Turn on bot protection on your own domain

Why your domain needs its own keys

On your built-in store address, bot protection is already on. On your own domain (for example yourbrand.com), Remavio cannot use its own protection, because Cloudflare allows each protection widget on only a few addresses. To protect forms, quizzes and paid steps on your domain, you create a free widget in your own Cloudflare account and paste its two keys into Remavio.

Create the widget in Cloudflare

1. Sign in to your Cloudflare account (a free account is enough) and open Turnstile.
2. Tap Add widget and give it a name, for example your store name.
3. Under Hostname Management, add every domain your store uses. They are listed in Remavio on the Bot protection tab. Adding yourbrand.com also covers www.yourbrand.com and every other subdomain. You can add up to 10 domains on the free plan, and wildcards such as *.yourbrand.com are not accepted.
4. Keep the widget mode on Managed and save.
5. Copy the Site key and the Secret key.

Add the keys to Remavio

1. In your admin, open Integrations (admin page) and choose the Bot protection tab.
2. Paste the site key and the secret key, then tap Save. Remavio checks the secret key with Cloudflare straight away.
3. When the check passes, turn on Bot protection.
4. Open your store on your own domain and send one test message through a form. The tab then shows when a visitor last passed the check.

If Cloudflare rejects your keys

If you delete the widget or change its secret key in Cloudflare, Remavio shows a red warning on the Bot protection tab. Until you fix it, forms on your domain refuse every visitor. Copy the current keys from Cloudflare again, save them, and the warning clears. You can also turn bot protection off while you fix it.

If the tab never shows a passed visitor check after you have tested a form, the site key and secret key are probably from two different widgets. Copy both again from the same widget.