Cloudflare Turnstile
Cloudflare Turnstile is an advanced human-verification service designed to protect forms from spam and bots without requiring users to solve a challenge. Unlike traditional CAPTCHAs that present puzzles, Cloudflare instructs the browser to perform a series of checks that help confirm the visitor's legitimacy.
Cloudflare Turnstile API Keys
To obtain a set of API key pair consisting of a Site Key and a Secret Key from Cloudflare Turnstile,
- Log in to your Cloudflare Turnstile account.
- Register your site details.
- Enter a Widget Name.
- Under Hostname Management, select Add Hostnames to add a custom hostname or choose from an existing hostname based on your data center (DC) as given in the below table.
Domains to be included
Zoho Forms Domains
Custom Domain (Example)
EU
forms.zoho.eu
forms.zohopublic.eu
forms.zylker.eu
AU
forms.zoho.com.au
forms.zohopublic.com.au
forms.zylker.com.au
US
forms.zoho.com
forms.zohopublic.com
forms.zylker.com
IN
forms.zoho.in
forms.zohopublic.in
forms.zylker.in
CA
forms.zohocloud.ca
forms.zohopublic.ca
forms.zylker.ca
JP
forms.zoho.jp
forms.zohopublic.jp
forms.zylker.jp
CN
forms.zoho.com.cn
formscn.zohopublic.com.cn
forms.zylker.com.cn
- Choose the type of widget you want to use under Widget Mode and click Create to get the Site Key and Secret Key for your widget.
Note:
- Ensure the widget mode setting you choose in Cloudflare is consistent with the mode selected in your form for proper functioning.
- Refine from enabling pre-clearance as this feature is not supported in Zoho Forms as this time.
Widget Modes
Cloudflare Turnstile offers three distinct widget modes that allows you to control how a human verification check is presented to a user.
Managed mode
This is the default and recommended mode. In Managed Mode, Turnstile automatically chooses the most appropriate challenge to verify the user. It uses a non-interactive method and only presents an interactive challenge if the user's behaviour is suspicious. This mode provides the best user experience by minimizing friction for legitimate users while maintaining a high level of security.
Non-Interactive mode
In Non-Interactive mode users see a loading spinner while the system verifies the users in the background without disrupting the user. Unlike Managed Mode, this mode will not present an interactive challenge. This is ideal for users who want to avoid friction to their website and prioritize a seamless user experience.
Invisible mode
Invisible mode is similar to Non-Interactive mode where the users will never interact with Turnstile widget. The entire check is performed in the background where the users will not see a loading spinner or any visual indication that the verification is in progress. Invisible mode is ideal for users who want to prioritize both visitor and visual experience.
Configuring Cloudflare Turnstile Widgets in Forms
To use this in your form,
- Navigate to Settings > Spam Control > CAPTCHA
- Select Cloudflare Turnstile from the CAPTCHA type.
- Enter the Site Key and Secret Key provided by Cloudflare Turnstile for your selected widget mode.
- Select the required Language for your Cloudflare Turnstile. The option supported by Cloudflare Turnstile will be listed here.
- Select the desired Widget Mode.
- Under Action on Challenge Failure, select the fallback action you want to perform:
- Block Submission and provide a message for the block.
- Show Zoho Forms CAPTCHA for further verification. Configuring this by providing a CAPTCHA Label and CAPTCHA Description.