Cloudflare Turnstile

Cloudflare Turnstile is a CAPTCHA alternative you can use to protect your Siteglide forms from spam and bot submissions. It sits alongside hCaptcha and reCAPTCHA in each form's Spam Protection tab.

What is Turnstile for?

Spam bots submitting your forms can fill your CRM with junk, send unwanted workflow and autoresponder emails, and add to your site's usage. Turnstile checks that a real person is submitting the form before Siteglide accepts it.

Unlike traditional CAPTCHAs, most visitors never have to solve a puzzle. Turnstile runs lightweight checks in the background and usually passes genuine visitors with a single click on a checkbox, or none at all. Only suspicious traffic gets a harder challenge.

Turnstile is a good choice when you:

• want the least friction for genuine visitors;

• already use Cloudflare for the site's domain (it isn't required);

• prefer a privacy-focused option that doesn't rely on tracking cookies.

Before you start

You'll need:

• A free Cloudflare account.

• Access to Site Manager → Constants in your Siteglide Admin. If you can't see it, ask your agency admin for the Constants permission.

Step 1: Create a Turnstile widget in Cloudflare

1. Log in to the Cloudflare dashboard and open Turnstile.

2. Click Add widget.

3. Give the widget a name, e.g. your site's name.

4. Under Hostnames, add every domain the form will be used on, e.g. example.com, www.example.com, and your Siteglide staging domain if you test there. Turnstile will only work on the hostnames listed here.

5. Choose a widget mode. Managed is recommended.

6. Click Create.

Cloudflare will show you two keys:

• Site Key: public, used to display the widget on your pages.

• Secret Key: private, used by Siteglide to verify submissions. Never paste it into a page or layout.

Step 2: Add your keys as Siteglide constants

1. In Siteglide Admin, go to Site Manager → Constants.

2. Add a constant named CAPTCHA_DEFAULT_SITE_KEY with your Site Key as the value.

3. Add a constant named CAPTCHA_DEFAULT_SECRET with your Secret Key as the value.

4. Save.

The names must match exactly, including capitals. These constants are shared by every form on the site that uses Turnstile, so you only need to set them once.

Step 3: Turn on Turnstile for a form

1. Go to CMS → Forms and open Edit Form Structure for the form you want to protect.

2. Open the Spam Protection tab.

3. Select Turnstile.

4. Save the form.

The form's default layout is updated automatically to include the Turnstile widget next to the Submit button.

Custom form layouts

If your form uses a custom layout, add the Turnstile include inside the {% form %} tag, typically just before your submit button:

{% include 'turnstile' %} 

This outputs the Turnstile widget and a hidden field Siteglide uses to track the verification. Remove any old hCaptcha or reCAPTCHA code from the layout if you're switching from another option.

How it works

• When a visitor clicks Submit, Siteglide checks the Turnstile widget has been completed. If it hasn't, the widget is highlighted with the input-error class and the form isn't sent.

• On the server, Siteglide verifies the Turnstile response with Cloudflare before saving anything. Submissions that fail are rejected.

• A form submission can involve several steps behind the scenes, such as saving the CRM user, company, address and Custom Field Sets. After a successful check, Siteglide issues a short-lived token so those steps don't need a new Turnstile check. The token lasts 10 minutes and is tied to the visitor's session.

Troubleshooting

The widget doesn't appear.

• Check that CAPTCHA_DEFAULT_SITE_KEY is set in Constants and the name is spelled correctly. If it's missing, Siteglide adds an HTML comment explaining the problem where the widget should be. View the page source and search for modules/captchas.

• If your custom layout doesn't include {% include 'turnstile' %}, add it.

The widget shows an error such as "Invalid domain".

• Add the domain you're testing on, including any www. or staging domain, to the widget's Hostnames in Cloudflare.

Submissions fail even though the widget is completed.

• Check that CAPTCHA_DEFAULT_SECRET is set and matches the Secret Key of the same Cloudflare widget as the Site Key.

• Make sure the form's Spam Protection tab is set to Turnstile, and the layout doesn't still contain hCaptcha or reCAPTCHA code.