“What do Cloudflare Turnstile error codes mean?”

What do Cloudflare Turnstile error codes mean?

Updated October 18, 2026By the CaptchaKit team

Short answer

Turnstile client errors starting with 110 usually point to configuration. 110200 means the domain is not authorized, so add it in Hostname Management. 200500 means the Turnstile iframe could not load, often because challenges.cloudflare.com is blocked. On the server, timeout-or-duplicate means the token expired or was already used.

Side by side

Turnstile codes covered on this page, from Cloudflare's documentation.

Turnstile codes covered on this page, from Cloudflare's documentation.
Code	Where	Meaning
110100	Browser	Invalid sitekey. Verify the sitekey in the Cloudflare dashboard.
110110	Browser	Sitekey not found. Check the sitekey's spelling and its dashboard configuration.
110200	Browser	Domain not authorized. Add it in Hostname Management.
110600	Browser	The challenge timed out. The visitor's clock may be wrong, or the challenge took too long.
110620	Browser	Interaction timed out. The visitor did not interact in time. Reset the widget with turnstile.reset().
200100	Browser	Clock or cache problem. The visitor's clock is wrong, or an intermediary cached the challenge.
200500	Browser	The iframe could not load. Check whether challenges.cloudflare.com is blocked.
300*	Browser	Generic challenge failure. Bot behavior was detected. Follow the troubleshooting steps.
400020	Browser	Invalid sitekey. Verify the sitekey in the Cloudflare dashboard.
400021	Browser	Sitekey domain mismatch. The sitekey's region does not match the domain in the Turnstile script tag.
400070	Browser	Sitekey disabled. Check the Cloudflare dashboard.
600*	Browser	Generic challenge failure. Bot behavior was detected. Follow the troubleshooting steps.
invalid-input-response	siteverify	The token is invalid, malformed or expired. Ask the visitor to retry.
timeout-or-duplicate	siteverify	The token expired or was already validated.

How to read a Turnstile error code

Cloudflare says the first three digits of a client error code identify the error family, such as configuration, network or challenge failure, and the remaining digits identify the specific error. Where the docs mark a code with an asterisk, the trailing digits vary and are for internal use.

Client errors show up in the widget or in your error callback. Server errors come back from the Siteverify API when your backend checks the token. They are separate lists.

Client errors you can fix

110200 is a configuration error. The page's domain is not on the widget's hostname list. Add it under Hostname Management for that widget. Cloudflare marks it as not retryable, so retrying will not help until the list changes.

200500 means the Turnstile iframe could not load. Cloudflare's advice is to check whether challenges.cloudflare.com is blocked, for example by a content blocker, a network filter or your own Content Security Policy. It is marked retryable.

110600 means the challenge timed out. Cloudflare says the visitor's clock may be wrong or the challenge took too long, and marks it retryable. 110620 means the visitor did not interact in time. Cloudflare's fix is to reset the widget with turnstile.reset(). 200100 is a clock or cache problem: the visitor's clock is wrong, or an intermediary cached the challenge. It is marked not retryable.

Sitekey errors are configuration errors and none is retryable. 110100 and 400020 are an invalid sitekey, so verify it in the Cloudflare dashboard. 110110 is a sitekey that was not found, so check the spelling and the dashboard configuration. 400021 is a sitekey domain mismatch: the sitekey's region does not match the domain in the Turnstile script tag. 400070 means the sitekey is disabled.

The 300 and 600 families

Codes starting with 300 and 600 are listed as families, written 300* and 600*. Cloudflare describes both as a generic challenge failure where bot behavior was detected, and marks them retryable. The remaining digits vary and are for internal use, so there is no per-code fix.

Cloudflare's troubleshooting steps for these are: use a browser Turnstile supports (all major browsers except Internet Explorer), disable extensions such as ad blockers, enable JavaScript, try a private window, test another browser or device, disable VPNs or proxies, and switch to a different network.

Cloudflare also notes that a 401 Unauthorized message in the browser console during a security check is usually expected, often tied to Private Access Token support. If the widget resolves and returns a token, no action is needed.

Server-side validation errors

A Turnstile token expires 300 seconds after it is issued and can be validated only once. A late or repeated submission returns success false, and Cloudflare documents the error as timeout-or-duplicate. Its error table also lists invalid-input-response for tokens that are invalid, malformed or expired, so handle both the same way: ask the visitor to complete the challenge again.

The table also lists missing-input-response (no token was sent), invalid-input-secret (the secret key is wrong), bad-request and internal-error. Cloudflare's advice for internal-error is to retry.

Fixes by cause

When the error is on a visitor's side and the cause is unclear, Cloudflare suggests disabling browser extensions, trying a private window, avoiding VPNs and proxies, and switching networks. If it persists, report the error code and the Ray ID to the site owner, or use the widget's Submit Feedback option.

As a site owner you can call turnstile.reset() inside the error callback to retry. Keep the hostname list current for every domain and staging site that renders the widget.

If it keeps failing

Some sites decide to try a different CAPTCHA after repeated errors. That is a reasonable choice and not a criticism of Turnstile, which solves a lot of sites without trouble. CaptchaKit vs Cloudflare Turnstile compares the two on cost, cookies and experience, and reCAPTCHA alternatives puts both next to other options.

Questions

What does error 110200 mean?

The domain is not authorized for that widget. Add the current domain in Hostname Management in the Cloudflare dashboard.

Why is Turnstile stuck or not loading?

Error 200500 means the iframe failed to load. Check whether challenges.cloudflare.com is blocked by an extension, a network filter or your Content Security Policy.

What does timeout-or-duplicate mean?

On the server it means the token expired or was already validated. Tokens last 300 seconds and work once.

How long is a Turnstile token valid?

300 seconds, and each token can be validated only once, according to Cloudflare's docs.

Do ad blockers break Turnstile?

Anything that blocks challenges.cloudflare.com can stop the iframe from loading, which Cloudflare lists as error 200500.

What do the 300 and 600 error families mean?

Cloudflare lists 300* and 600* as generic challenge failures where bot behavior was detected. Both are retryable, and the remaining digits are for internal use.

How do I retry after an error?

Call turnstile.reset() in the error callback to run the challenge again.

Is there a Turnstile alternative?

Yes, several. See reCAPTCHA alternatives for a sourced list.