FormThunder isn't open yet. This site describes the service as it will run at launch. Find out more

FormThunder
Menu

Run a contact form on Cloudflare Pages with Turnstile spam checks

A contact form on Cloudflare Pages can post straight to FormThunder with no Pages Function or Worker. To keep bots out, add a Turnstile widget: create it in your Cloudflare dashboard, store its site key and secret on the form, and FormThunder verifies each token before accepting the submission. Turnstile and custom captcha keys need the Pro plan.

Updated

The Cloudflare Pages code

contact.html
<form action="https://formthunder.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <label>Name <input name="name" required></label>
  <label>Email <input name="email" type="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>
  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITE_KEY"></div>
  <button type="submit">Send</button>
</form>
<script src="https://formthunder.com/client/script.js" async></script>
Store the secret on the form
curl -X PATCH https://formthunder.com/api/v1/forms/YOUR_FORM_ID \
  -H "Authorization: Bearer ft_live_..." \
  -H "Content-Type: application/json" \
  -d '{"spam":{"captcha":"turnstile","site_key":"YOUR_TURNSTILE_SITE_KEY","secret":"YOUR_TURNSTILE_SECRET","filter":true}}'

Replace YOUR_ACCESS_KEY with your free key. It's public by design, so it's safe in client code.

Notes for Cloudflare Pages

  • The Turnstile secret goes on the form through the API, the CLI or the dashboard. It never goes in your HTML, and your site needs no Worker to hold it.
  • In the Turnstile widget settings, list your production and *.pages.dev hostnames, or the widget fails on preview URLs.
  • /client/script.js renders any .cf-turnstile it finds. If you turned on Rocket Loader, it may delay the script. Add data-cfasync="false" to that script tag if the widget is slow to show.
  • Using a Pages Function to forward the post is possible, but every visitor then shares your Worker's IP for rate limits, so post from the browser.

Or have your AI add it

Connect the MCP server, then ask. The agent creates the form and writes the code for you, and it can send a real test when it's done.

You, to your AI
Add a FormThunder contact form to this Cloudflare Pages site that emails hello@example.com. Send a test when you're done.

Questions

Do I need a Cloudflare Worker for a contact form?

No. The browser posts straight to FormThunder. A Worker would only add a step.

Do I need Turnstile?

No. The honeypot and spam filter are on every plan, and hCaptcha is on Free too. Turnstile is one option on Pro.

Related guides

Get your Cloudflare Pages form sending

The free plan covers 250 submissions a month, with MCP, the CLI and the brand kit included.

Get started freeRead the quickstart