Skip to main content

Tutorial: Integrating Cloudflare Turnstile with Sngine

This tutorial will guide you through integrating Cloudflare Turnstile into your Sngine platform while keeping Google reCAPTCHA. Turnstile will be added to both the Contact Form and the Sign-Up Form for enhanced security.

1. Upload the files (If you don't want to do the manual work)

Skip step 3 if you just uploaded all the files, if you don't want to overwrite the file because you have a modified theme, continue to step 2

Download the zip and upload to your root, pay attention that this files will be overwritten

/includes/ajax/admin/settings.php

/includes/class-user.php

/content/themes/default/templates/admin.settings.tpl

/content/themes/default/templates/contact.tpl

/content/themes/default/templates/_sign_form.tpl

2. Add the Database 

Add new options for Cloudflare Turnstile in the database.

Use the file included visit yoursite.com/installCloud.php and run the script 

Or do it manually as it show bellow

Run the following SQL queries:

CREATE TABLE IF NOT EXISTS `system_options` (
    `option_name` VARCHAR(255) NOT NULL,
    `option_value` TEXT NOT NULL,
    PRIMARY KEY (`option_name`)
);

INSERT INTO `system_options` (`option_name`, `option_value`) VALUES ('turnstile_enabled', '0');
INSERT INTO `system_options` (`option_name`, `option_value`) VALUES ('turnstile_site_key', '');
INSERT INTO `system_options` (`option_name`, `option_value`) VALUES ('turnstile_secret_key', '');

You are done if you have uploaded all the files

Now visit yousite.com/admincp/settings/security and look for and add you key

 

3. Or Edit the code manually

2. Admin Panel Settings

Add Turnstile Settings in Admin Settings:

Open /content/themes/default/templates/admin.settings.tpl

Look For 

 <div class="row form-group">
          <label class="col-md-3 form-label">
            {__("reCAPTCHA Site Key")}
          </label>
          <div class="col-md-9">
            {if !$user->_data['user_demo']}
              <input type="text" class="form-control" name="reCAPTCHA_site_key" value="{$system['reCAPTCHA_site_key']}">
            {else}
              <input type="password" class="form-control" value="*********">
            {/if}
          </div>
        </div>

        <div class="row form-group">
          <label class="col-md-3 form-label">
            {__("reCAPTCHA Secret Key")}
          </label>
          <div class="col-md-9">
            {if !$user->_data['user_demo']}
              <input type="text" class="form-control" name="reCAPTCHA_secret_key" value="{$system['reCAPTCHA_secret_key']}">
            {else}
              <input type="password" class="form-control" value="*********">
            {/if}
          </div>
        </div>
 <!-- success -->

And after this add

<!-- Cloudflare Turnstile Enabled -->
<div class="form-table-row">
    <div class="avatar">
        {include file='__svg_icons.tpl' icon="shield" width="40px" height="40px"}
    </div>
    <div>
        <div class="form-label h6">{__("Cloudflare Turnstile Enabled")}</div>
        <div class="form-text d-none d-sm-block">{__("Enable or disable Cloudflare Turnstile security.")}</div>
    </div>
    <div class="text-end">
        <label class="switch" for="turnstile_enabled">
            <input type="checkbox" name="turnstile_enabled" id="turnstile_enabled" {if $system['turnstile_enabled']}checked{/if}>
            <span class="slider round"></span>
        </label>
    </div>
</div>

<!-- Turnstile Site Key -->
<div class="row form-group">
    <label class="col-md-3 form-label">{__("Turnstile Site Key")}</label>
    <div class="col-md-9">
        <input type="text" class="form-control" name="turnstile_site_key" value="{$system['turnstile_site_key']}">
    </div>
</div>

<!-- Turnstile Secret Key -->
<div class="row form-group">
    <label class="col-md-3 form-label">{__("Turnstile Secret Key")}</label>
    <div class="col-md-9">
        <input type="text" class="form-control" name="turnstile_secret_key" value="{$system['turnstile_secret_key']}">
    </div>
</div>

3. Save Turnstile Settings

In includes/ajax/admin/settings.php, under the security case, add:

case 'security':
    $_POST['turnstile_enabled'] = (isset($_POST['turnstile_enabled'])) ? '1' : '0';

    update_system_options([
        'turnstile_enabled'    => secure($_POST['turnstile_enabled']),
        'turnstile_site_key'   => secure($_POST['turnstile_site_key']),
        'turnstile_secret_key' => secure($_POST['turnstile_secret_key']),
    ]);
    break;

4. Add Turnstile to Forms (I added after the Recapcha code)

Contact Form (contact.tpl)

{if $system['turnstile_enabled']}
    <div class="form-group">
        <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
        <div class="cf-turnstile" data-sitekey="{$system['turnstile_site_key']}"></div>
    </div>
{/if}

Sign-Up Form (_sign_form.tpl 

{if $system['turnstile_enabled']}
    <div class="form-group">
        <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
        <div class="cf-turnstile" data-sitekey="{$system['turnstile_site_key']}"></div>
    </div>
{/if}

5. Verify Turnstile on Submission

In class-user.php, update the verification logic:

Look For 

 $custom_fields = $this->set_custom_fields($args);

    /* check reCAPTCHA */

    if ($system['reCAPTCHA_enabled'] && $args['from_web']) {

      $recaptcha = new \ReCaptcha\ReCaptcha($system['reCAPTCHA_secret_key'], new \ReCaptcha\RequestMethod\CurlPost());

      $resp = $recaptcha->verify($args['g-recaptcha-response'], get_user_ip());

      if (!$resp->isSuccess()) {

        throw new ValidationException(__("The security check is incorrect. Please try again"));

      }

    }
And after that add 
/* Check Cloudflare Turnstile */
if ($system['turnstile_enabled'] && $from_web) {
    if (empty($_POST['cf-turnstile-response'])) {
        throw new ValidationException(__("Please complete the Cloudflare security check."));
    }

    $verify_url = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
    $data = [
        'secret'   => $system['turnstile_secret_key'],
        'response' => $_POST['cf-turnstile-response'],
        'remoteip' => get_user_ip(),
    ];

    $options = [
        'http' => [
            'header'  => "Content-type: application/x-www-form-urlencoded\r\n",
            'method'  => 'POST',
            'content' => http_build_query($data),
        ]
    ];

    $context  = stream_context_create($options);
    $response = file_get_contents($verify_url, false, $context);
    $result = json_decode($response);

    if (!$result->success) {
        throw new ValidationException(__("The Cloudflare Turnstile check failed. Please try again."));
    }
}

✅ Congrats

You've successfully integrated Cloudflare Turnstile into your Sngine platform alongside Google reCAPTCHA. Now your platform is doubly protected against spam and bot attacks!

Need Help? Visit the community forums. 

Back to top