How to protect your forms from spam with Cloudflare Turnstile

Cloudflare Turnstile is a privacy-friendly alternative to CAPTCHAs. Your station uses its own free Turnstile widget, so you control it in your Cloudflare account and see its analytics there.

What does it protect?

• contact and song-request forms
• talkback messages
• listener sign-in and sign-up
• comments
• live chat (checked once per session, not for every message)

How do you create your widget?

1. Sign in to Cloudflare (a free account works) and open Turnstile.
2. Choose Add widget, name it after your station and pick Managed mode.
3. Add your hostnames. Radiocast Sites lists the exact ones in Settings → Security: your station address and every custom domain you've connected.
4. Create the widget and keep the page open. You need its Site Key and Secret Key.

How do you add the keys to your site?

1. In the editor, open Settings → Security and switch on Cloudflare Turnstile.
2. Paste the Site key.
3. Paste the Secret key and choose Save. Radiocast Sites checks it with Cloudflare and stores it encrypted. It is never published with your site.
4. Publish.

Publishing is blocked while Turnstile is on without both keys, so you can't go live with protection that doesn't work.

How do you test it?

Cloudflare publishes test keys: site key 1x00000000000000000000AA with secret 1x0000000000000000000000000000000AA always passes. Swap in your real keys before you rely on it.