Cloudflare Turnstile is a free, privacy focused alternative to traditional CAPTCHAs. Adding it to your Helpdesky contact form protects you from spam bots while keeping the experience smooth for real visitors. The setup takes about five minutes and requires a free Cloudflare account.
Without Turnstile enabled, your contact form has no bot protection. We strongly recommend setting it up before embedding the form on your website.
Create a Cloudflare Account
If you don't already have a Cloudflare account, create one at cloudflare.com. Turnstile is completely free, even on the free plan, with no usage limits. You do not need to move your domain's DNS to Cloudflare to use Turnstile.
Create a Turnstile Widget
Once you are logged in to Cloudflare, navigate to the Turnstile section in the left sidebar. You can also go directly to dash.cloudflare.com/turnstile.
Click Add widget and fill in the following:
- Widget name: Give it a recognizable name, such as "Contact Form" or your website name.
- Domains: Add the domain where your contact form is embedded (for example,
yoursite.com). You can add multiple domains if the form appears on more than one site. - Widget mode: Choose Managed for the best balance of security and user experience. Cloudflare will decide whether to show a challenge based on the visitor's behavior.
Click Create to finish.
Copy Your Site Key and Secret Key
After creating the widget, Cloudflare will show you two keys:
- Site Key (public): This is embedded in your form and sent to the visitor's browser. It starts with
0x4AAAAAAA. - Secret Key (private): This is used on the server side to verify the visitor's response. Keep this key confidential.
Copy both keys. You will paste them into Helpdesky in the next step.
Add the Keys to Your Helpdesky Dashboard
Open your Helpdesky dashboard and go to Contact Form in the sidebar.
Scroll down to the Cloudflare Turnstile section. You will see two fields:
- Site Key: Paste the public site key from Cloudflare.
- Secret Key: Paste the private secret key from Cloudflare.
Click Save at the top of the page. Your contact form will now require Turnstile verification before a message can be submitted.
Test the Integration
Open your website where the contact form is embedded and submit a test message. You should see the Turnstile widget appear near the submit button. It usually verifies the visitor automatically in about a second. In some cases, a brief interactive challenge may appear.
If the widget does not appear, double check the following:
- The domain in your Turnstile widget settings matches the domain where the form is embedded.
- Both the site key and secret key are pasted correctly with no extra spaces.
- You have saved the settings in the Helpdesky dashboard.
If you have not yet set up your contact form, follow the Contact Form Setup Guide first.
What Happens When Turnstile Blocks a Submission
When Turnstile determines that a visitor is likely a bot, the form will not submit and the visitor will see a verification challenge. Legitimate visitors will pass automatically in most cases. Messages that fail verification are never delivered to your inbox, so you will not need to sort through spam manually.
Turnstile runs entirely on Cloudflare's infrastructure and does not slow down your page. It also does not track visitors or use cookies for advertising, making it a good choice if you care about privacy compliance.