# Adding CloudFlare Turnstile to your project

**A CAPTCHA defends your website from automated bot attacks, abuse, and fraudulent activity.**

## How to use

You can refer to a sample implementation of CloudFlare Turnstile CAPTCHA in the [`turnstile` branch](../../tree/turnstile) of this repository.

Note you must provide appropriate keys in CakePHP configuration to use the service. You should always use test keys unless your project is in production.

Don't forget to instruct your client to register for production keys on handover deployment.

### What are implemented in the sample?

The sample code implemented the following:
- Add plugin keys to configuration files (such as `config/app_local.php`) instead of hard-coding them
- Create controller components so codes can be reused between Controllers
- Render JS or CSS calls in the header blocks of layout (instead of reference inline, for performance considerations)
- A full front-end implementation of Turnstile with customisation options and JS callbacks (e.g. form submit buttons are disabled unless CAPTCHA is passed)
- A full back-end implementation of Turnstile verification so user cannot login, reset password or register unless a valid CAPTCHA response is in place

### Use other CAPTCHA services?

With the same method demonstrated in this implementation, you can also implement other types of CAPTCHA on your website, such as Google reCAPTCHA.
