO offers, redesign pitches and partnership outreach come from real browsers. Turnstile lets them through, by design.
  2. No reason, everVerification returns pass or fail with no score and no explanation, so a blocked customer is a mystery.
  3. A script on every protected pageTurnstile needs its widget on the page and a verify call on your server.

Doorman and Cloudflare Turnstile, side by side.

QuestionDoormanCloudflare Turnstile
What it checksWhat the visitor sent, against what you sellBrowser signals: small invisible challenges and browser checks
Pitches from bots that pass the checkKept outPass
What visitors seeNothingUsually nothing; a checkbox when it judges a visitor risky
Why something was blockedThe exact sentenceNo score or reason in the response
SetupA form URL or one server callA script and widget on the page, plus a server-side verify call
PriceFree for 100 submissions a month, Pro $29 for 5,000Free with unlimited challenges; Enterprise via sales

Their plans and behaviour as published on their own sites, checked 29 September 2026. Sources: developers.cloudflare.com/turnstile, developers.cloudflare.com/turnstile/plans, developers.cloudflare.com/turnstile/get-started/server-side-validation.

Which one is right for you?

Choose Doorman if

  • The junk you get is typed by people or written to sound like them
  • You want to know why each message was kept out
  • You want unsure submissions held for you, not guessed
  • You'd rather add nothing to your pages

Choose Cloudflare Turnstile if

  • Your only problem is scripted bots flooding a form
  • You want a free check with unlimited volume
  • You're already on Cloudflare and want it in the same dashboard

Turnstile is free, so keep it in front for bots if you like and let Doorman read what gets past it.

Switch in two minutes

  1. Hosted form change the form's action to your Doorman URL and remove the Cloudflare Turnstile script and widget.
  2. From your server replace the Cloudflare Turnstile verify call with one doorman.check call; act on deliver, hold or drop.
  3. Or ask your agent copy one prompt into Claude Code, Codex or Cursor and it does the swap.
  4. Start safely watch mode delivers what it would have dropped, tagged, until you switch it to enforce.

Read the docs

Before → afterhtml
<!-- before: a Cloudflare Turnstile script and widget -->
<form action="/contact" method="POST"> … <div class="cloudflare-turnstile-widget"></div>

<!-- after: no script, no widget -->
<form action="https://withdoorman.com/f/f_yourForm" method="POST"> …

Checked, not guessed.

Every decision comes from Doorman's models reading the submission, in milliseconds, with the reason attached.

13/13
agency and SEO pitches dropped in our labelled set; a bot check passes all of them
0
genuine enquiries dropped; the unsure ones were held for you
~100 ms
to judge a submission, invisible to the visitor

Labelled test set: 104 invented but labelled contact-form and checkout submissions, judged live; latency is the median of those checks. Questions were not tuned to the set.

Questions

Should I remove Turnstile?

You don't have to. Turnstile filters automated traffic for free; Doorman reads the messages that get through it. Many sites run both.

Does Doorman need Cloudflare?

No. It works with any host or stack: a form action URL or one API call.

What does it cost at volume?

Pro is $29 a month for 5,000 submissions and Business is $79 for 50,000. Every plan gets the same models.

How much does it cost?

Free for 100 submissions a month. Pro is $29 a month for 5,000 and Business is $79 a month for 50,000, and every account starts with 14 days of Pro. Until November 30, the first 100 paying customers get Pro at $19 and Business at $59, kept for as long as they stay. See pricing.

Try it on your own forms.

Start with 14 days of Pro, free. Turn on watch mode to see every call before you trust it.

Start free Try the live demo