Protect Your Forms with Cloudflare Turnstile

Any form on a public URL will eventually get hit by bots. Scrapers crawl the web looking for <form> tags, then blast them with automated POST requests — SEO junk, crypto spam, phishing bait, sometimes just noise from a misfiring script. If your form emails you or writes to a sheet, that garbage lands right where you work.

The instinct is to bolt a CAPTCHA onto everything. But CAPTCHAs are friction, and friction costs you real submissions. The better approach is a layered defense: cheap, invisible checks that stop the easy 95% of bots first, and a stronger challenge only where it's actually needed. Cloudflare Turnstile is that stronger challenge — a modern, low-friction CAPTCHA that, unlike reCAPTCHA, almost never makes a real visitor solve an image puzzle.

The layered model

Think of spam defense as a stack, from zero-friction to some-friction:

1. Honeypot — a hidden field a real person never sees. Naive bots fill every input they find, so a filled honeypot is a dead giveaway. Costs the visitor nothing.
2. Rate limiting and velocity scoring — server-side checks that catch floods, duplicate payloads, and suspicious submission speed. Also invisible.
3. Turnstile — a cryptographic proof-of-work challenge in the browser. The layer you add when a determined bot is getting past the first two.

Here's the part that saves you work: ShipMyForm runs the first two layers automatically, for free, on every form. Every submission passes through an invisible honeypot field (_gotcha) and server-side rate limiting plus duplicate and velocity spam scoring before it ever reaches your inbox or your connectors. You don't configure any of it.

That means most forms never need a CAPTCHA at all. If you want the honeypot-first approach in depth — including how to hide the field accessibly — start with how to stop contact form spam without reCAPTCHA. Turnstile is the next step up from there, for the forms that are actively targeted.

Why Turnstile over reCAPTCHA

Turnstile is Cloudflare's free CAPTCHA alternative. It runs a series of small challenges in the background and, in the vast majority of cases, decides you're human without asking you to do anything — or at most shows a single checkbox. No grids of crosswalks, no fading storefronts, no "select all the buses."

It's also privacy-friendly: it isn't built to profile users across the web the way an ad-funded CAPTCHA is. You use your own free Cloudflare keys, so there's no per-submission bill and nothing tying your form to a third party's tracking. For most sites that's a straight upgrade over reCAPTCHA on every axis that matters.

Setting up Turnstile with ShipMyForm

There are three moves: create the widget in Cloudflare, tell ShipMyForm your secret key, and add the widget to your HTML.

Step 1: create a Turnstile widget

Go to dash.cloudflare.com → Turnstile and create a widget for your domain. Cloudflare hands you two keys:

• a Site Key — public, meant to appear in your HTML.
• a Secret Key — private, used only server-side to verify challenges.

Keep the tab open; you'll need both in a moment.

Step 2: enable Turnstile on your form

In ShipMyForm, open your form and go to Settings. Enable Require Cloudflare Turnstile and paste your Secret Key into the field. It's stored encrypted, and from now on ShipMyForm will verify every submission's token against Cloudflare before accepting it.

Step 3: add the widget to your HTML

Two additions to your page. First, load the Turnstile script (once, anywhere on the page):

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Then drop the widget <div> inside your form, using your Site Key:

<form action="https://shipmyform.com/f/YOUR_FORM_ID" method="POST">
  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>

  <div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

  <button type="submit">Send</button>
</form>

That's the whole integration. The widget renders itself, runs its challenge, and injects a hidden field named cf-turnstile-response into the form containing a one-time token. When the form is submitted, that token rides along with the rest of the fields.

On ShipMyForm's side, the server takes the cf-turnstile-response token and verifies it with Cloudflare. If the token is missing or invalid, the submission is rejected before it's stored or forwarded. A scripted bot that POSTs straight to your endpoint has no valid token — it never obtained one from a real browser challenge — so it simply can't get through.

Honeypot vs Turnstile vs reCAPTCHA

Each layer trades friction for strength differently. Here's how they stack up:

The honeypot is free and frictionless but only catches unsophisticated bots. Turnstile catches the ones that fake a real submission, at almost no cost to your visitors. reCAPTCHA does a similar job but leans on visible puzzles and ties your form to Google.

When to turn it on

Don't reach for Turnstile by default. Add friction only when you have a problem to solve. Because ShipMyForm's honeypot and rate limiting already run on every form, the honest answer for most forms is: you don't need a CAPTCHA yet.

Turn Turnstile on when:

• spam is still landing in your dashboard despite the invisible defenses;
• a specific form is being actively, repeatedly targeted;
• the submissions are high-value enough that a single bot getting through is costly (signups, lead capture, anything that triggers billing or emails).

Until one of those is true, leave it off and keep the form frictionless. The layered model is the whole point: start with the invisible checks ShipMyForm gives you for free, and step up to Turnstile precisely when — and only when — the bots earn it.

Next steps

• Start with the free, invisible approach: stop form spam without reCAPTCHA.
• New here? See what a form backend actually is.
• Want clean submissions in your inbox? Send an HTML form to your email.
• Keep a spam-free log of everything: send submissions to Google Sheets.
• Start free — the honeypot and rate limiting are on every plan, with 100 submissions a month and no card required.