Cloudflare Turnstile
Enhance enrolment security with Cloudflare Turnstile to verify human traffic.
Cloudflare Turnstile can be enabled to reduce automated enrolments and scripted abuse. When enabled, the enrolment form includes a Turnstile check and validates the resulting token server-side.
The implementation stays mostly invisible. Turnstile runs in the background and only becomes interactive when Cloudflare requires extra verification.
Bot detection cannot be 100% accurate. Turnstile provides basic bot mitigation, not a guarantee. AI-assisted automation and human-in-the-loop services make abuse increasingly hard to fully control. Cloudflare documents Turnstile’s approach here: Cloudflare Turnstile docs.
How it works
When the enrolment form loads, Turnstile runs in the background.
When the form is submitted, Turnstile may ask for an interactive check.
The Wallet Crew validates the Turnstile token server-side before accepting the enrolment.
Configuration
Configuration requires a Turnstile widget in Cloudflare and the widget keys. The Wallet Crew uses the Site key and Secret key to validate enrolment submissions.
Create and configure a Turnstile widget in Cloudflare
Create a Turnstile widget in the Cloudflare dashboard. Cloudflare provides a Site key (public) and a Secret key (private) for each widget.
Official setup guide: Cloudflare Turnstile “Get started”
Cloudflare dashboard entry point: dash.cloudflare.com (then open Turnstile)
The default configuration is usually sufficient. Please consult your IT team for any additional adjustments.
Enable Turnstile in The Wallet Crew
Ask The Wallet Crew team to enable the Cloudflare Turnstile extension for the tenant.
Then open the Back Office settings page and paste the keys:
Notes
Turnstile is usually invisible because it runs in the background. An interactive check is only shown when Cloudflare flags the session as higher risk.
Token validation is always performed server-side by The Wallet Crew when the extension is enabled.
Limits and expectations
Turnstile improves baseline protection, but it does not “solve bots”. Automated abuse evolves quickly and often relies on AI-assisted tooling, residential proxies, and human-in-the-loop services. This makes perfect bot detection unrealistic for most public enrolment flows.
Cloudflare positions Turnstile as a frictionless alternative to CAPTCHAs, not as a guarantee that every bot will be blocked. Combine Turnstile with other controls when enrolment is business-critical.
Official documentation: Cloudflare Turnstile docs
Challenge cookie
After a successful Turnstile verification, the application can set a short-lived security cookie. This keeps bot-protection state between requests and reduces repeated Turnstile challenges during the same enrolment session.
How this cookie works:
The user submits the enrolment form with a valid Turnstile token.
The server validates that token with Cloudflare.
If validation succeeds, the server issues a signed proof cookie.
On the next enrolment-related requests, the server checks that cookie.
If the cookie is still valid, the server can skip a new Turnstile challenge for that short window.
This behavior is configurable in Back Office:
Cookie validity is set in seconds, common value is 600 seconds (10 minutes)
When disabled, the server does not issue this cookie and Turnstile verification is required for each submission path.
Legal requirement: security cookie
This cookie should be listed in the cookie policy (often under “strictly necessary” / “security cookies”).
Cookie name:
neo.<tenantId>.turnstile-proofwhere<tenantId>is the identifier of your wallet crew tenantPurpose: Keep bot-protection state between requests and avoid repeated Turnstile challenges
Category: Security cookie (generally considered strictly necessary)
Lifetime: Configurable (seconds). Set to 0 to disable.
Scope: Enrolment form submission
Technical attributes:
HttpOnlySecureSameSite=LaxPath=/
This cookie is used only for security and fraud prevention, not for analytics or marketing.
FAQ
Does Turnstile always show a CAPTCHA-like challenge?
No. Turnstile often completes in the background. An interactive widget is only displayed when Cloudflare requires extra verification.
Is Turnstile enough to fully block bots?
No. Turnstile provides baseline bot mitigation, but it is not perfect. Modern abuse can use AI-assisted automation, proxy networks, and human-in-the-loop solving.
Cloudflare’s official documentation covers Turnstile’s intent and behavior: Cloudflare Turnstile docs.
Which keys are needed from Cloudflare?
The Wallet Crew requires the Turnstile widget Site key and Secret key.
Cloudflare explains how to create a widget and retrieve those values here: Turnstile “Get started”.
What happens if the Turnstile token is missing or invalid?
When the extension is enabled, the enrolment submission is only accepted when a valid Turnstile token is received and successfully verified server-side. Invalid, expired, or missing tokens are treated as non-legitimate submissions.
How to test that Turnstile is correctly configured?
A quick validation is to submit the enrolment form from a normal browser session and confirm it completes without friction. A second validation is to open the same flow in a stricter context (private browsing, disabled third-party cookies, VPN, or automation tooling) and confirm Turnstile still behaves as expected.
Cloudflare documents recommended test patterns and integration steps in the setup guide: Turnstile “Get started”.
Which domain should be configured on the Cloudflare widget?
Add the custom domain that hosts the enrolment form.
This is configured in the Turnstile widget settings in Cloudflare. Cloudflare’s setup guide covers widget configuration details: Turnstile “Get started”.