Choosing a human check for your forms: built-in captcha, Turnstile or reCAPTCHA
Spam messages and credential-stuffing attempts reach every website sooner or later. InsightSite offers three human checks under Admin → Security, each switched on per form: admin login, contact form, blog comments, newsletter and shop checkout.
Which one to pick
| Method | Best for | Notes |
|---|---|---|
| Built-in image captcha | Visitors mostly in mainland China, or no third parties | No sign-up or keys; letters/digits or arithmetic; every image works once |
| Cloudflare Turnstile | Sites deployed on Cloudflare | Most visitors pass without doing anything; create keys in the Cloudflare dashboard |
| Google reCAPTCHA | Teams already on Google | v2 checkbox or v3 invisible score; the script can load from recaptcha.net for visitors in China |
Setting it up
- Open Admin → Security and choose a method; third-party services need a site key and a secret key, which can also come from environment variables.
- Tick the forms to protect.
- Click Test new settings and pass the check once; only then can you save. A wrong key cannot lock you out of the admin.
Good to know
- If the site sets its own Content Security Policy, allow the provider's script domains: challenges.cloudflare.com for Turnstile; www.google.com, www.gstatic.com and www.recaptcha.net for reCAPTCHA. The built-in captcha needs nothing.
- Locked out anyway? Set
NUXT_CAPTCHA_PROVIDER=none, redeploy, sign in and change it back.
The human check works together with login rate limits: even after passing it, repeated wrong passwords on one account are slowed down for a while.
Related articles
InsightSite 1.30–1.31: backups to object storage, multi-user with password reset, fleet checks
The latest release adds three practical things: send site backups straight to R2 / S3 / Alibaba OSS / Tencent COS, run the admin with several administrators and e-mail password reset, and check the health and AI-search readiness of every site in one command.
InsightSite 1.7–1.9: a safer admin, configurable bot protection and scheduling without cron
The last few releases focused on three things: a hardened admin, a choice of human check for every form, and scheduled content that goes live even on sites without a cron job.
From zero to Cloudflare in three commands
Generate a site, refine it locally, deploy it: build a InsightSite website with an admin and publish it on Cloudflare Pages.