Cloudflare Turnstile
Turnstile is Cloudflare’s alternative to a CAPTCHA. It checks that a visitor is a real person without making them identify traffic lights, and in most cases without them noticing at all.
Brixit uses it in two places: the login page, and public lead forms. Lead forms are the reason it matters — a public form with no bot protection fills your CRM with junk contacts, and every one of them is a notification somebody has to dismiss.
What you need
A Cloudflare account. You do not need your domain to be on Cloudflare’s DNS — Turnstile works on any site.
Create a widget
- In the Cloudflare dashboard, open Turnstile and press Add widget.
- Give it a name and add your domain under Hostname Management.
- Choose a widget mode. Managed is the right default: invisible to most visitors, with a checkbox only when Cloudflare is unsure.
Add every hostname the widget will appear on. If your CRM is at crm.example.com, that is the hostname — not example.com. A hostname mismatch is the most common cause of a widget that renders and then refuses to validate.
Fill in the fields
Settings → Integration keys → Security → Cloudflare Turnstile.
| Field | Where to find it |
|---|---|
| Site Key | Cloudflare dashboard, on your widget |
| Secret Key | Same widget, beside the site key |
The Site Key is public — it appears in the page source, which is expected. The Secret Key is not, and is stored encrypted.
Checking it works
Open your login page in a private window. The widget appears below the password field; in managed mode it usually resolves on its own within a second.
If it shows an error code, Cloudflare’s widget documentation lists them. 110200 means the hostname is not on the widget’s list.
Turning it off
Clear both fields and save. Bot protection is skipped when no credentials are present, so removing them is enough — there is no separate switch to find.