Skip to main content
The bot check belongs to the platform owner and covers the whole platform. Agency admins don’t see it.

​
What it protects

When the bot check is on, these forms need a passed check before anything is saved or sent: The website chat on clients’ own sites is not covered. It runs inside the business’s site, where the platform can’t add the check. People see a small Cloudflare box above the send button. Most of the time it passes on its own in a second or two. If the check fails or Cloudflare doesn’t answer within 5 seconds, the form isn’t sent and the person sees “We couldn’t check that you’re not a bot. Please try again.” in their language.

​
Turning it on

The bot check is off until you add both keys. Turnstile is free.
1

Create a widget in Cloudflare

In the Cloudflare dashboard, open Turnstile and choose Add widget. Give it a name and add the hostnames your forms are on, for example your platform’s main address, its www address and the portal’s address.
2

Copy the keys

Cloudflare shows a site key and a secret key. On the Platform page, in Bot check on public forms, paste the site key and the secret key.
3

Check the hosts and turn it on

Leave Hosts empty to use the platform’s own hosts (they are listed under the field), or list the hostnames yourself. Switch on Check public forms for bots and save.
The secret key is stored encrypted and is never shown again. Remove the keys turns the check off and deletes both keys.

​
Clients’ own domains

Free Turnstile keys work only on the hostnames added to the widget in Cloudflare. A client’s booking page, shop page or intake form on that client’s own domain therefore skips the check, unless you add that domain both here and to the widget in Cloudflare. Only the client’s own forms skip it there. A form sent through another client’s domain, or through a host that isn’t in your list and isn’t one of the platform’s own, still needs a passed check, so a bot can’t avoid it by sending its requests to a client’s domain.
The marketing site keeps its page for up to 5 minutes, so the check can take a few minutes to appear there after you turn it on. Someone who opened the page before that may need to reload it to send the form.

​
With an AI agent

The platform owner’s agent can read the settings with bot_check and change them with set_bot_check. The agent never asks for the keys in chat. Paste them on the Platform page instead, unless you choose to give them to the agent yourself.