Skip to main content
allGood uses Cloudflare Turnstile to tell real visitors from bots. A widget is created once for your account, and it covers the domains you’ve connected. Where: Settings → Web Edge (the Bot protection card) and Settings → Form Processing (the Bot protection dropdown).
Configuring this for a marketer, not building against it? See Turn on bot protection for a form for the settings-only walkthrough.

​
How it works

When a form requires a bot check:
  1. The allGood script renders the widget on your page.
  2. The visitor’s browser produces a token, usually without them doing anything.
  3. The token is sent with the submission.
  4. allGood verifies it and refuses a missing or invalid one.
The widget’s sitekey is public and ships in your page’s HTML. Its secret never leaves allGood and can’t be read from the app or the API.

​
Provisioning it

There’s no “create widget” button. Connect a domain, wait for it to reach active, then press Sync on Settings → Web Edge. The widget is created — or extended to cover the new hostname — as part of that sweep. Until then the screen tells you so, and forms that require a bot check can’t be registered.
The Bot protection card, showing how many hosts the widget covers and the public sitekey

The Bot protection card, showing how many hosts the widget covers and the public sitekey.

​
Both switches have to agree

Bot protection is a two-sided decision. A check runs only when both are on. Per-form opt-in is off by default.

​
The failure worth knowing about

A Turnstile widget only issues tokens on hostnames it covers. If a form requires a bot check and sits on a hostname the widget doesn’t cover, the browser produces no token, and every submission from that page is refused as a bot — with nothing obviously wrong in your setup and a form that looks correctly configured.
Two places tell you before it bites:
  • The coverage chip on each row of the allowed origins list.
  • The fourth step on a domain row, Bot protection ready.
The fix in both cases is the same: press Sync on Settings → Web Edge. allGood also refuses to register a form that requires a bot check while no widget exists, precisely so you can’t reach the silent version of this by accident.

​
What the visitor sees

If you use the allGood script, the widget is placed just before your form’s submit button and the Turnstile loader is fetched once per page. Style it with the .cf-turnstile class if you need to move it.
If your site sets a Content Security Policy, it has to allow https://challenges.cloudflare.com for both script-src and frame-src. Otherwise the widget never renders — and again, every submission is refused.
If you build the request yourself, you render the widget yourself and send the token. See the Form capture API.

​
Next

→ Consent provider