Block bots with Turnstile
Turn on an invisible challenge that keeps automated signups off a form, no puzzles for real visitors.
Every form, embed or landing page, has a Protect with an invisible CAPTCHA setting that runs Cloudflare Turnstile against every submission. Find it in the Behavior card on an embedded form’s settings screen, or in Page settings on a landing page.
Turn it on
Tick Protect with an invisible CAPTCHA and save. There’s nothing else to configure. Most visitors never see anything: the check runs invisibly, and a submission completes only once it passes. If it fails, the visitor sees an inline message asking them to try again.
Not available on Plain HTML
Turnstile isn’t available on the Plain HTML embed variant (see Add a form to your website): a raw, unstyled HTML form can’t render the challenge widget. While Turnstile is on, that variant’s snippet is replaced with a note; turn Turnstile off, or use the JavaScript embed or hosted page instead.
When to use it
Turn it on if a form is attracting automated signups (junk addresses, garbage names) that get past the spam checks every form already runs. It’s a good match for a public, high-traffic form; for a low-traffic internal form it’s usually not worth it.