Cloudflare Turnstile is a user-friendly CAPTCHA that is not as intrusive and is compatible with GDPR and WCAG 2.1, which helps us protect our Joomla sites from spam and automated access (bots). Turnstile runs a series of complex browser challenges in the background that are invisible to the user. These challenges analyse the behaviour and characteristics of the browser to determine whether the visitor is a human or a bot, and only in some cases will it request verification from the visitor.
Installing Cloudflare Turnstile in Joomla
We must download the Cloudflare Turnstile plugin developed by Sharky. This plugin can be found in the JED (Joomla Extensions Directory) or directly in the Github repository. After downloading it, you have to install it like any other extension by going to System >> Install >> Extensions.
Generating Cloudflare Turnstile Keys
To generate the keys we need to configure Turnstile in Joomla, we must access our Cloudflare accounts https://dash.cloudflare.com/. If you do not have an account, you must create one and then log in.
- Click on the Turnstile menu item to access the Turnstile panel.
- Click on the "Add Widget" button to create a new widget.
- Enter a name for your widget so that you can identify it in the future (the site name is ideal).
- Click on "Add Hostnames", which is basically your domain or subdomain without http://, https://, ports or paths.
- Enter your domain or subdomain correctly.
- Click on "Add" to add the domain or subdomain. You can add up to 10 per widget.
- Click on "Add" to add the domains to the widget.
- In "Widget Mode", select Managed so that Cloudflare decides how to verify the visitor.
- Click on "Create" to create the widget.
After creating the widget, you will be taken to the next screen where you can find the keys you need for your Joomla site.
NOTE: While configuring a widget for Turnstile in Cloudflare, at each step you will see links to detailed documentation. You can access them if you want to learn more about them.
Configure Cloudflare Turnstile in Joomla
To configure the Captcha - Cloudflare Turnstile plugin, we must access the Joomla administrator and follow these steps:
Add the Site and Secret keys
To do this, go to System >> Manage >> Plugins and search for Turnstile. Access to the options by clicking on the plugin name. Then copy the Site and Secret keys you just created in Cloudflare and paste them into their respective fields in the plugin. You can leave the other fields with their default settings. Finally, click Save & Close.
Add Cloudflare Turnstile as the default captcha in Joomla
The final step to protect our Joomla site with Cloudflare Turnstile is to make it the default captcha for Joomla. To do this, go to: System >> Setup >> Global Configuration >> Site tab >> Default Captcha field, select Captcha - Cloudflare Turnstile, and save.
To see how Cloudflare Turnstile is protecting our Joomla site from spam, go to https://dash.cloudflare.com/, click on Turnstile and View Analytics next to the widget you have created.