Signup spam prevention

Configure Turnstile#

Open Community settings → Spam prevention (/admin/settings/spam). Protection starts disabled. Use inherited TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY deployment values or protected encrypted administrator overrides. Set APP_URL to the canonical community hostname and register that hostname in your Cloudflare configuration.

Verify before enabling#

Use your current administrator password for protected operations. Complete the page's real-key challenge test, then explicitly enable protection. Dummy keys can preview a widget but cannot establish hostname verification or enable protection.

Test signup as a guest. A challenge failure requires a fresh token. Do not copy challenge tokens into tickets, logs or reusable forms.

Key and hostname changes#

Changing keys or the canonical hostname invalidates verification. If protection was already enabled, signup remains blocked until retested or explicitly disabled. Login and recovery stay available. Blank replacement credentials retain existing values; inheritance removes an override. Keep the original APP_KEY backed up for encrypted overrides.

Network and content security policy#

Allow outbound HTTPS to challenges.cloudflare.com. If your host adds CSP, allow that host in script-src and frame-src on signup and the administrator test page. The application does not require unsafe-eval. Provider/dashboard instructions may change; follow the provider's current documentation when setting up its account.

See the installation reference for the server validation contract. A custom theme must preserve the CAPTCHA widget and submitted cf-turnstile-response field, while core performs verification.