CLOUDFLARE / TURNSTILE
Turnstile
Creator & Lead Developer
Keeping the human experience at the center of bot management. A privacy-preserving CAPTCHA alternative that helps prevent abuse without visual puzzles.
Explore TurnstilePrincipal Systems Engineer · Cloudflare
Humans. Bots.
AI agents.
One evolving web.
I am the creator and lead developer of Turnstile and Precursor at Cloudflare, working at the intersection of browser-based bot detection and AI. I’m interested in what comes next as AI agents become part of everyday life on the web.
AREAS OF FOCUS
AI & agents / Bot management / Trust on the web
01 / Selected work
Trust on an evolving web.
How can we understand automated behavior and prevent abuse while keeping the web accessible to people?
CLOUDFLARE / PRECURSOR
Precursor
Creator & Lead Developer
Understanding behavior beyond a single request. Continuous client-side signals help identify sophisticated automation, including agentic interactions.
Introducing Precursor02 / Writing
From CAPTCHA to AI agents.
Articles I’ve co-authored on the Cloudflare Blog, tracing the path from CAPTCHA alternatives to behavioral signals and agentic activity.
Introducing Precursor
Detecting agentic behavior with continuous client-side signals.
Introducing Ephemeral IDs
A new tool for fraud detection, beyond IP addresses.
Turnstile meets the Cloudflare WAF
Using Pre-Clearance to protect browser fetch requests.
Cloudflare is free of CAPTCHAs
Turnstile becomes generally available and free for everyone.
Announcing Turnstile
A user-friendly, privacy-preserving alternative to CAPTCHA.
The end of the road for CAPTCHAs
Moving beyond visual puzzles with Managed Challenge.
03 / Background
Understanding the web.
Questioning what comes next.
I joined Cloudflare in 2018, after working in research on hybrid systems, network architectures and HTTP/2. Today, I'm a Principal Systems Engineer working on browser-based bot detection.
Before Cloudflare, I worked with the Theory of Hybrid Systems group and the Communication and Distributed Systems group at RWTH Aachen. My master's thesis explored the performance of HTTP/2 Server Push.
Today, my curiosity extends to the future of AI and its overlap with bot management. How do we distinguish useful automation from abuse? What should trust look like when software acts on our behalf? These questions connect my interests in security, privacy, internet protocols and distributed systems.
More on LinkedIn04 / Research
Publications & ideas.
Tara Whalen, Thibault Meunier, Mrudula Kodali, Alex Davidson, Marwan Fayed, Armando Faz-Hernández, Watson Ladd, Deepak Maram, Nick Sullivan, Benedikt Christoph Wolters, Maxime Guerreiro, Andrew Galloni:
Let The Right One In: Attestation as a Usable CAPTCHA Alternative.
Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)
Let The Right One In: Attestation as a Usable CAPTCHA Alternative.
Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)
Martin Henze, Benedikt Wolters, Roman Matzutt, Torsten Zimmermann, Klaus Wehrle:
Distributed Configuration, Authorization and Management in the Cloud-based Internet of Things.
16th IEEE International Conference on Trust, Security and Privacy in Computing and Communications
Distributed Configuration, Authorization and Management in the Cloud-based Internet of Things.
16th IEEE International Conference on Trust, Security and Privacy in Computing and Communications
Torsten Zimmermann, Benedikt Wolters, Klaus Wehrle, Oliver Hohlfeld:
Is the Web ready for HTTP/2 Server Push?
14th International Conference on emerging Networking EXperiments and Technologies (ACM CoNEXT '18)
Is the Web ready for HTTP/2 Server Push?
14th International Conference on emerging Networking EXperiments and Technologies (ACM CoNEXT '18)
More publications +
Torsten Zimmermann, Benedikt Wolters, Oliver Hohlfeld:
A QoE Perspective on HTTP/2 Server Push.
ACM SIGCOMM 2017 Workshop on QoE-based Analysis and Management of Data Communication Networks (Internet-QoE 2017)
A QoE Perspective on HTTP/2 Server Push.
ACM SIGCOMM 2017 Workshop on QoE-based Analysis and Management of Data Communication Networks (Internet-QoE 2017)
Torsten Zimmermann, Jan Rüth, Benedikt Wolters, Oliver Hohlfeld:
How HTTP/2 Pushes the Web: An Empirical Study of HTTP/2 Server Push.
IFIP NETWORKING'17
How HTTP/2 Pushes the Web: An Empirical Study of HTTP/2 Server Push.
IFIP NETWORKING'17
Johanna Nellen, Kai Driessen, Martin R. Neuhäußer, Erika Ábrahám, Benedikt Wolters:
Two CEGAR-Based Approaches for the Safety Verification of PLC-Controlled Plants.
Information Systems Frontiers 2016: 1-26
Two CEGAR-Based Approaches for the Safety Verification of PLC-Controlled Plants.
Information Systems Frontiers 2016: 1-26
Sascha Geulen, Martina Josevski, Johanna Nellen, Janosch Fuchs, Lukas Netz, Benedikt Wolters, Dirk Abel, Erika Ábrahám, Walter Unger:
Learning-based control strategies for hybrid electric vehicles.
CCA 2015: 1722-1728
Learning-based control strategies for hybrid electric vehicles.
CCA 2015: 1722-1728
Johanna Nellen, Benedikt Wolters, Lukas Netz, Sascha Geulen, Erika Ábrahám:
A Genetic Algorithm based Control Strategy for the Energy Management Problem in PHEVs.
GCAI 2015: 196-214
A Genetic Algorithm based Control Strategy for the Energy Management Problem in PHEVs.
GCAI 2015: 196-214
Johanna Nellen, Erika Ábrahám, Benedikt Wolters:
A CEGAR Tool for the Reachability Analysis of PLC-Controlled Plants Using Hybrid Automata.
Formalisms for Reuse and Systems Integration 2015: 55-78
ResearchGate ↗A CEGAR Tool for the Reachability Analysis of PLC-Controlled Plants Using Hybrid Automata.
Formalisms for Reuse and Systems Integration 2015: 55-78
Patent +
Benedikt Wolters, David Kitchen, Alex Cruz Farmer, Andrew Galloni:
Transparent inspection of responses from origin servers to identify protected data
US Patent No 10733307 (August 2020)
Transparent inspection of responses from origin servers to identify protected data
US Patent No 10733307 (August 2020)
Awards & certifications +
- Master Thesis Award 2018, Fachgruppe Kommunikation und Verteilte Systeme (KuVS), Gesellschaft für Informatik e.V.
- 1st Place it-talents.de Code Competition December 2018
- Best Thesis Award 2017, Verein zur Förderung von Forschung und Lehre im Bereich Kommunikation und Verteilte Systeme (FOLKS e.V.)
- 1st Place it-talents.de Code Competition October 2017
- 3rd Place it-talents.de Code Competition February 2017
- Univention Absolventenpreis (Bachelor Thesis Award) 2016
- Google Security Hall of Fame 2011 / Google Vulnerability Reward Recipient
- Certified Scrum Master (Scrum Alliance)
- Certified Software Tester (ISTQB)
University projects & theses +
- Master Thesis (2018): Demystifying the Performance of HTTP/2 Server Push
- Aachen 2025: Organ Challenge C++ Kinect Game, Demo [German]
- Medicine Project Thesis (2016): Robust Patient Pseudonym Extraction during Automatic Calibration in Low-Cost Photogrammetry
- Research Focus Class (2015): Privacy under Attack – Online Crowdinvestments: Divestment of Privacy?
- Seminar Paper (2015): Structure-Based Comparison of Biomolecules, Seminar on Bioinformatics Algorithms
- Seminar Paper (2014): Connecting the IoT: Opportunities for Using SDN and NFV to Realize Flexible LTE Network Architectures
- Bachelor Thesis (2014): Distributed Authorization Management for Secure Sensor Data in the Cloud
- Seminar Paper (2013): Bringing Healthcare to the Cloud: Security and Privacy Challenges
- Proseminar (2011): The PageRank Algorithm
05 / Elsewhere
Experiments & open source.
GeneiAL
C++ Genetic Algorithm Library – I am the maintainer of this open-source library for evolutionary algorithms.
netray.io
Internet-wide HTTP/2 measurements – Involved in large-scale measurements of HTTP/2 adoption across the web.
Nine Men's Morris
Challenge my AI-powered Nine men's morris game engines.
TSP-Solver
Traveling Salesman Problem solver – A challenge implementation for optimization problems.