Skip to content
CMS Max Documentation

Cloudflare Turnstile

Protect your website forms from bots with a privacy-friendly CAPTCHA alternative

Overview

The Cloudflare Turnstile plugin adds bot protection to your website forms using Cloudflare's free, privacy-friendly alternative to traditional CAPTCHAs. Turnstile verifies visitors without intrusive challenges, providing a smoother user experience while still blocking automated attacks and spam submissions.

Setup

  1. Navigate to Settings > Plugins
  2. Find Cloudflare Turnstile and click to open the settings page
  3. Click Save and Install
  4. Select your account type (see below)

Cloudflare Turnstile plugin settings page

Configuration

Account Type

Option Description
CMS Max Enterprise Account Uses the shared CMS Max Turnstile account. No additional setup is needed.
Use your own Cloudflare account Use your own Cloudflare Turnstile site key and secret key. Recommended for high-traffic sites or advanced configuration.

Using the CMS Max Enterprise Account

Select CMS Max Enterprise Account and save. Turnstile protection is enabled immediately on your forms with no further configuration.

Using Your Own Cloudflare Account

Own Account Details section with Site Key and Secret Key fields

  1. Go to the Cloudflare Dashboard and navigate to Turnstile
  2. Click Add site and enter your website domain
  3. Choose your widget mode (Managed, Non-Interactive, or Invisible)
  4. Copy the Site Key and Secret Key
  5. In CMS Max, select Use your own Cloudflare account
  6. Paste the Site Key and Secret Key into the corresponding fields
  7. Click Save

Both keys must start with 0x followed by at least 20 alphanumeric characters.