June 5, 2026
Add CAPTCHA Spam Protection to Your Store
Stop bots from flooding your store's forms with fake signups and spam. A simple, step-by-step guide to turning on free CAPTCHA protection with Cloudflare Turnstile in about five minutes.
Every online store with a contact form, a newsletter box, or account signup eventually attracts bots. They push junk through your forms, fill your inbox with spam, and create fake accounts that clutter your customer list. CAPTCHA protection quietly blocks that traffic before it reaches you, and your real customers barely notice it is there.
Rovela uses Cloudflare Turnstile for this, a modern and privacy-friendly alternative to the old puzzle-style CAPTCHAs. Most visitors are verified automatically with nothing to click. Setting it up takes a few minutes and it is free. This guide walks you through every step.
What CAPTCHA does for your store
Once it is turned on, Rovela adds a small verification check to the public forms on your store, such as your contact form, newsletter signup, and account registration. Genuine visitors pass through smoothly, while automated bots are stopped at the door. The result is fewer spam messages, fewer fake signups, and a cleaner customer list.
What you will need
- A free Cloudflare account. If you already use Cloudflare for anything else, the same account works.
- Your store's web address, for example your-store.rovela.app, or your own custom domain if you have connected one.
- About five minutes.
Step 1: Open Cloudflare Turnstile
Go to dash.cloudflare.com and sign in, or create a free account if you do not have one yet. Once you are in, find Turnstile in the menu on the left side of the dashboard and open it.
Step 2: Create a widget for your store
Click Add widget to create a new check. Cloudflare asks for a few details:
- Name: any label that helps you recognize it later, such as your store name.
- Hostname: your store's web address, entered without the https:// part, for example your-store.rovela.app. If you also use a custom domain, add it here as well so the protection covers both addresses.
- Widget mode: choose Managed. This is the recommended option and gives the best balance between strong security and a smooth experience for your customers.
Save the widget when you are done.
Step 3: Copy your two keys
After the widget is created, Cloudflare shows two keys:
- A Site Key, which is safe to show publicly.
- A Secret Key, which must stay private.
Keep this page open, or copy both keys somewhere safe for a moment. You will paste them into Rovela in the next step. If you ever misplace the secret key, you can return to this widget in Cloudflare and reset it.
Step 4: Add the keys in Rovela
Back in your Rovela store, open the Features area and find Spam protection (CAPTCHA) under Integrations. Paste your Site Key and Secret Key into the matching boxes, then apply. Rovela handles the rest and turns on protection across your public forms automatically. Your secret key is stored securely and is never shown to your visitors.
What your customers will see
For most visitors, a small verification box appears on the form and confirms them on its own within a second, with nothing to click. Only when something looks suspicious is a visitor asked to take a quick extra step. Your checkout and product pages are not affected, so the shopping experience stays exactly the same.
Tips for a smooth setup
- Add every address you use. If your store answers on both a www version and a plain version of your domain, add both as hostnames in the same widget so no form is left unprotected.
- It stays free for normal store traffic. Cloudflare Turnstile is free, and the included usage is far more than a typical store will ever need.
- You stay in control. If you ever want to remove the protection, you can uninstall the feature in Rovela, and your forms go back to working without the check.
Common questions
Will this slow down my store? No. The check is lightweight and runs in the background while the page loads.
Do I need to be technical? No. The only task is copying two keys from Cloudflare into Rovela. There is nothing to code and nothing to install.
Does it collect my customers' personal data? Cloudflare Turnstile was built to respect privacy and does not rely on tracking your visitors around the web, which makes it a friendlier choice than older CAPTCHA tools.
Last verified: 2026-06-05
