Appearance

Cloudflare Turnstile ​

Protect UpForm forms with Cloudflare Turnstile. UpForm supports Cloudflare Turnstile (Managed) and Cloudflare Turnstile (Non-interactive).

Turnstile checks visitors for bots without the classic “select all images” challenge. You create a widget in Cloudflare, add the keys in UpForm Settings, then enable Turnstile on each form you want to protect.

For Google reCAPTCHA Enterprise instead, see reCAPTCHA Enterprise.

Before you begin ​

You will need:

  • A Cloudflare account
  • Your Shopify store domain (for example, your-store.myshopify.com)

Cloudflare menus can change. If a path does not match exactly, search the dashboard for Turnstile.

Create a Turnstile widget in Cloudflare ​

  1. Sign in to the Cloudflare dashboard.
  2. Go to Application security → Turnstile.

Cloudflare Turnstile dashboard page

  1. Click Add widget.

Add Turnstile widget button

  1. Enter a Widget Name (for example, UpForm – Cloudflare Turnstile).
  2. Under hostname management, click Add Hostname, enter your Shopify domain (for example, store-name.myshopify.com), then add it. When the domain appears under Selected hostnames, continue.

Turnstile widget name and hostnameSelected hostnames for Turnstile widget

  1. Choose a Widget Mode:
    • Managed — Cloudflare decides when to show a challenge. Real visitors may see little or nothing; suspicious traffic may get a click challenge.
    • Non-interactive — the widget stays visible and runs in the background without asking the visitor to click.

Turnstile widget mode selection

  1. Click Create.
  2. Copy the Site Key and Secret Key. You will paste these into UpForm.

In UpForm, select the CAPTCHA type that matches this widget mode: Cloudflare Turnstile (Managed) or Cloudflare Turnstile (Non-interactive).

Configure CAPTCHA in UpForm ​

  1. In UpForm, open Settings → CAPTCHA.
  2. Select Cloudflare Turnstile (Managed) or Cloudflare Turnstile (Non-interactive) to match the widget mode you chose in Cloudflare.
  3. Paste the Site key and Secret key.
  4. Click Save.

UpForm Turnstile CAPTCHA settings

If the keys are wrong or incomplete, verification can fail and the form may not be protected.

You can also open these settings from a form with Configure CAPTCHA in the General tab.

Enable CAPTCHA on a form ​

Credentials in Settings do not automatically protect every form. Enable CAPTCHA on each form you want to secure.

  1. Open the form in the form builder.
  2. Go to the General tab → CAPTCHA.
  3. Under CAPTCHA type, select Cloudflare Turnstile (Managed) or Cloudflare Turnstile (Non-interactive) (only configured types appear).
  4. Choose a Theme of Light or Dark.
  5. Save the form.

Form CAPTCHA type Turnstile selection

For more form-level CAPTCHA options, see General.

If this does not work as expected, Contact for help.