Secure your petitions with SpeakOut! Pro's new Cloudflare Turnstile integration.

See Pro Features

How to Secure Your Petitions with CAPTCHA (Turnstile, reCAPTCHA, or hCaptcha)

Spam bots are constantly crawling the web looking for forms to submit fake data to. If your petition form is unprotected, you risk receiving hundreds of fake signatures, which can undermine the credibility of your campaign.

SpeakOut! Pro includes built-in, server-secured integration with the three most popular anti-spam services: Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.

How It Works (The Security)

SpeakOut! Pro uses a secure two-step verification process to guarantee that every signature is from a real human:

  1. The Frontend Check: When a user visits your petition, the CAPTCHA widget analyzes their browser behavior to determine if they are human. If they pass, it generates a unique, temporary “Security Token.”
  2. The Backend Verification: When the user clicks “Sign,” SpeakOut! doesn’t just trust the token. It securely sends that token directly from your website’s server to the CAPTCHA provider’s server to verify its authenticity. If a bot tries to bypass the visual form and submit data directly to your database, the server will block the signature and return a “Please complete the security check” error.

Are These Services Free?

Yes! All three of these services operate on a “freemium” model. They are 100% free for almost all websites, and only charge massive enterprise companies processing millions of forms per month.

  • Cloudflare Turnstile: Completely Free. Cloudflare offers this explicitly as a free, privacy-first alternative for everyone on the web.
  • Google reCAPTCHA: Free. It is completely free for up to 1,000,000 requests (form loads) per month.
  • hCaptcha: Free “Publisher” Tier. Their free tier gives you standard bot protection and easily covers up to 1 million requests per month. (They only charge for “Pro” tiers if you want advanced enterprise features).

Which CAPTCHA Should You Choose?

Selecting the right service depends on whether you value user experience, privacy, or brand recognition. While all three options provide excellent security, they each handle “human verification” differently.

If you want the best conversion rate, choose Cloudflare Turnstile. It is our top recommendation because it is “frictionless”—it rarely asks users to solve puzzles, meaning your supporters can sign your petition faster without getting frustrated. It is also the most privacy-friendly option, as it does not track users for advertising. If you aren’t sure which
to pick, start with Turnstile.

1. Cloudflare Turnstile (Highly Recommended )

Cloudflare Turnstile is the newest and most advanced option. It is a “frictionless” alternative to traditional CAPTCHAs.

  • Pros: It is incredibly fast and highly focused on user privacy (it doesn’t track users for ad targeting). Best of all, it almost never asks your supporters to solve frustrating
    image puzzles (like clicking on traffic lights or crosswalks). It usually verifies them silently in the background or with a simple checkbox.
  • Cons: None. It is the modern standard.

2. Google reCAPTCHA

This is the industry standard that everyone recognizes. SpeakOut! supports both v2 (the familiar “I am not a robot” checkbox and image puzzles) and v3 (which runs invisibly i
n the background and assigns a risk score).

  • Pros: Backed by Google’s massive data network, making it very accurate at spotting bots.
  • Cons: Major privacy concerns. Google tracks user behavior across the web to determine if they are human. The image puzzles in v2 can be highly frustrating for users and reduce your signature conversion rates.

3. hCaptcha

hCaptcha was built as a direct, privacy-first competitor to Google reCAPTCHA.

  • Pros: It respects user privacy much more than Google and complies with strict privacy laws like GDPR and CCPA.
  • Cons: Because it doesn’t track users across the web like Google does, it has less data to work with. To compensate, it forces users to solve image puzzles much more frequently than Google or Cloudflare.

How to Enable Your Preferred CAPTCHA

To use any of these services, you must first register your website with the provider to get a pair of API keys (a “Site Key” and a “Secret Key”).

Option A: Setup Google reCAPTCHA

  1. Go to the Google reCAPTCHA Admin Console.
  2. Register your site and choose between reCAPTCHA v2 or reCAPTCHA v3.
  3. Copy the generated Site Key and Secret Key.
  4. In WordPress, go to SpeakOut! Pro > Settings.
  5. Under the “Enable Google recaptcha?” section, check the box to turn it on.
  6. Select the version you registered for (v2 or v3) from the dropdown.
  7. Paste your Site Key and Secret Key, then click Save. (Note: reCAPTCHA applies globally to all your petitions).

Option B: Setup hCaptcha

  1. Go to the hCaptcha Dashboard and sign up.
  2. Add your website as a new site to generate your keys.
  3. Copy the Site Key and Secret Key.
  4. In WordPress, go to SpeakOut! Pro > Settings.
  5. Under the “Enable hCaptcha?” section, check the box to turn it on.
  6. Paste your Site Key and Secret Key, then click Save. (Note: hCaptcha applies globally to all your petitions).

How to Configure and Use Cloudflare Turnstile in SpeakOut! Pro

Cloudflare Turnstile is a powerful, privacy-first alternative to CAPTCHA that protects your petition forms from spam and bots. Best of all, it works almost entirely in the background, without forcing your real supporters to solve annoying puzzles (like identifying traffic lights or crosswalks).

This guide will walk you through setting it up and customizing how it looks.

Step 1: Get Your Turnstile Keys from Cloudflare

  1. Log into your Cloudflare Dashboard (or create a free account if you don’t have one).
  2. In the left-hand sidebar, navigate to Turnstile.
  3. Click the Add widget button.
  4. Give your widget a name (e.g., “SpeakOut Petitions”).
  5. Enter your website’s domain name under Domain.
  6. Choose your Widget Mode:
    • Managed (Recommended): Cloudflare decides whether to show a checkbox based on the user’s risk profile. It usually passes good traffic silently.
    • Non-interactive: Shows a brief loading animation but never requires the user to click anything.
    • Invisible: Operates entirely in the background and is completely hidden from the page
  7. Click Create.
  8. Cloudflare will now provide you with a Site Key and a Secret Key. Keep this page open.

Step 2: Add Your Keys to SpeakOut!

  1. In your WordPress admin dashboard, go to SpeakOut! Pro > Settings.
  2. Click on the Petition Form tab.
  3. Scroll down to the Enable Anti Spam section and select Cloudflare Turnstile.
  4. Copy and paste the Site Key and Secret Key from Cloudflare into the respective fields.
  5. Click Save Settings at the bottom of the page.

That’s it! Cloudflare Turnstile is now globally protecting all of your petition forms against bots.

Advanced Customization (Theme & Size)

While the Widget Mode (Invisible vs. Visible) is controlled directly inside your Cloudflare dashboard, SpeakOut! allows you to control exactly how the visible widget renders on you
r website to match your branding.

In the WordPress dashboard under SpeakOut! Pro > Settings, simply select Cloudflare Turnstile under the Enable Anti Spam option. You will see two additional drop downs below your keys:

  1. Theme:
    • Auto (Default): The widget automatically switches between Light and Dark mode based on the user’s preferences.
      • Light: Forces the widget to always use a light background.
      • Dark: Forces the widget to always use a dark background (great for websites with dark themes).
  2. Size:
    • Normal (Default): Renders the standard-width widget.
    • Compact: Renders a much narrower widget. This is highly recommended if you are placing your petition in a narrow sidebar or a tight column where the normal widget might get cut off.

Pro Tips

  • Analytics: SpeakOut! automatically tags every Turnstile check with your petition’s ID. If you log into your Cloudflare dashboard, you can filter your Turnstile analytics to see
    exactly how much bot traffic is being blocked on each specific petition!
  • Language: You don’t need to configure language settings. SpeakOut! automatically detects the active language of your WordPress site and forces Turnstile to render in that exact
    language for a perfectly seamless international experience.