Setting up Cloudflare Turnstile

Where to find it: Left menu → Integrations → Security → Cloudflare Turnstile Who it's for: Stores that want to add Cloudflare's bot recognition on top of Treyza's built-in protection. In short: You create a free Turnstile widget at Cloudflare and add your store's domains; then you enter the site key and secret key it gives you into Treyza and verify each domain once on your storefront. It takes about 10 minutes.

What does it do?

Cloudflare Turnstile is Cloudflare's free bot verification service. On top of Treyza's built-in protection, it recognizes malicious traffic with what Cloudflare learns from millions of sites. Most visitors see nothing; if Cloudflare deems it necessary, a one-click verification box appears inside the form.

• It is free and verifications are unlimited.
• You don't need to move your store's domain to Cloudflare or change your DNS settings.
• If Cloudflare can't be reached, visitors are automatically verified with Treyza's built-in protection; your store doesn't lock up. Details: Bot protection: how your store is protected.

Know the order up front (this is where most people get stuck)

Turnstile only works on domains you have registered with Cloudflare in advance. Treyza, in turn, tests your keys once on a domain with Verify on storefront before using them there. On a domain that isn't verified, Treyza's built-in protection keeps running; that way a wrongly copied key or a missing domain can't lock your customers out of signing in.

The correct order:

1. List the domains your store opens on.
2. Open a free Cloudflare account.
3. Create a Turnstile widget and add the domains.
4. Copy the site key and the secret key.
5. Enter the keys into Treyza, test them, enable the integration and save.
6. In the window that stays open, verify each domain with Verify on storefront.
7. Try signing in to your store in a private window.

---

1) List your store's domains

Example: if your store's default address is modashop.treyza.shop and your custom domain is modashop.com, you add these two domains to the widget.

---

2) Open a Cloudflare account

If you already have a Cloudflare account, skip this step.

1. Open dash.cloudflare.com/sign-up.
2. Fill in the Email and Password fields.
3. Press the Create Account button.
4. Click the link in the verification email Cloudflare sends you.

The account is free.

---

3) Create a Turnstile widget

A "widget" is the verification record you create at Cloudflare for your store.

1. Open the Turnstile page in the Cloudflare dashboard. Direct link: dash.cloudflare.com/?to=/:account/turnstile
2. Press the Add widget button.
3. Fill in the form like this:

4. Press the Create button.

Widget mode options:

Is there a limit on the free plan? On the free plan you can create up to 20 widgets and add up to 10 domains to each widget. Verifications are unlimited. That's more than enough for a store.

---

4) Copy the keys

Once the widget is created, Cloudflare shows two keys. Copy both and keep them somewhere safe:

---

5) Enter the keys into Treyza

1. In the Treyza panel, open Integrations from the left menu.
2. In the Security section, click the Cloudflare Turnstile card.
3. Fill in the fields in the window that opens. The field names currently appear in Turkish in the panel even in English; this table writes them as they appear on screen:

4. Press the Test Connection button and read the result (the message appears in Turkish):

5. Turn on the Enable Integration switch.
6. Press the Save button. The window stays open and the Domain verification list appears together with the text "Saved. Now verify your domains on the storefront."

Enabling first is safe: Turnstile is used only on verified domains; on domains that aren't verified, Treyza's built-in protection keeps running.

An action you turn off (for example Formlarda kullan) stays protected by Treyza's built-in protection instead of Turnstile; no action is left unprotected. Form file uploads are always verified with the built-in protection.

---

6) Verify your domains on the storefront

The keys you saved don't take effect right away. In the window you see this description: "Keys take effect on a domain only after being verified once on your storefront; until then your customers are protected by Treyza's built-in protection."

1. Look at the Domain verification list in the window that stayed open after saving; it lists all of your store's domains. Next to the heading you see the provider's name and the integration's status (Active or Inactive). (The same list also appears on the Treyza Bot Protection card in the Integrations → Security section.) If the keys haven't been saved yet or the window has unsaved changes, you see "Save the keys first to verify your domains." instead of the list; press Save first.
2. Press the Verify on storefront button next to a domain. Your store's sign-in page on that domain opens in a new tab. You don't need to sign in.
3. If Cloudflare's verification box appears on the page, tick it. Within a few seconds a result banner appears on the page: "Bot protection is verified on this domain. You can go back to the panel and refresh."
4. Go back to the panel tab; the list in the window refreshes by itself. Repeat steps 2–3 for the other domains in the list.
5. When you're done, close the window with Close and refresh the page. The domains' statuses appear in the list on the Treyza Bot Protection card; the domains you verified show Verified.

Each domain in the list shows one of these statuses:

If no domain is verified yet, the list says "The keys haven't been verified on any domain yet." If the integration is Active, this note is shown as a warning; if it's Inactive, as an information note.

If verification fails, the banner says "Verification failed:" followed by the reason:

---

7) Check that it works

1. Open a private window in your browser (Ctrl + Shift + N in Chrome). That way your open panel session doesn't affect the test.
2. On a verified domain, open your store's sign-in page, for example https://modashop.treyza.shop/login.
3. Most of the time you see nothing; Turnstile runs in the background. If Cloudflare deems it necessary, a one-click box appears in the form.
4. Sign in with a customer account. The sign-in should succeed.
5. In the Treyza panel, on the Integrations → Security → Treyza Bot Protection card, the Verification method should be Cloudflare Turnstile and the Passed count under Last 7 days should go up.
6. If you like, open your widget on Cloudflare's Turnstile page: within a few minutes you'll see the verification counts (e.g. Challenges issued, Valid tokens).

---

Troubleshooting

For errors during verification, first check the "Reason on the banner" table in step 6. For problems on the customer's side, Cloudflare's error code appears in the browser's developer console (the F12 key); the first three digits of the code tell you the kind of problem.

---

Rotating the secret key

Rotate the secret key if you suspect it has fallen into someone else's hands.

1. Open the Turnstile page at Cloudflare and select your widget.
2. Choose Settings → Rotate Secret Key.
3. Copy the new secret key.
4. In Treyza, open Integrations → Security → the Cloudflare Turnstile card.
5. The Gizli anahtar (Secret Key) field is empty; the last four characters of the old key are shown under it (e.g. "Saved key: ••••1234"). Paste the new key into this empty field.
6. Check it with Test Connection and press Save. After saving, the Saved key line shows the last four characters of the new key.
7. Because the secret key changed, the domain verifications are reset: run Verify on storefront again for every domain in the list in the window that stays open, then press Close. Meanwhile your customers are protected by the built-in protection.

The site key doesn't change; you only update the secret key.

---

Frequently asked questions

Is Turnstile paid? No. Turnstile is free and verifications are unlimited. The free plan allows up to 20 widgets and up to 10 domains per widget.

My domain isn't on Cloudflare. Is that a problem? No. Turnstile works on any site; you don't need to move your domain to Cloudflare or change DNS settings.

I saved the keys, but my customers are still verified with the built-in protection. Turnstile takes effect on a domain only when two conditions are both met: the domain has been verified with Verify on storefront, and the Enable Integration switch is on. Verify every domain marked Not verified in the Domain verification list and check that the integration is enabled (steps 5 and 6).

Can I use Cloudflare's test keys? No. Cloudflare's public test keys let every visitor through, bots included; the protection would only be for show, so Treyza doesn't accept these keys. If you enter them, Save shows "Documented test keys can't be used on a live store; copy your real keys from the provider's dashboard." Use your own widget's keys.

I have several stores. Can I use the same widget? You can (you add every store's domain to the same widget and enter the same keys in each store). Still, we recommend a separate widget per store: Cloudflare's statistics are split store by store, and rotating one store's key doesn't affect the others.

I connected a new custom domain. First add the new domain to your widget at Cloudflare (Settings → Hostname Management → Add Hostnames), then press Verify on storefront for that domain in the Domain verification list in Treyza. Until you verify it, the built-in protection runs on that domain.

I see a "Fix with Spin" notice in the Cloudflare dashboard. Cloudflare shows this notice when it sees no verified request for the widget. It disappears once you have verified your domains and the first sign-ins happen on your storefront. If it persists, check that the Enable Integration switch is on, the domains show Verified, and that you entered this widget's keys into Treyza.

Which language does the verification box use? The box is shown in whatever language your storefront was opened in.

What happens if I turn Turnstile off? When you turn off the Enable Integration switch and press Save, every action goes back to Treyza's built-in protection; you can close the window with Close. Your keys are not deleted.

Do I need to do anything for data protection (KVKK)? Yes. Turnstile sends the visitor's IP address, browser information (User-Agent) and technical signals about their connection (the TLS fingerprint) to Cloudflare for bot detection; Cloudflare is a company based abroad. Cloudflare states that it collects these signals not to identify or target anyone but only to detect and block bots, and that it doesn't use them for advertising. You need to describe this processing in your privacy notice; for suggested wording and a note on transfers abroad, see the Legal Pages (Agreements) page.

---

Related pages

• How bot protection works and the summary card: Bot protection: how your store is protected
• Setting up Google reCAPTCHA: Setting up Google reCAPTCHA
• Setting up and enabling integrations: Managing Integrations (List, Setup, Turning On/Off)
• Connecting a custom domain: Custom Domain
• Privacy notice and cookie policy: Legal Pages (Agreements)