Low-friction, privacy-friendly captcha that blocks spam sign-ups.
- No puzzles for most of your visitors to solve
- Site key and secret key, nothing else to configure
- Layers on top of the always-on spam protection
What you can do with it
- Add a Cloudflare Turnstile check to the RSVP form and the booking page with one switch.
- Stop bots that get past the built-in checks, while most people pass without doing anything.
- Keep Google out of your forms: Turnstile sets no cookies.
- With HappenBoard Pro, protect the visitor event submission form and free ticket orders the same way.
How to set it up
- In your Cloudflare account, create a Turnstile widget for your domain and copy its site key and secret key.
- In WordPress, go to HappenBoard → Integrations and click Configure on the Cloudflare Turnstile card.
- Turn on Enable Turnstile on public forms.
- Paste the Site key and the Secret key, then click Save changes.
- Send your own form once and check that your name appears on the Attendees screen.
The spam protection guide explains the checks that run before Turnstile.
What you need
- A free Cloudflare account. Your site does not need to use Cloudflare for anything else.
- HappenBoard, the free plugin.
- An administrator account on your WordPress site.
Free and Pro
Turnstile is in the free plugin, like the built-in checks: a hidden trap field, a signed time stamp, rate limits and one sign-up per email address.
HappenBoard Pro extends the same protection to its event submission form and to orders of free tickets.
Good to know
- Turnstile is off until you turn it on, and both keys are required.
- If Cloudflare cannot be reached, the check is skipped rather than blocking the sign-up. The built-in checks still apply.
- The Turnstile script loads only on pages that show a form.
- Your site sends the visitor’s IP address to Cloudflare with each check: mention it in your privacy policy.
- The secret key is never shown again after saving. Type a new one only to replace it.
