This page demonstrates why server-side verification is mandatory.
The attack: An attacker steals a valid Turnstile token from a real user (via XSS, MITM, or observation) and tries to reuse it to submit malicious content. Without siteverify, the attack works. With siteverify, the token is rejected on the second use.
Step 1: Legitimate submission (first use)
Step 2: Attacker replays the same token
After step 1 succeeds, the Worker cached the token. Clicking below simulates an attacker submitting the same stolen token again.