Cloudflare Turnstile captcha

Turnstile checks visitors in the background and rarely asks them to do anything. Like reCAPTCHA, the token is sent with the form and Formclick verifies it with Cloudflare before saving. It doesn’t use cookies for tracking, which makes it a good fit for privacy-conscious sites.

1. Create a widget

1. In the Cloudflare dashboard, open Turnstile and add a widget.
2. Add your website’s domain (and localhost for local testing).
3. Choose the Managed widget mode (recommended).
4. Copy the site key and secret key.

2. Turn it on in Formclick

Open your form → Settings → Security, choose Cloudflare Turnstile, paste both keys and save. The secret key is stored encrypted and never shown again.

3. Add it to your form

<form action="https://api.formclick.io/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <!-- The widget. Cloudflare adds the token to the form for you. -->
  <div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

  <button type="submit">Send</button>
</form>

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<!-- Handles submit, file upload, loading state and success/error messages. -->
<script src="https://cdn.formclick.io/formclick.min.js"></script>

The widget adds a hidden cf-turnstile-response field to your form. It works with plain HTML forms and with formclick.min.js, which also resets the widget after each attempt so visitors can retry.

Testing

Cloudflare provides test keys: the site key 1x00000000000000000000AA with the secret 1x0000000000000000000000000000000AA always passes, so you can try your form before using real keys. Switch to your own keys before going live.

If your plan changes

Turnstile is checked only while your plan includes captcha. On the Free plan Formclick stops checking tokens so your form keeps working; upgrade again and the saved settings apply straight away.

Errors

Using fetch? Send the token as cf-turnstile-response, e.g. from turnstile.getResponse().