# Cloudflare Turnstile

Add Cloudflare Turnstile to a Form Plume form: create the widget, save your site and secret keys, add the script, and let the server verify each submission.

Turnstile is one of the [CAPTCHA](/docs/spam-protection/captcha) options and adds a browser check without asking most visitors to solve a puzzle.

## 1. Create the widget

Create a Turnstile widget in Cloudflare and add every production domain that contains the form. Copy the site key and secret key.

## 2. Save the keys

Open [Spam protection](/docs/spam-protection), choose **Cloudflare Turnstile**, and save both keys. The secret becomes write-only after it is stored.

## 3. Add Turnstile to the form

```html
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
```

Turnstile adds `cf-turnstile-response` to the submission. Form Plume verifies it on the server.

Test the published form on an allowed domain. Localhost and preview hosts must be allowed separately when you use them.