Is Cloudflare Turnstile Effective?

Cloudflare turnstile is great and simple to use/integrate, but I’m curious on how a managed Cloudflare Turnstile Captcha can truly help mitigate bot activity on a website. If an interactive challenge (puzzle) is never presented, can’t a malicious user/bot simply just invoke a click on the checkbox of the Captcha when it is presented?

Traditional Captchas sometimes challenge users to solve certain puzzles, but for the while that I’ve tested turnstile, I’ve never been provided by an interactive puzzle other then occasionally ticking the ‘Verify You are a Human’ box, nor have I seen any documentation on any other interactive challenge simply besides that.

I believe that’s part of the design of Turnstile. Instead of having the visitor solve a puzzle, a number of browser challenges are performed to determine if the visitor is an actual human or not. I don’t know the details of those challenges, but you can read more about them here: