How do I choose which forms to protect and check the configuration?
After entering your Cloudflare Turnstile keys, choose which forms to protect in the Invisible CAPTCHA module configuration.
Choose the forms to protect
- Open the module configuration, then the Settings tab.
- In the Active Forms section, select Yes for each form to protect and No for those to exclude.
- Click Save in this section.
The module offers the following protections:
- Back office: login and forgotten password.
- Customer account: account creation, login and forgotten password.
- Shop: contact form and guest checkout.
- Additional modules: newsletter sign-up and product availability alert registration.
Newsletter protection requires the ps_emailsubscription module to be enabled. Product availability alerts require ps_emailalerts. If the corresponding module is not enabled, the option is unavailable. A form provided by another module or heavily modified by your theme may require a compatibility check.
Exempt customers who are already logged in
In the Configuration tab, under General configuration, the Disable CAPTCHA for logged in customers option lets you skip CAPTCHA for customers who are already authenticated on the shop. Select Yes to exempt them, or No to keep the check, then save this section.
This option concerns shop customers, not employee login to the back office. Whitelisted IP addresses are another exemption: see How to whitelist IP addresses?.
Check the configuration
- Check that both keys from the same widget are saved and that the hostname being used is authorized in Cloudflare.
- To test the shop without the logged-in customer exemption, use a private browsing window without signing in to a customer account. Also check that your IP address is not exempted by the whitelist.
- Open each enabled form and submit suitable test data. Check that the form works and the expected action completes.
- If you protect the back office, also check its login and forgotten password forms.
The widget mode is selected in Cloudflare: in Invisible mode, no visible widget is expected. The absence of a checkbox therefore does not mean protection is disabled. The modes are explained in the FAQ about Cloudflare keys and widgets.
If a form remains blocked or does not respond, first check its keys, authorized hostname and exemptions. To capture a browser error, see How to detect a JavaScript error?.