Stop form spam with Cloudflare Turnstile
Your inbox gets inquiries from customers again instead of spam. And your customers don't have to click on traffic lights for it, not even on their phones.
Works with your form on
Signs your form needs better protection
I hear this from almost every company with a contact form.
Every morning you delete inquiries in foreign scripts, full of links and ads.
A real customer inquiry got lost among the spam.
Customers give up because the picture puzzle doesn't work on their phone.
Your data protection officer has concerns about Google reCAPTCHA.
Your inbox gets real inquiries again
Turnstile checks in the background whether a real browser fills in the form. To make it hold, I set up four things.
I also check every submission on the server. A bot that skips the form and posts directly can't get through. Without this check, Cloudflare says, Turnstile protects nothing.
- Submission with valid tickdelivered
- Posted directly, no formrejected
- Old tick reusedrejected
More that Cloudflare handles for your website
It all runs in the same Cloudflare account. Whatever you set up today can be extended later.
- ViewCloudflare ZarazTracking through your own domain, only after consent.
- ViewDDoS protectionYour website stays online during overload attacks.
- ViewCloudflare WAFAttacks and password guessing stay away from your server.
- ViewCloudflare and GDPREvery document your data protection officer asks for.
- ViewCloudflare WorkersSmall jobs run at Cloudflare, without a server.
What Turnstile alone doesn't stop
Spam people type by hand
Turnstile detects bots. Someone who sits down and fills in your form themselves gets through. Required fields and inbox filters help with that.
Bots attack the whole website
Then protecting one form isn't enough. For that I set up Cloudflare's firewall, which checks every request before it reaches your website.
I'll tell you in a free intro call what your forms need.
How the setup works
At the end we send a test inquiry together.
- 01Intro callIn 30 minutes we look at your forms and how much spam arrives right now.
- 02Fixed-price quoteYou get in writing which forms I protect and when it's done.
- 03Setup and testI add Turnstile, set up the server-side check and send test inquiries until everything arrives and no bot gets through.
Fixed price after the intro call
Turnstile itself is free. You only pay for the setup in your forms, at a fixed price.
Questions about Cloudflare Turnstile
Christian Schmitt answersTurnstile is Cloudflare's spam protection for forms. It checks in the background whether a person or a bot is filling in the form. Most visitors only see a quick tick and solve no picture puzzle.
Christian Schmitt answersYes, Turnstile is free. You only need a Cloudflare account. The only cost is the setup in your form.
Christian Schmitt answersTurnstile can be used in a privacy-compliant way but needs an entry in your privacy policy. According to Cloudflare it only processes what bot detection needs, such as IP address and browser details, and doesn't read form entries. The sign-off comes from your data protection officer.
Christian Schmitt answersYes. Turnstile does the same job, but your visitors don't have to click on traffic lights or crossings. I swap reCAPTCHA out of your form and check that all inquiries keep arriving.
Christian Schmitt answersNo. Turnstile works on any website, even one that doesn't run through Cloudflare. Adjusting the form and the server-side check is enough.
Christian Schmitt answersYes. There are WordPress plugins that add Turnstile to contact forms, login and comments. I set them up and check that inquiries keep arriving.
Christian Schmitt answersThen it shows a box to tick instead of blocking them. Turnstile also meets WCAG 2.2 AA, so people with screen readers get through too.
