Docs/Cloudflare Turnstile
Cloudflare Turnstile
Cloudflare Turnstile provides smart, privacy-preserving CAPTCHA protection against bots and form spam without visual puzzles.
What your site can do with Cloudflare Turnstile
- Block automated spam bots from submitting forms without frustrating human puzzles
- Invisible or smart challenge modes that preserve visitor privacy
- Server-side token verification via Codunk Secure Gateway
Common use cases
| Example app | Example prompt | What happens |
|---|---|---|
| Spam protection | Use Turnstile to protect my contact form from bot spam. | Bots are silently blocked while genuine visitors pass without puzzles. |
| Lead form safeguard | Add smart bot verification to lead forms without CAPTCHA images. | Ensures only authentic leads trigger notifications and CRM syncs. |
Prerequisites
- A Cloudflare account
- A Turnstile Sitekey (public) and Secret Key (starts with 0x4... or 1x...)
Set up Cloudflare Turnstile
- In the Cloudflare dashboard, navigate to Turnstile → Add widget.
- Set your domain (or localhost for testing) and select Managed or Non-interactive.
- Copy both the Site Key and Secret Key.
- In the Studio, open Connectors → Cloudflare Turnstile, paste both keys, and republish.
Limitations
- Turnstile verifies tokens on submission; without the Secret Key configured, server-side validation is bypassed.
- Requires modern browser support for cryptographic web primitives.