> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instaforge.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Bot check on public forms

> Cloudflare Turnstile checks that a person, not a bot, sends the public forms. It stays off until the platform owner adds keys.

The bot check belongs to the [platform owner](/running-the-agency/agencies) and covers the whole platform. Agency admins don't see it.

## What it protects

When the bot check is on, these forms need a passed check before anything is saved or sent:

* the contact form on the marketing site
* booking on a [booking page](/bookings/booking-page)
* placing an order on a [shop page](/grow-sales/shop-and-orders)
* sending the [intake form](/getting-started/client-intake-form)
* signing up a new agency, when [self sign-up](/running-the-agency/self-signup) is on

The website chat on clients' own sites is not covered. It runs inside the business's site, where the platform can't add the check.

People see a small Cloudflare box above the send button. Most of the time it passes on its own in a second or two. If the check fails or Cloudflare doesn't answer within 5 seconds, the form isn't sent and the person sees "We couldn't check that you're not a bot. Please try again." in their language.

## Turning it on

The bot check is off until you add both keys. Turnstile is free.

<Steps>
  <Step title="Create a widget in Cloudflare">
    In the Cloudflare dashboard, open **Turnstile** and choose **Add widget**. Give it a name and add the hostnames your forms are on, for example your platform's main address, its `www` address and the portal's address.
  </Step>

  <Step title="Copy the keys">
    Cloudflare shows a **site key** and a **secret key**. On the **Platform** page, in **Bot check on public forms**, paste the site key and the secret key.
  </Step>

  <Step title="Check the hosts and turn it on">
    Leave **Hosts** empty to use the platform's own hosts (they are listed under the field), or list the hostnames yourself. Switch on **Check public forms for bots** and save.
  </Step>
</Steps>

The secret key is stored encrypted and is never shown again. **Remove the keys** turns the check off and deletes both keys.

## Clients' own domains

Free Turnstile keys work only on the hostnames added to the widget in Cloudflare. A client's booking page, shop page or intake form on that [client's own domain](/running-the-agency/custom-domains) therefore skips the check, unless you add that domain both here and to the widget in Cloudflare.

Only the client's own forms skip it there. A form sent through another client's domain, or through a host that isn't in your list and isn't one of the platform's own, still needs a passed check, so a bot can't avoid it by sending its requests to a client's domain.

<Note>
  The marketing site keeps its page for up to 5 minutes, so the check can take a few minutes to appear there after you turn it on. Someone who opened the page before that may need to reload it to send the form.
</Note>

## With an AI agent

The platform owner's agent can read the settings with **bot\_check** and change them with **set\_bot\_check**. The agent never asks for the keys in chat. Paste them on the Platform page instead, unless you choose to give them to the agent yourself.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.