Cloudflare Turnstile Integration with FluentBooking

Cloudflare Turnstile adds a bot check to every FluentBooking booking form, and FluentBooking blocks any booking that does not pass the check. Your calendars stay free of spam bookings, and your visitors never have to solve an image or text puzzle.

In this guide, we'll walk you through creating your Turnstile keys and connecting them to FluentBooking. Let's get started!

Important

Spam Protection is only available in FluentBooking Pro. You will need the FluentBooking Pro plugin to use this feature. You will also need a Cloudflare account, which you can create on the Cloudflare sign-up page. If you prefer to use Google, see Google reCAPTCHA Integration with FluentBooking.

Setting Up Cloudflare Turnstile Integration

To connect Turnstile with FluentBooking, you need a Site Key and a Secret Key from a Turnstile widget. You create the widget in your Cloudflare dashboard, then paste both keys into FluentBooking.

Create Cloudflare Turnstile Keys

To create your keys, log in to the Cloudflare dashboard, go to Turnstile from the left-side menu, and click the Add widget button.

Next, enter a Widget name that helps you recognize this website later, and click Add Hostnames to register your domain.

Enter the domain where your booking forms appear in the Add a custom hostname field and click the Add button. Your domain appears under Selected hostnames. Then, click the Add button at the bottom of the panel.

Now, choose your Widget Mode (Managed, Non-interactive, or Invisible), answer the pre-clearance question, and click the Create button.

Cloudflare now shows your keys. Click the Site Key and Secret Key fields to copy them, and keep them ready for the next step.

Configuring Cloudflare Turnstile With FluentBooking

Now that your keys are ready, connect them to FluentBooking.

Open the Spam Protection Settings

To open the settings, go to Settings in your FluentBooking dashboard and click Spam Protection in the left sidebar.

Then, switch on the Spam Protection toggle at the top of the card.

Select Cloudflare Turnstile

Under Provider, select Cloudflare Turnstile. FluentBooking uses one provider at a time for all of your booking forms.

Enter Your Keys

Paste the keys you copied from Cloudflare into the matching fields:

• Site Key: Paste the Site Key from your Turnstile widget.
• Secret Key: Paste the Secret Key from your Turnstile widget.

Verify Your Keys

To test your keys, click the Verify Keys button. FluentBooking asks Cloudflare for a token and checks both keys with it, so your domain must already be on the widget. If a Turnstile widget appears and asks you to confirm, complete it.

When the keys work, the message Cloudflare accepted both keys. appears next to the button.

Save Your Settings

If you want logged-in users to book without the check, tick Skip the check for logged-in users. Turn this on only if visitors cannot create accounts themselves, because a bot with an account would skip the check too.

Finally, click the Save Settings button.

Using Cloudflare Turnstile in Your Bookings

Once you save your settings, the check runs on every booking form on your site. You do not have to change anything on your individual events.

The Turnstile widget appears on the booking form, right above the Schedule Meeting button. What your visitors see depends on the Widget Mode you chose. In Invisible mode, they see no widget at all.

The check only applies to new bookings. A visitor rescheduling an existing booking does not have to pass it again.

Troubleshooting Cloudflare Turnstile

• Verify Keys says FluentBooking could not get a token from Cloudflare: Check the Site Key, and make sure your domain is on the widget in your Cloudflare dashboard.
• Verify Keys says Cloudflare refused the Secret Key or the token: Copy both keys again, and make sure they come from the same Turnstile widget.
• A visitor sees "The security check did not load": The check could not load in the visitor's browser. Ask them to refresh the page or turn off their ad blocker.
• A visitor sees "The security check expired": The token timed out while the form was open. Ask them to try again.
• A notice on your dashboard says Cloudflare Turnstile refused the secret key: Open Spam Protection and save the correct keys.

Important

FluentBooking does not stop taking bookings if Cloudflare is unreachable or your Secret Key is wrong. Bookings are accepted without the check until Cloudflare answers again, so an outage never blocks your visitors. This means a wrong Secret Key leaves your forms unprotected, so always use Verify Keys after you change your keys, and act on the dashboard notice if you see it.

For more ways to control who can book and how often, see Booking Limits & Rules.