Turnstile protects selected public actions without forcing you into a full captcha-heavy experience everywhere.

• registration
• user login
• admin login
• contact form
• abuse report
• DMCA form
• gated download flows

1. Create a Turnstile site in Cloudflare.
2. Copy the site key and secret.
3. Save them in Config Hub > Security.
4. Enable only the placements you actually want to protect.
5. Test each form after saving.

• use the lightest placement strategy that still blocks abuse
• test both a normal pass and a forced failure
• if a public form starts failing unexpectedly, re-check the key pair and page hostname alignment