Bot Protection
Client Cove uses Cloudflare Turnstile to keep bots off your sign-in forms — credential stuffing on login, junk accounts on registration, email spraying on password reset. For real people it is usually invisible; a bot gets a challenge it cannot pass.
What It Is
Turnstile is Cloudflare's CAPTCHA replacement. Instead of making everyone pick fire hydrants out of photos, it verifies the visitor silently in the background and only escalates to a visible check when something looks off. Client Cove verifies every token server-side with Cloudflare before the protected form's real work runs — a submission with a missing or failed token is refused before the password is even checked.
Setting It Up
- Create a free Turnstile widget at your Cloudflare dashboard — add every domain the portal runs on to its allowed domains
- Copy the site key and secret key
- In Client Cove: Settings → Authentication → Cloudflare Turnstile — enable it, paste both keys
- Choose which forms it protects (all three are recommended)
That's the whole setup. No Cloudflare account changes beyond the widget, and your site does not need to be behind Cloudflare's proxy.
Which Forms It Protects
Each has its own toggle:
| Form | Behavior |
|---|---|
| Login | Adaptive — invisible until failed attempts (see below) |
| Registration | Always visible |
| Forgot password | Always visible |
Why You Usually Cannot See It
On the login form, Turnstile runs in adaptive mode: for the first attempts it is completely invisible — no widget, no badge, zero friction for a legitimate client typing their password. After two failed attempts from the same address or username, the visible challenge appears and must be completed before further tries.
So "I don't see it on the login page" almost always means it's working. To confirm it's wired up, view the page source on /login/ — you'll find a <div class="cf-turnstile"> element and the challenges.cloudflare.com script tag even when nothing is drawn — or simply fail two logins and watch the widget appear.
How Verification Works
For the technically minded:
- The browser widget mints a single-use token; the server redeems it with Cloudflare's siteverify API before the form's handler runs. Tokens cannot be reused.
- Tokens are scoped to the form that minted them — a token from the registration form is rejected on login, so a bot cannot harvest tokens on one surface and spend them on another.
- Hostname enforcement is available for strict setups: verification can require the token to have been solved on your own domain. It is off by default — Cloudflare already restricts widgets to their allowed domains, and on a proxied or aliased install a wrong hostname guess would lock everyone out of login. Once you've confirmed your setup, a developer can enable it with the
cove_turnstile_enforce_hostnamefilter. - If Turnstile is disabled, verification is skipped entirely — forms behave as if the feature didn't exist.
Troubleshooting
Error 110200 in the browser console, and no widget renders. The page's domain is not in the widget's allowed-domains list in Cloudflare. Add it — and note this includes localhost for local development sites. Because verification is enforced whenever the feature is on, a domain mismatch doesn't just hide the widget; it blocks password login on that domain until the domain is added or the feature is toggled off.
"Please complete the captcha verification" on every attempt. The widget isn't minting tokens — usually the domain problem above, or the Turnstile script being blocked by an aggressive ad blocker.
Testing without a real widget. Cloudflare publishes test keys that always pass (site key 1x00000000000000000000AA, secret 1x0000000000000000000000000000000AA) — they work on any domain and render a banner saying they're for testing. Useful on development sites; never leave them on production, since they wave everything through.