Add Cloudflare Turnstile CAPTCHA support for comment forms

[OldMan-Jakob]

Currently, Akeeba Engage supports any CAPTCHA implemented via Joomla’s CAPTCHA API—however, Cloudflare Turnstile isn’t recognized because it’s integrated via form fields, not the legacy Joomla interface Engage expects. Could you add Turnstile support or ensure Engage uses the Global CAPTCHA plugin regardless of implementation style? This would allow users to use a privacy-friendly, non-Google CAPTCHA solution on comment forms. Thanks!

[nikosdion]

The Joomla CAPTCHA interface is not legacy. Whoever told you that is an absolute and complete moron. Please, do name and shame. The community needs to know if there are shady developers spreading FUD about Joomla just because they are too incompetent to write the simplest of all Joomla plugins, a CAPTCHA plugin!

There's an entire CAPTCHA category over at the JED. Here are some CAPTCHA plugins which do work and fulfil your criteria:

• Cloudflare Turnstile
• hCAPTCHA
• ALTCHA

[OldMan-Jakob]

My apologies, Nicholas, if I didn't make myself clear.
I am using the Cloudflare Turnstile captcha plugin from the JED, but what I found is that Engage apparently didn't recognise the plugin, which I'd defined as in the Global Settings. I tried the two alternative settings in Engage, which are "None" or "Global", and all I got was either nothing with the choice of "None" as expected and choosing "Global" resulted in:
"reCAPTCHA v3 site key is missing. Please contact the website's administrator."
So all I was trying to say, it would be nice if Engage also accepted Cloudflare Turnstile. I certainly didn't want to imply anything about Joomla's interface. I have been using Joomla since Version 1.1 and your own Components almost as long and will continue to do so.

[nikosdion]

Engage doesn't "recognise" anything. The configuration XML file uses Joomla's built-in field to select a CAPTCHA plugin. You can select any published CAPTCHA plugin accessible by your user, as is the Joomla default. The form field is the built-in Joomla CAPTCHA field which uses whichever CAPTCHA plugin you have configured. The code that checks the CAPTCHA simply calls Joomla's CAPTCHA API to request verification.

[OldMan-Jakob]

OK. So where, I wonder, is that error coming from? But it's not a big deal. I'm sorry to have bothered you and as always, thank you for your very fast replies. Best Regards David

…

On Fri, 8 Aug 2025 at 17:45, Nicholas K. Dionysopoulos < ***@***.***> wrote: Engage doesn't "recognise" anything. The configuration XML file uses Joomla's built-in field to select a CAPTCHA plugin. You can select any published CAPTCHA plugin accessible by your user, as is the Joomla default. The form field is the built-in Joomla CAPTCHA field which uses whichever CAPTCHA plugin you have configured. The code that checks the CAPTCHA simply calls Joomla's CAPTCHA API to request verification. — Reply to this email directly, view it on GitHub <#345 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2BV2TCWWVQUQVS5Z5FQTW33MTAZPAVCNFSM6AAAAACDNU57IKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBUG44DAMA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[nikosdion]

I can only tell you with 100% confidence that it's a user error. I have a live demo site using CloudFlare Turnstile with Akeeba Engage using the same plugin you said you are using.

To help you better understand what is going on I decided to set it all up again and document the process even though it has nothing to do with my own software. I have about 30' waiting for the food to cook, so here it goes.

First of all, you need to create a CloudFlare Turnstile widget. When doing so, you MUST specify the hostname of your site. For example, if your site is https://www.example.com you MUST add the hostname www.example.com (and example.com to be extra sure) AND remember to select them in the Turnstile widget creation page. As for the other options, here's what I am using:

In your Joomla site you MUST publish the “Captcha - Cloudflare Turnstile” plugin making sure that its Access is set to Public. Moreover, you MUST configure the plugin with the Site Key and Secret Key you got when you created your CloudFlare Turnstile widget, like so:

At this point, you can select the widget in Akeeba Engage's Options page:

Once you do that and save the options, the CloudFlare Turnstile (non-)CAPTCHA appears correctly in the comment form:

I can also confirm that it works just fine:

I am 99.999% sure that you have simply forgotten to publish the “Captcha - Cloudflare Turnstile” plugin and/or mucked up its Access. You wouldn't be the first or last person to do that. You have to remember that an unpublished Joomla! plugin does NOT load, and does NOT appear in any selection drop-down provided by Joomla for plugin-provided features (like CAPTCHA). The same applies for plugins whose Access is set to something your user cannot, well, access. For example, if you make the grave mistake of changing a plugin's Access to Guest your Super User cannot access the plugin because the Guest access level only applies to people who are NOT logged in yet and, well, you are most definitely logged in 🤪 Finally, whenever you have a plugin talking to a third party service you MUST configure it before you use it. Failure to do so mathematically leads to issues for what I would presume is obvious reasons.

I believe that armed with this knowledge you can now set up your comments without a problem.

[OldMan-Jakob]

Dear Nicholas You are just amazing! Thank you so much for taking the time to do all this! It never ceases to amaze me, the commitment you show. I'm sure many others will also benefit from this detailed description. I have checked each step as recommended. And have got it working. Thank you. Best regards David

…

On Sat, 9 Aug 2025 at 11:08, Nicholas K. Dionysopoulos < ***@***.***> wrote: I can only tell you with 100% confidence that it's a user error. I have a live demo site using CloudFlare Turnstile with Akeeba Engage using the same plugin you said you are using <https://extensions.joomla.org/extension/cloudflare-turnstile/>. To help you better understand what is going on I decided to set it all up again and document the process even though it has nothing to do with my own software. I have about 30' waiting for the food to cook, so here it goes. First of all, you need to create a CloudFlare Turnstile widget <https://dash.cloudflare.com/sign-up?to=/:account/turnstile>. When doing so, you *MUST* specify the hostname of your site. For example, if your site is https://www.example.com you *MUST* add the hostname www.example.com (and example.com to be extra sure) *AND* remember to select them in the Turnstile widget creation page. As for the other options, here's what I am using: Screenshot.2025-08-09.at.11.52.36.png (view on web) <https://github.com/user-attachments/assets/8e47c2ab-0c28-44e0-a042-14d5e7fa63fd> In your Joomla site you *MUST* publish the “Captcha - Cloudflare Turnstile” plugin making sure that its Access is set to Public. Moreover, you *MUST* configure the plugin with the Site Key and Secret Key you got when you created your CloudFlare Turnstile widget, like so: Screenshot.2025-08-09.at.11.58.52.png (view on web) <https://github.com/user-attachments/assets/b4fb4e25-0650-4525-a3fe-ee50a4e1be92> At this point, you can select the widget in Akeeba Engage's Options page: Screenshot.2025-08-09.at.12.00.27.png (view on web) <https://github.com/user-attachments/assets/0e58439b-7897-4633-b29c-d10a3e2591cf> Once you do that and save the options, the CloudFlare Turnstile (non-)CAPTCHA appears correctly in the comment form: Screenshot.2025-08-09.at.12.01.03.png (view on web) <https://github.com/user-attachments/assets/b22e7e99-97d4-40d1-b63b-14892a53532d> I can also confirm that it works just fine: Screenshot.2025-08-09.at.12.01.55.png (view on web) <https://github.com/user-attachments/assets/37843718-96dd-4c21-8486-9da15b7dc46e> I am 99.999% sure that you have simply forgotten to publish the “Captcha - Cloudflare Turnstile” plugin and/or mucked up its Access. You wouldn't be the first or last person to do that. You have to remember that an unpublished Joomla! plugin does NOT load, and does NOT appear in any selection drop-down provided by Joomla for plugin-provided features (like CAPTCHA). The same applies for plugins whose Access is set to something your user cannot, well, access. For example, if you make the grave mistake of changing a plugin's Access to Guest your Super User cannot access the plugin because the Guest access level only applies to people who are NOT logged in yet and, well, you are most definitely logged in 🤪 Finally, whenever you have a plugin talking to a third party service you MUST configure it before you use it. Failure to do so mathematically leads to issues for what I would presume is obvious reasons. I believe that armed with this knowledge you can now set up your comments without a problem. — Reply to this email directly, view it on GitHub <#345 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2BV2TEWKSA6H57JHFDCAJT3MW3BFAVCNFSM6AAAAACDNU57IKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBVGYYDKOA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[nikosdion]

You're welcome! I am glad I could help you :)