How to Measure How Much Spam Turnstile Blocks in PrestaShop 8

If your PrestaShop 8 store keeps collecting fake account registrations, contact-form spam or product reviews stuffed with phishing URLs, the problem isn’t just stopping it — it’s knowing whether whatever you put in place to stop it actually works. This guide covers both: how to deploy Cloudflare Turnstile with the right configuration, and how to measure, with your own store’s data, how much spam it’s actually taking off your plate.

Why reCAPTCHA and the honeypot fall short

The classic defenses have degraded on three fronts. First: CAPTCHA-solving services run on human labor farms and charge fractions of a cent per image — at that price, solving CAPTCHAs at scale is trivial for anyone running mass spam. Second: the honeypot still filters out the simplest bots, but the sophisticated ones detect CSS-hidden fields and only fill in the visible ones. Third: reCAPTCHA v3 with a strict score threshold tends to produce false positives on real customers browsing from shared mobile-carrier IPs — several legitimate customers reach the internet through the same IP and everyone’s score takes the hit.

There’s also a legal angle that in many stores weighs more than the technical one: after Schrems II and the guidance issued by EU data protection authorities, continuing to use reCAPTCHA means documenting a solid legal basis for transferring data to the US. Turnstile states that it does no cross-site tracking and processes on European edge infrastructure, which simplifies that front considerably. And the free tier of 1M challenges per month covers a normal store’s scale many times over.

The right deployment: 15 minutes of configuration

Create the site in the Cloudflare dashboard, grab the two keys (Site Key and Secret Key) and install the module in the Back Office. The configuration we recommend as a starting point:

• Widget mode: Managed — Cloudflare decides whether or not to present a challenge based on its own signals. The visible badge also acts as a deterrent for simple bots.
• Action on fail: Block — reject the request if the token isn’t valid. Except in stores with a very technical audience (aggressive blockers, restricted JS), where a more lenient policy may make sense.
• API timeout with fail open: if Cloudflare’s API doesn’t respond within a few seconds, let the request through — a third-party infrastructure problem should never lock out your legitimate customers.
• Logging enabled: record every attempt with IP, user agent and result. Without this, the measurement part of this guide is impossible.
• Hostname restriction: enabled in the Cloudflare dashboard — the token is only valid if it comes from your domain. This automatically blocks tokens reused from other sites.

A side benefit of retiring reCAPTCHA: its widget loads several scripts from Google domains, while Turnstile’s is a single script served from Cloudflare’s CDN — noticeably lighter. It’s not the reason to switch, but you’ll feel it on pages with forms.

Your baseline: measure before the change (or use your history)

To know how much spam Turnstile is removing, you need to know how much you had. Ideally, measure a fixed period before the change; if you’ve already installed it, rebuild the baseline from your history. What to count, per channel:

• New account registrations per month — and of those, how many are bots: emails on disposable domains, generated name patterns, accounts with no orders and no activity afterwards.
• Contact form messages — how many are obvious spam (links, generated text, languages you don’t serve).
• Product reviews — how many arrive with URLs or automated text.
• False positives — complaints from real customers who couldn’t complete a form. This counter is almost always at zero because nobody measures it: switch it on (a tagged support channel is enough).

With the baseline in place, measuring is straightforward: same counts, same period length, after enabling the module. Compare channel by channel, not in aggregate — the effect can be very different on registrations than on reviews.

Reading the logs: what the error codes tell you

The module records Cloudflare’s error-codes for every failed verification, and that distribution is the profile of the bots attacking your specific store:

• invalid-input-response with no token: bots that don’t even try to obtain a valid token — good old brute-force spam.
• hostname-mismatch: tokens obtained on other sites that also use Turnstile and replayed against yours. The hostname restriction cuts them off at zero cost.
• timeout-or-duplicate: bots that solve the challenge but take too long to submit, or that try to reuse the same token several times.
• invalid-input-response with a failed challenge: bots that give it a go and don’t pass Cloudflare’s checks.

The ratio between these four varies from store to store — there’s no “normal” distribution to copy. The useful one is your own: if hostname-mismatch dominates, you’re on the receiving end of campaigns recycled from other sites; if failed challenges dominate, you have attackers going specifically after you.

The honest limit: what no CAPTCHA blocks

Some spam is going to keep getting through, and it’s worth knowing which: bots operating in real browsers on residential IPs are indistinguishable from human users to any verification system — Turnstile included. If you still see a trickle of fake registrations after deployment, it’s not that the module is misconfigured: it’s that category.

For that remainder, the tool is post-registration behavior detection: active email verification, anomalous usage patterns, analysis of first-hours activity. Turnstile is not the last line of defense — its job is to eliminate the volume of noise that makes working at that level of detail impossible.

Frequently asked questions

How much spam does Turnstile block in a PrestaShop store?

It depends on the profile of bots attacking your store — which is why this guide focuses on measuring it with your own data: a per-channel baseline (registrations, contact, reviews) before the change and the same count afterwards, plus the error codes from the module’s log.

Is Turnstile free?

Yes, for a normal store’s usage: Cloudflare’s free tier covers 1M challenges per month. The Zeyvro Turnstile module is also free and open source under the MIT license.

Can Turnstile block real customers?

False positives are rare and tend to be concentrated in very restrictive browsing environments (JavaScript partially blocked by privacy extensions). Set the API timeout to fail open and measure false positives through a tagged support channel to catch them.

Is Turnstile a better fit for the GDPR than reCAPTCHA?

Turnstile states that it does no cross-site tracking and processes on European edge infrastructure, which simplifies the legal basis compared with reCAPTCHA, whose use requires documenting data transfers to the US after Schrems II. For a formal assessment, check with your legal counsel.

Download the module

Zeyvro Turnstile is free and open source under the MIT license. Direct download, 30-second install, 2-minute configuration, with the error-code logging you need for the measurement part of this guide.

Zeyvro builds PrestaShop 8 modules out of a real store running in production. Unobfuscated code.