Cloudflare Turnstile offers a user-friendly, privacy-focused alternative to traditional CAPTCHAs. Unlike reCAPTCHA, Turnstile never shows visual puzzles or image challenges. It runs silently in the background, validating users through non-intrusive browser challenges that don't track users across the web. FormsList's Turnstile integration gives you the best of both worlds: powerful bot detection without sacrificing user experience or privacy. Turnstile is GDPR-friendly and doesn't use cookies for tracking, making it ideal for European websites and privacy-conscious projects. Setup is straightforward. Get your Turnstile site key and secret key from the Cloudflare dashboard, add the Turnstile widget to your form, and configure the secret key in FormsList. Every submission is validated server-side, ensuring bots can't bypass the protection.
By Vaibhav Jain · Last updated March 27, 2026
Log into your Cloudflare dashboard, go to Turnstile, and create a new site widget. Copy the site key and secret key.
Add the Cloudflare Turnstile script and widget div to your form HTML. The widget renders as an invisible or managed challenge.
In the FormsList dashboard, go to Spam Protection settings for your form. Enable Cloudflare Turnstile and enter your secret key.
Submit a test form entry to verify Turnstile is working. Check the FormsList dashboard to confirm the submission passed validation.
Turnstile never shows image puzzles or checkboxes. It validates users silently using browser-based challenges. It also doesn't use tracking cookies, making it more privacy-friendly than reCAPTCHA. Cloudflare Turnstile is free with no assessment limits.
Yes, you need a free Cloudflare account to generate Turnstile keys. However, your website does not need to use Cloudflare's CDN or DNS. You only need the account for the Turnstile widget keys.
You should use one CAPTCHA solution per form. We recommend choosing either Turnstile or reCAPTCHA. Turnstile is the better choice if privacy and user experience are priorities. Both work with FormsList's honeypot field for layered protection.
200 free submissions a month and a live endpoint in 30 seconds. No server, no credit card, just point your form at it.