Any Hostname (Enterprise only)

Last updated Apr 16, 2026 The Any Hostname feature removes the requirement to specify hostnames during widget creation, allowing widgets to function on any domain.

By default, hostname validation is a security feature that prevents unauthorized use of your widgets. The Any Hostname entitlement removes this restriction, making the hostname field optional during widget creation.

When enabled, widgets can be created without the required hostname specification and used on any domain without pre-configuration. Hostname validation protection is also removed.

Implementation

To reduce security risks when using Any Hostname, monitor widget usage through Turnstile Analytics to identify unexpected patterns, implement server-side validation with hostname checking in your application code, and use action and cData parameters to track widget usage sources and identify where widgets are being deployed.

When using the Any Hostname feature, it is essential to implement additional validation in your server-side code to maintain security controls. Always validate the hostname field in Siteverify responses.

Example responsejs

async function validateTurnstileWithHostname(token, expectedHostnames = []) {
  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      secret: process.env.TURNSTILE_SECRET,
      response: token
    })
  });

  const result = await response.json();

  if (!result.success) {
    return { valid: false, error: 'Token validation failed' };
  }

  // Additional hostname validation when using Any Hostname
  if (expectedHostnames.length > 0 && !expectedHostnames.includes(result.hostname)) {
    return { 
      valid: false, 
      error: 'Hostname not in allowed list',
      hostname: result.hostname 
    };
  }

  return { valid: true, data: result };
}

You should regularly review Turnstile Analytics for unexpected usage patterns and monitor the hostname field in Siteverify responses. You can set up alerts for widget usage on unexpected domains.

Use action and cData parameters to track widget usage sources.

<!-- Widget with tracking information -->
<div class="cf-turnstile" 
     data-sitekey="your-site-key"
     data-action="customer-portal"
     data-cdata="tenant-123"></div>

Use cases

The Any Hostname feature is particularly valuable for customers with:

  • Large domain portfolios with many domains to manage individually.
  • Dynamic subdomain creation and frequently create subdomains or customer-specific domains.
  • Multi-tenant applications such as SaaS platforms serving multiple customer domains.
  • Development environments that test across various staging and development domains.

Was this helpful?

YesNo

On this page

Any Hostname (Enterprise only) - 图1Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/turnstile/additional-configuration/hostname-management/any-hostname/#page","headline":"Any Hostname (Enterprise only)","description":"Allow Turnstile widgets on any hostname with Enterprise plans.","url":"https://developers.cloudflare.com/turnstile/additional-configuration/hostname-management/any-hostname/","inLanguage":"en","image":"https://developers.cloudflare.com/turnstile/additional-configuration/hostname-management/any-hostname/og.png?v=86282bff9de4f843","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Configure Pre-clearance to reduce repeated challenges for visitors. title: Pre-clearance configuration image: https://developers.cloudflare.com/turnstile/additional-configuration/hostname-management/pre-clearance/og.png?v=8ef65bc2d3440357

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/turnstile/llms.txt
Use this file to discover all available pages before exploring further.