December 20, 2025 · 7 min read

How I Stopped Contact Form Spam with Cloudflare Turnstile

After implementing Turnstile spam submissions dropped to virtually zero.

The Problem: Contact Form Spam

Contact form with Turnstile widget

For months, my website's contact form was getting hammered with spam. Dozens of fake submissions every day—everything from cryptocurrency pitches, SEO services to random garbage text.

I wanted something that actually worked without punishing real users.

What is Turnstile?

Turnstile is Cloudflare's privacy-friendly CAPTCHA alternative. Unlike traditional CAPTCHAs that make users click on fire hydrants or type distorted text, Turnstile runs quietly in the background.

Most legitimate users never have to interact with it—it just works. The verification happens behind the scenes, and only suspicious traffic gets challenged.

The Results

Since implementing Turnstile, my spam submissions have dropped to virtually zero.

And the best part: real users haven't complained once. Most people don't notice anything different because the experience is almost invisible.

Formulario de contacto con widget de Turnstile

Turnstile normally doesn't need any interaction from the user, it will try to automatically validate if the user is human or not.

Implementation Was Simple

The setup took about 20 minutes end to end:

1. Generated the Cloudflare Site Key and Turnstile Secret Key.

2. Added the Turnstile widget to my contact form with a small React wrapper.

3. Added server-side verification to check the token before processing submissions.

No complicated configuration, no ongoing maintenance. Once it was wired in, it just stayed out of the way.

Should You Use It?

If you're dealing with contact form spam, I can strongly recommend Turnstile. It's free for most use cases, respects user privacy, and actually works in practice.

The user experience is seamless, the integration is straightforward, and the spam protection is robust. My contact form is finally usable again, and I'm not wasting time deleting junk every morning.

If you want to implement it yourself, the Cloudflare Turnstile documentation has everything you need.