Cloudflare Turnstile

An embedded Turnstile widget validates a token in your application. It is different from a Cloudflare firewall or managed challenge, so a WAF skip rule does not automatically make the widget return a valid token.

Staging or test environments

Use Cloudflare's official Turnstile testing sitekey and matching testing secret. The testing pair produces a dummy token that can be validated with the matching testing secret.

Never deploy Turnstile testing credentials to production. Production secrets reject dummy test tokens.

See Cloudflare's automated-testing guide.

Production websites

If you need FormTester 365 to test the live form:

  1. Turn off the FormTester 365 proxy for the website.
  2. Add a server-side exception that skips Turnstile verification only for these source addresses:
    • 45.56.67.77
    • 2600:3c00::f03c:92ff:fef9:6b3b
  3. Limit the exception to the form page and submission endpoint.
  4. If the widget disables the submit button until it completes, allow the trusted test request to submit without changing behavior for other visitors.
  5. Run a FormTester 365 manual test, then submit from a normal connection to confirm Turnstile is still enforced.

Keep server-side Turnstile verification enabled for every other request. Do not put a reusable bypass token in public HTML, JavaScript, or a URL.

Was this helpful?