Cloudflare Turnstile

Prepare the provider

1. Register the exact development and production hostnames in the provider dashboard.
2. Copy the public site key into the page and store the verification secret only in the server environment.
3. Enable the matching provider in the form configuration and publish it.

Send the token with the request

Render the Cloudflare Turnstile widget, wait for a valid token, and include it with the same form submission. Tokens expire and should not be stored for later reuse.

Recover from verification failures

Show a clear retry action, request a new token, and distinguish a visitor error from provider downtime. Do not silently mark a failed challenge as successful.