Automatic Turnstile

Where do I turn it on?

Open your form and go to the Settings tab. Under Spam & Security, set Automatic CAPTCHA to Cloudflare Turnstile. Automatic CAPTCHA is the label in the Formbold dashboard.

You don't add a widget to your site. This is available on all plans, including Free.

What happens after the visitor submits?

The form posts to your Formbold endpoint, then visitors see a short Almost there page, hosted by Formbold, with the Turnstile challenge. After they pass it, the submission goes through.

This works with regular HTML forms that post straight to your endpoint. For fetch() or Ajax forms, or forms with file uploads, use Custom Turnstile instead.

Why can Automatic Turnstile lose file uploads and break Ajax forms?

Because of that extra Almost there page. The challenge runs after submit, on a Formbold-hosted page, not as a widget on your form.

File uploads can go missing. The file is part of the original form post. It does not carry over to the Almost there page, so the submission can be saved without the file.

fetch() or Ajax can break. Your script posts to the endpoint and expects a JSON response. Instead it can receive the Almost there HTML page, or a redirect to it, so the script never gets the JSON it is written to read.

Custom Turnstile puts the widget on your form, so the visitor completes the challenge before the form is sent. The submission then goes straight to your endpoint, with the files and the response your script expects. See Custom Turnstile.