Custom Turnstile

Where do I turn it on?

Open your form, click Settings and scroll to Spam & Security. Set Custom CAPTCHA to Cloudflare Turnstile, then save your widget's secret key. Custom CAPTCHA is the label in the Formbold dashboard.

Use this when you want the Turnstile widget on your form, or when Automatic Turnstile would drop file uploads or break a fetch() or Ajax form. Custom Turnstile is available on all plans, including Free.

What do I need from Cloudflare?

In Cloudflare, go to Turnstile and click Add widget. Enter the domain of your form, pick a widget mode, and create it. Then copy the sitekey and the secret key.

Each widget has its own sitekey and secret key. The sitekey is public: it goes in your HTML to show the widget. The secret key is private: it goes only into Formbold, which uses it to validate the token with Cloudflare's Siteverify API.

Cloudflare offers three widget modes:

• Managed (recommended): Cloudflare decides whether the visitor needs to tick a checkbox, based on risk. There are no images or text to decipher.
• Non-Interactive: the visitor sees a widget with a loading spinner. The challenge runs without any click.
• Invisible: the challenge runs in the background, with no visible widget.

If you're not sure, choose Managed.

How do I set it up in Formbold?

1. In Formbold, set Custom CAPTCHA to Cloudflare Turnstile.
2. Paste the secret key and click Save & turn on.
3. Add the widget to your form, using your sitekey:

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<form action="https://formbold.com/s/FORM_ID" method="POST">
  <input type="email" name="email" required />
  <div class="cf-turnstile" data-sitekey="YOUR_SITEKEY"></div>
  <button type="submit">Send</button>
</form>

The widget must sit inside the <form> tag. When the visitor passes the challenge, Turnstile adds a token in a hidden field named cf-turnstile-response. That token goes to Formbold with the rest of the form. Formbold then checks it with Siteverify. You don't call Siteverify yourself.

The sitekey goes in your HTML. The secret key goes only into Formbold. Never put the secret key in your page.

Troubleshooting

• The widget isn't on the form, or it's outside the <form> tag.
• The secret key in Formbold belongs to a different widget than the sitekey on your page. Each widget has its own pair.
• The token expired, or the same token was sent twice. A Turnstile token is valid for five minutes and can be used only once.
• Your domain isn't in the widget's Hostnames list in Cloudflare.