Configuring Cloudflare Turnstile

Cloudflare Turnstile is our recommended Captcha provider. It is a free, privacy-friendly alternative to CAPTCHA that automatically verifies visitors.

Unlike traditional challenges that ask users to "identify crosswalks," Turnstile runs smart background checks. In most cases, it is completely invisible or requires only a single click.

Step 1: Get Your Keys

  1. Log in to the Cloudflare Dashboard.
  2. Navigate to Turnstile in the sidebar.
  3. Click Add Site.
  4. Site Name: Enter a friendly name (e.g., "Flux Forms").
  5. Domain: Enter the domains where you will host the form (e.g., mysite.com).
    • Tip: Add localhost or 127.0.0.1 to the list if you plan to test the form on your local machine.
  6. Widget Mode:
    • Managed (Recommended): Cloudflare decides when to show a challenge.
    • Non-interactive: Runs purely in the background. If it fails, the user cannot submit.
    • Invisible: The widget is hidden, but a challenge may appear if needed.
  7. Click Create.
  8. Copy the Site Key and Secret Key.

Step 2: Configure Flux

Now, store these keys securely in your Flux server.

  1. SSH into your Flux instance:
    ssh -p 2222 admin@<your-ip>
  2. Navigate to Infrastructure -> Captcha (or "Manage Captchas").
  3. Press n to create a new configuration.
  4. Provider Name: Give it a unique ID (e.g., cf-turnstile-main).
  5. Type: Select Cloudflare Turnstile from the list.
  6. Site Key: Paste the Site Key you copied from Cloudflare.
  7. Secret Key: Paste the Secret Key.
  8. Select Save (or press Enter) to confirm.

Step 3: Attach to a Form

Finally, link this configuration to the specific form you want to protect.

  1. Go back to the Dashboard and select Forms (or "Manage Forms").
  2. Select the form you want to protect.
  3. Select Edit Metadata.
  4. In the Captcha dropdown, select your new provider (e.g., cf-turnstile-main).
  5. Select Save & Exit.

Success!
Your form is now protected. Flux will automatically inject the necessary scripts and render the Turnstile widget (or run it invisibly) whenever the form is loaded.