# Cloudflare Turnstile captcha

> Add Cloudflare Turnstile, a privacy-friendly captcha that most visitors never have to click. Formclick verifies every token.

Source: https://docs.formclick.io/html-forms/turnstile

> **Starter, Pro and Business plans:** Turnstile is a paid Formclick feature. Turnstile itself is free; you need a Cloudflare account to create a widget.

Turnstile checks visitors in the background and rarely asks them to do anything. Like reCAPTCHA, the token is sent with the form and Formclick verifies it with Cloudflare before saving. It doesn’t use cookies for tracking, which makes it a good fit for privacy-conscious sites.

## 1. Create a widget

1. In the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/turnstile), open **Turnstile** and add a widget.
2. Add your website’s domain (and `localhost` for local testing).
3. Choose the **Managed** widget mode (recommended).
4. Copy the **site key** and **secret key**.

## 2. Turn it on in Formclick

Open your form → **Settings → Security**, choose **Cloudflare Turnstile**, paste both keys and save. The secret key is stored encrypted and never shown again.

> **Warning:** Once saved, submissions without a valid Turnstile token are rejected. Add the widget to your form before saving.

## 3. Add it to your form

```html title="contact.html"
<form action="https://api.formclick.io/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <!-- The widget. Cloudflare adds the token to the form for you. -->
  <div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

  <button type="submit">Send</button>
</form>

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<!-- Handles submit, file upload, loading state and success/error messages. -->
<script src="https://cdn.formclick.io/formclick.min.js"></script>
```

The widget adds a hidden `cf-turnstile-response` field to your form. It works with plain HTML forms and with `formclick.min.js`, which also resets the widget after each attempt so visitors can retry.

## Testing

Cloudflare provides [test keys](https://developers.cloudflare.com/turnstile/troubleshooting/testing/): the site key `1x00000000000000000000AA` with the secret `1x0000000000000000000000000000000AA` always passes, so you can try your form before using real keys. Switch to your own keys before going live.

## If your plan changes

Turnstile is checked only while your plan includes captcha. On the Free plan Formclick stops checking tokens so your form keeps working; upgrade again and the saved settings apply straight away.

## Errors

| Situation | Message |
| --- | --- |
| Widget not completed | “Please complete the captcha.” |
| Token invalid, expired or already used | `400` “Captcha verification failed. Please try again.” |
| Cloudflare couldn’t be reached | `503` “We couldn’t verify the captcha. Please try again.” |

Using `fetch`? Send the token as `cf-turnstile-response`, e.g. from `turnstile.getResponse()`.