What the check is for
Cloudflare Turnstile, a CAPTCHA alternative, helps websites distinguish ordinary visitors from automated bots. It usually runs checks in the browser without asking you to solve a visual puzzle. A bot can send a form submission straight to the website server without opening the page or clicking its buttons. That is why a tick on the page is not enough to protect a form.
Verify before sending
After its checks, Turnstile gives the browser a temporary token: a short piece of data sent with the form. The website server must ask Cloudflare whether that token is valid before accepting the submission. This check is called server-side validation. Tokens expire after five minutes and can only be used once. Cloudflare also recommends checking the website address and the form action recorded with the token, so it is used on the intended website and for the intended task. A valid token is a security signal, not proof of who the visitor is.
SIGNAL also limits submissions
SIGNAL combines Turnstile with limits on how often a form can be submitted and how much data it can send. Its newsletter form also asks for explicit consent. If verification is unavailable, SIGNAL rejects the submission rather than accepting it without the check. This is SIGNAL's chosen security posture: it helps prevent unchecked bot submissions, but can also block legitimate visitors during an outage.