Configure site security
Set up the verification required for public forms on a site's customer hostnames.
Cloudflare Turnstile verification is required for public-facing contact and inquiry forms to accept submissions. If Turnstile is missing or incorrectly configured for the address visitors use, public forms will not work: visitors cannot submit contact messages or inquiries. CMS verifies a form submission before saving it. Treat form security as a prerequisite when preparing a CMS site for public forms.
The CMS Security page configures a separate Turnstile site key and secret key for each custom customer hostname. Set up the hostname under Domain Settings first; if no customer hostname is available, the Security page has no hostname to configure. The site's default address uses a platform-managed Turnstile configuration.
Create the credentials first
If you do not have the keys yet, follow Create Turnstile credentials. The guide explains the Cloudflare setup and recommended practices for hostname restrictions, secret storage, and key replacement. If you are not the organization administrator, ask your administrator to arrange the setup with the person who manages your Cloudflare account.
Configure a hostname
- Select the site, then open CMS → Site Settings → Security in App.
- In Cloudflare Turnstile, choose the Hostname you want to configure and select Edit.
- Enter the Turnstile site key and Turnstile secret key issued for that hostname. Confirm the hostname and key pair with the person who manages your Turnstile account.
- Select Save. Check that the secret key shows Configured afterward. Repeat for each customer hostname that needs Turnstile.
Before inviting visitors to use forms on a custom domain, confirm its domain verification is complete, its Turnstile keys are configured for the same hostname, and a test submission succeeds.
The saved secret is masked and is not displayed back to you. Enter a new secret only when you need to replace it. The Clear stored secret key option removes the saved secret when you save; use it only when you intend to stop using that key.
If the site warns that Turnstile is not configured for a custom domain, check that you selected the right hostname and saved both keys. Do not put secret keys in a support message or screenshot.