Bot protection

Bots try stolen passwords on sign-in forms, create fake accounts and post spam reviews. With LanternWP Companion, your store's forms can ask Cloudflare Turnstile to check that a person, not a bot, sends them. Most visitors are not asked anything: Turnstile decides in the background and only sometimes shows a check to tick.

Bot protection is off until you turn it on, and your store works the same without it.

Get your keys from Cloudflare

Turnstile is free and works without moving your site to Cloudflare.

1. Sign in to your Cloudflare dashboard, or create a free account, and open Turnstile.
2. Add a widget. Enter your store's domain, and choose a mode: Managed shows a check only when Cloudflare is unsure about the visitor.
3. Copy the Site key and the Secret key.

Turn it on

1. Go to WooCommerce → Settings → Advanced → Bot protection.
2. Tick Protection, paste both keys and select Save changes. If Cloudflare does not accept the secret key, the page says so.
3. Under Forms, untick any form you do not want checked:
   • signing in, on the account page and on the WordPress login page;
   • creating an account;
   • asking for a new password;
   • comments and reviews from guests (signed-in customers are not asked);
   • the contact form.

Show the check chooses whether the Turnstile box always shows in these forms, or only when the visitor has to do something.

If Cloudflare is down

By default, forms go through when Cloudflare cannot be reached, so your customers can still sign in. Choose Stop the forms under If Cloudflare cannot be reached to refuse them instead. Keep the default if you are not sure: with it, a mistake in the keys cannot lock you out of your own store.

Privacy

Turnstile sends information about the visitor's browser and device to Cloudflare. While bot protection is on, Settings → Privacy suggests a paragraph about it for your privacy policy.

Another plugin already adds Turnstile

If Simple CAPTCHA with Cloudflare Turnstile is active, Companion's bot protection stays off, so no form shows two checks. The settings page says so.