0.11.26 — the anti-bot widget steps out of sight

The anti-bot widget accepts an “auto” theme, and that is its default. “Auto” sounds like “match the page” and means “match the visitor's system”. A reader whose phone was set to dark mode therefore got a black rectangle against a background that is paper-coloured throughout the engine — the one element on the page that did not know where it was standing.

Turnstile will not take a colour of your own: there are three themes and that is the whole choice. The light one won, because the engine has no dark version and none is coming. The light widget's background is #fafafa and the leading instance's paper is (250, 250, 248) — one step apart on one channel, invisible. It is the same trick as the quotation cards sitting on canvas for Instagram.

Painting the box the right colour solves the smaller of the two problems, though. Better not to put the box there at all. The widget now stands in the mode where it appears only once Cloudflare actually wants a click from the reader; for everyone else the token is produced in the background and arrives through the same callback as before. The account form has empty space below the address field instead of a foreign rectangle reporting a success nobody asked to see. When the widget does appear, it is light and takes the width of the column rather than a fixed three hundred pixels jutting out on a narrow screen.

None of this weakens the protection, because the widget's visibility was never the protection. The secret sits on the server, the token is still checked before every guarded action, and an instance with no site key still renders nothing and still refuses the comment. What changed is what a reader who is not a bot has to look at — which is, statistically, everyone this site is of any use to.