---
title: Bot protection
summary: Stop bots at your sign-in, account, password, comment and contact forms with Cloudflare Turnstile, an option you turn on.
url: https://lanternwp.com/docs/bot-protection
updated: 2026-10-13
---

# Bot protection

Bots try stolen passwords on sign-in forms, create fake accounts and post spam reviews. With LanternWP Companion, your store's forms can ask Cloudflare Turnstile to check that a person, not a bot, sends them. Most visitors are not asked anything: Turnstile decides in the background and only sometimes shows a check to tick.

Bot protection is off until you turn it on, and your store works the same without it.

## Get your keys from Cloudflare

Turnstile is free and works without moving your site to Cloudflare.

1. Sign in to your Cloudflare dashboard, or create a free account, and open **Turnstile**.
2. Add a widget. Enter your store's domain, and choose a mode: **Managed** shows a check only when Cloudflare is unsure about the visitor.
3. Copy the **Site key** and the **Secret key**.

## Turn it on

1. Go to **WooCommerce → Settings → Advanced → Bot protection**.
2. Tick **Protection**, paste both keys and select **Save changes**. If Cloudflare does not accept the secret key, the page says so.
3. Under **Forms**, untick any form you do not want checked:
   - signing in, on the account page and on the WordPress login page;
   - creating an account;
   - asking for a new password;
   - comments and reviews from guests (signed-in customers are not asked);
   - the [contact form](contact-form.md).

**Show the check** chooses whether the Turnstile box always shows in these forms, or only when the visitor has to do something.

## If Cloudflare is down

By default, forms go through when Cloudflare cannot be reached, so your customers can still sign in. Choose **Stop the forms** under **If Cloudflare cannot be reached** to refuse them instead. Keep the default if you are not sure: with it, a mistake in the keys cannot lock you out of your own store.

## Privacy

Turnstile sends information about the visitor's browser and device to Cloudflare. While bot protection is on, **Settings → Privacy** suggests a paragraph about it for your privacy policy.

## Another plugin already adds Turnstile

If **Simple CAPTCHA with Cloudflare Turnstile** is active, Companion's bot protection stays off, so no form shows two checks. The settings page says so.