Skip to main content

Cloudflare Turnstile

SonoTrix add-on for CS-Cart and Multi-Vendor that replaces Google reCAPTCHA with Cloudflare Turnstile — seamless bot protection on storefront forms, checkout, reviews, vendor applications, and optionally the administration panel login.

Purchase / product page: Cloudflare Turnstile on the CS-Cart Marketplace (srx_cloudflare_turnstile).

You can:

  • Protect login, registration, checkout, reviews, and other storefront forms
  • Use default Site / Secret keys or per-storefront custom keys
  • Optionally protect the administration panel login
  • Skip verification for logged-in customers or after the first valid answer (when enabled)
Register form protected by Cloudflare Turnstile — Success verification
My Account Track my order form with Cloudflare Turnstile
Administration panel login protected by Cloudflare Turnstile
Cloudflare Turnstile General settings — enable, default site key and secret key

Install the add-on​

  1. Download the Cloudflare Turnstile package (srx_cloudflare_turnstile) from the marketplace page or your SonoTrix license downloads.
  2. Go to Add-ons → Manage add-ons.
  3. Upload, install, and enable the add-on (status ON).
  4. Clear the CS-Cart cache once after installation.

See also: How to Install CS-Cart Add-ons.

Disable official reCAPTCHA

While this add-on is active, disable the official CS-Cart reCAPTCHA add-on. Both register an antibot driver; running them together can cause conflicts.

Create Cloudflare Turnstile keys​

You need a Site key and a Secret key from Cloudflare for your store domain(s).

Step 1 — Sign in to Cloudflare​

Open the Cloudflare Dashboard and sign in (or create an account).

Step 2 — Open Turnstile​

From the dashboard, open Turnstile (or go to Turnstile get started).

Step 3 — Create a widget​

  1. Create a new Turnstile widget.
  2. Add your storefront domain(s) (and admin domain if you protect admin login).
  3. Choose the widget mode that fits your UX (Managed / Non-interactive / Invisible as offered by Cloudflare).
  4. Save the widget.

Step 4 — Copy Site key and Secret key​

Copy the generated Site key and Secret key. You will paste them into the add-on Settings → General (default keys) and optionally into Storefront keys for custom per-storefront credentials.

Official reference: Cloudflare Turnstile — Get started.

Configure the add-on (General)​

Go to Add-ons → Manage add-ons → Cloudflare Turnstile → Settings → General.

  1. Enable Enable Cloudflare Turnstile.
  2. Paste Site key (default) and Secret key (default).
  3. Optionally enable Protect administration panel login to show Turnstile on admin.php sign-in.
  4. Click Save.
SettingWhat it does
Enable Cloudflare TurnstileTurns on Turnstile for the store when keys are set.
Protect administration panel loginShows Turnstile on the admin login form.
Site key (default)Public widget key used when a storefront inherits default keys.
Secret key (default)Private server key used to validate tokens.

Per-form protection​

Still under Settings → General, use Per-form protection to choose which storefront forms require Turnstile. Typical forms include:

  • Login form
  • Create and edit profile form
  • Recover password form
  • Checkout (user information) form
  • Track my order form
  • In-stock notification subscription form
  • Apply for a vendor account form
  • Subscribe form
  • Gift certificate purchase form
  • Call request and buy now with one click form
  • Custom forms
  • Comments and reviews forms

Behavioral options (when available in settings):

  • Do not use verification if user is logged in
  • Do not use verification after first valid answer

On Ultimate / multi-storefront installs, some of these options can be managed per storefront.

Per-form protection checkboxes for Cloudflare Turnstile

Storefront keys (Ultimate / multi-storefront)​

Open Settings → Storefront keys.

For each storefront choose:

ModeMeaning
Use default keys from GeneralInherit the Site key / Secret key from Settings → General.
Custom keysEnter a storefront-specific Site key and Secret key (widget for that domain).
DisabledDo not run Turnstile for that storefront.
Storefront keys — default vs custom Cloudflare Turnstile keys

This matches the Default / Custom / Disabled pattern used by other SonoTrix multi-storefront add-ons.

Protect administration panel login​

  1. Enable Protect administration panel login on Settings → General.
  2. Ensure default (or applicable) Site / Secret keys are filled.
  3. Save, then open the admin login page and confirm the Verify you are human Turnstile widget appears before Sign in.

Verify on the storefront​

After saving keys and form toggles:

  1. Open a protected page (for example Register or Sign in).
  2. Confirm the Turnstile widget renders and can reach Success! for a legitimate visitor.
  3. Submit the form once to confirm server-side validation accepts a valid token.

Troubleshooting​

IssueCheck
No widget on formsAdd-on ON; Enable Cloudflare Turnstile checked; Site + Secret keys saved; form enabled under per-form protection; cache cleared
Widget fails / always errorsDomain allowed on the Cloudflare Turnstile widget; Site/Secret keys match that widget; no mix-up of test vs production keys
Conflicts with reCAPTCHADisable the official reCAPTCHA add-on
Wrong keys on one storefrontStorefront keys not left on Custom with empty keys; use Default or fill Custom Site + Secret
Admin login has no TurnstileEnable Protect administration panel login; keys present
Storefront never shows TurnstileStorefront mode is not Disabled under Storefront keys

References​