Turnstile on your forms
Create a Cloudflare Turnstile widget (by prompt through the Cloudflare MCP), put it on the order form and the login form, check every token on the server in placeOrder and signIn, use Cloudflare's test keys on your laptop, and prove that a missing or failed token is refused.
Why this matters
Your forms now refuse bad data (Lesson 10.4). But a bot doesn't have to send bad data. It can fill in the order form perfectly: a real-looking name, a real-looking phone number, two plates of jollof, a pickup at 12:30. Then do it again. And again. Five hundred times before Adjoa wakes up. Every one passes your checks, lands in her dashboard and triggers two emails.
The fix is to check that the sender is a person before you do anything else. That's what Cloudflare Turnstile does. For most visitors it takes a second and asks nothing of them. A small box on the form shows a spinning check, then a tick. Bots don't get a tick.
There's one part you must get right, and it's the part beginners most often skip: the check only counts if your server verifies it. A Turnstile box on the page with no server check is a sign saying "Guard on duty" with nobody behind it. In this lesson the widget goes on the page and the server checks every token, and you'll prove both.
In the full lesson
- The idea in plain English
- Do it
- Check it worked
- Understand what AI wrote
- Quick check
- What you can do now
The step-by-step, the prompt to copy, the video and the check-it-worked list, for every lesson in all 15 modules. GHS 399 ($40), paid once by mobile money or card, yours to keep.