# Protect lead submissions with Turnstile

You'll add Cloudflare Turnstile to check lead submissions for bots before RightMessage sends them to your email platform or CRM.

Check new lead submissions for bots before they reach your email platform or CRM. Cloudflare Turnstile usually runs in the background, so visitors only complete a challenge when one is needed.

You'll need access to the project's **General** settings and permission to publish. You'll also need a Cloudflare account that can manage a Turnstile widget for the domains where your forms run.

## Add your Turnstile keys

1. In Cloudflare's Turnstile dashboard, create or select a widget for your website's domains.
2. Copy the widget's site key.
3. In RightMessage, open **Settings** > **General**.
4. Find **Bot Protection**.
5. Paste the site key into **Cloudflare Turnstile Site Key**.
6. Copy the matching secret key from Cloudflare and paste it into **Cloudflare Turnstile Secret Key**.
7. Review and [publish your changes](https://rightmessage.com/help/publishing-your-changes).

![Bot Protection settings with Cloudflare Turnstile site key and secret key fields](https://rightmessage.com/help/screens/builders-bot-protection.light.webp)

Keep the secret key in its designated field, not in page code, an AI prompt, or a screenshot. The field has a visibility control. Leave it concealed when sharing your screen. RightMessage stores it for server-side checks rather than exposing it in your website snippet.

For protection to work, you need a configured site key, a published site key, and a valid matching secret. Both fields matter.

## Try a normal signup

1. Open the actual page containing your form or identifying question in a clean browser.
2. Submit a synthetic test contact you control.
3. Complete a challenge if one appears.
4. Confirm that the expected contact and mapped data reached the provider.

Complete the test on your website rather than in the dashboard preview, which doesn't make a live protected submission. The check's completion time can vary.

When a normal signup reaches your provider with its mapped data, you've checked that visitors can still sign up with protection enabled.

## If a submission won't go through

Check these settings first:

1. Make sure the site and secret keys belong to the same Turnstile widget.
2. Check that the widget covers the page's domain.
3. Check that you've published the site key.
4. If the browser blocks the Turnstile script, ask your site administrator to review the error and network details.

Protected public submissions need a verified Turnstile token. If it's missing or rejected, the request receives a `422` response.

Some contact actions can look up or update a verified existing contact without a new token. They can't introduce an unchecked email address, so this isn't a way around protection for new leads.

A missing or invalid secret, or an unavailable verification service, is a setup or service failure. It doesn't mean the bot check passed. Fix the settings or investigate the service failure rather than disabling verification in application code.

Never skip server-side verification based on a public RightMessage project identifier or a header someone could forge. If a protected site won't load in the visual editor, follow [safe visual-editor troubleshooting](https://rightmessage.com/help/allow-rightmessage-to-load-your-site-in-the-visual-editor).

Bot protection doesn't replace consent. An Email question's consent settings still control whether RightMessage can identify someone and update your provider. Turnstile also doesn't establish that every recorded analytics event came from a person.