Skip to main content
Bots submit forms at scale. They scrape fake leads into your database, pad your conversion numbers, and harvest whatever confirmation page a submission unlocks. Bot protection screens them out before they reach allGood. It uses a check called Cloudflare Turnstile that runs quietly in the visitor’s browser, usually without them noticing.

Prerequisites

  • You can open the Form Processing and Web Edge Sessions settings pages.
  • A subdomain is registered and active on Web Edge Sessions. Bot protection cannot be set up until a subdomain reaches that stage.

How it works

When a form requires a bot check, the allGood script on your page asks the visitor’s browser to prove it is a real browser. Most visitors never see or do anything. A missing or invalid result gets the submission refused before it is stored. The widget is created once for your account and covers the subdomains you have connected. Its public sitekey is included in your page’s HTML. Its secret never leaves allGood.

Two switches, and both have to agree

Turning on bot protection for a form takes two settings, on two different pages. A check runs only when both are on. If a form is not asking visitors to prove they are human and you expected it to, check the account-wide setting first.
The Bot protection card, showing how many hosts the widget covers and the public sitekey

The Bot protection card, showing how many hosts the widget covers and the public sitekey.

Turn it on

1

Confirm your subdomain is active

On Web Edge Sessions, confirm the subdomain that hosts your form shows State: active with all four progress steps done.
2

Select Sync

Still on Web Edge Sessions, select Sync. This creates the widget, or extends it to cover a newly added subdomain. It does not happen automatically when a subdomain goes active. allGood also refuses to register a form that requires a bot check while no widget exists, so you cannot hit the failure below by accident.
3

Turn on the account-wide switch

Open Form Processing and set Bot protection to on.
4

Opt in the form

Open the form’s own settings and turn on its bot-check option.
Both switches are on and the subdomain has synced. The form accepts submissions, and a real visitor can submit it without doing anything differently.
A bot check only works on a subdomain that has finished provisioning. If a form that requires a bot check sits on a subdomain that has not, every submission from that page is refused with no error message, and nothing in the form’s own configuration looks wrong. Check the coverage chip on each origin in the allowed origins list, and the Bot protection ready step on the subdomain row. If either is missing, select Sync.

If a submission is refused

  • Every submission from the form is refused, and nothing else looks wrong. Confirm the subdomain is active and synced, as described above.
  • Some succeed and others do not. That is closer to the check working as intended. An occasional refusal from a slow connection or an older browser is expected.
  • Your site sets a Content Security Policy. It must allow Cloudflare’s challenge domain, or the widget never loads and every submission is refused with no error message. Ask whoever manages your site’s security headers to follow Install the tag.