Create Turnstile credentials

Your organization administrator should coordinate this setup with the person who manages your Cloudflare account. You need permission to manage Turnstile widgets in that account and the custom hostname shown on the CMS Security page. A widget is the Cloudflare configuration that provides a site key and secret key.

Create a widget in Cloudflare

1. Sign in to the Cloudflare dashboard using your organization's account, open Turnstile, and select Add widget.
2. Give it a recognizable name, such as your site name and hostname.
3. Under Hostname management, add the custom hostname used by your CMS site, such as www.example.com. Enter the hostname without https://, a path, or a port.
4. Choose Managed mode, Cloudflare's recommended starting point. Leave optional pre-clearance settings unchanged unless your site administrator has a specific requirement.
5. Select Create and copy the site key and secret key from this same widget.

These steps follow Cloudflare's widget creation instructions. The example name and hostname are illustrative; use your own site's details.

Add the keys to CMS

The site key identifies the widget in visitors' browsers. The secret key is private and lets CMS verify submissions. They are different values and must belong to the same widget.

Open CMS → Site Settings → Security, select the matching hostname, and follow Configure a hostname to save both keys. CMS handles the verification integration; you do not need to paste Cloudflare's example code into your page content.

Create a separate widget and key pair for each custom hostname you configure in CMS. The site's default address is managed by Industrix and does not need a customer-created pair.

Recommended practices

• Restrict hostnames. Use the specific hostname needed by the form. Cloudflare also allows its subdomains, so choosing www.example.com is narrower than choosing example.com. Check every address visitors use against Cloudflare's hostname rules.
• Protect the secret. Store it in your organization's approved password manager or secret store. Give access only to people responsible for the configuration. Never include it in page content, screenshots, email, or WhatsApp messages.
• Keep ownership clear. Record which site, hostname, and widget the pair belongs to. Coordinate changes through your organization administrator.
• Replace keys carefully. If a secret is exposed or needs replacement, follow Cloudflare's rotation instructions, update the saved secret for the matching CMS hostname promptly, and test the form again. Do not clear a working secret before its replacement is ready.
• Use real widget credentials for public forms. Do not use Cloudflare's sample keys as your site's credentials.

Confirm that forms work

After saving, check that CMS shows the secret as Configured. Open a public form on the same hostname, complete any verification, and submit a clearly labeled test message. Confirm it arrives in CMS → Inbox → Submissions. Repeat for each custom hostname visitors use.

If the form still cannot submit, check the allowed hostname, the matching key pair, and whether the secret was replaced in Cloudflare without being updated in CMS. Ask your organization administrator to contact support if needed, without sharing the secret key.