# Protecting your Forms with Cloudflare Turnstile
> Formspree Docs · Form and Project Settings · Updated April 14, 2026
[**Cloudflare Turnstile**](https://www.cloudflare.com/products/turnstile/) is a modern, privacy-focused alternative to CAPTCHAs. It provides frictionless bot detection without user challenges, improving both accessibility and form security.
Formspree supports Turnstile out of the box — just configure your keys and enable CAPTCHA in your form settings.
## Step 1: Create a Turnstile Site
Start by visiting the [**Cloudflare Turnstile dashboard**](https://dash.cloudflare.com/login).
Click **Add widget** to create a new Turnstile site, then:
1. Enter a **name** for your site.
2. Add your **domain** (e.g., `example.com`) under _Allowed Domains_. Use [localhost](http://localhost) for development purposes.
3. Choose the **widget mode**
Save the configuration. Once created, you’ll see your new Widget keys
Copy this **Site Key and Secret Key** — you’ll use it in your HTML form and Formspree configuration.
## Step 2: Configure CAPTCHA in Formspree
Go to your form’s settings page in [**Formspree Dashboard**](https://formspree.io/dashboard).
Under the **CAPTCHA** section, make sure CAPTCHA protection is **enabled**.
Click **Adjust settings**, select **Cloudflare Turnstile**, and paste your **Secret Key** in the provided field.
Save your changes.
## Step 3: Add Turnstile to Your Form HTML
Now it’s time to add Turnstile to your form. Include the **Turnstile script** and your **Site Key** in your HTML code.
Here’s a basic example:
```html
Turnstile Demo
```
When a user submits the form, the Turnstile widget automatically generates a token (`cf-turnstile-response`) that is verified by Formspree using your Secret Key.
## Using AJAX (Optional)
If you’re submitting your form via AJAX, you can include the Turnstile token manually in your request.
Below is an example using **Vanilla JS**:
```html
Turnstile AJAX Demo
```
Or using [Turnstile API](https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/#widget-lifecycle-management)
```html
```