How to Measure How Much Spam Turnstile Blocks in PrestaShop 8

If your PrestaShop 8 store keeps collecting fake account registrations, contact-form spam or product reviews stuffed with phishing URLs, the problem isn’t just stopping it — it’s knowing whether whatever you put in place to stop it actually works. This guide covers both: how to deploy Cloudflare Turnstile with the right configuration, and how to measure, with your own store’s data, how much spam it’s actually taking off your plate.

Why reCAPTCHA and the honeypot fall short

The classic defenses have degraded on three fronts. First: CAPTCHA-solving services run on human labor farms and charge fractions of a cent per image — at that price, solving CAPTCHAs at scale is trivial for anyone running mass spam. Second: the honeypot still filters out the simplest bots, but the sophisticated ones detect CSS-hidden fields and only fill in the visible ones. Third: reCAPTCHA v3 with a strict score threshold tends to produce false positives on real customers browsing from shared mobile-carrier IPs — several legitimate customers reach the internet through the same IP and everyone’s score takes the hit.

There’s also a legal angle that in many stores weighs more than the technical one: after Schrems II and the guidance issued by EU data protection authorities, continuing to use reCAPTCHA means documenting a solid legal basis for transferring data to the US. Turnstile states that it does no cross-site tracking and processes on European edge infrastructure, which simplifies that front considerably. And the free tier of 1M challenges per month covers a normal store’s scale many times over.

The right deployment: 15 minutes of configuration

Create the site in the Cloudflare dashboard, grab the two keys (Site Key and Secret Key) and install the module in the Back Office. The configuration we recommend as a starting point:

• Widget mode: Managed — Cloudflare decides whether or not to present a challenge based on its own signals. The visible badge also acts as a deterrent for simple bots.
• Action on fail: Block — reject the request if the token isn’t valid. Except in stores with a very technical audience (aggressive blockers, restricted JS), where a more lenient policy may make sense.
• API timeout: a few seconds. If you’d rather a Cloudflare outage never blocks anyone, choose “Log only” under Action on fail — the trade-off is that bots also get through while the outage lasts.
• Logging enabled: record every attempt with IP, user agent and result. Without this, the measurement part of this guide is impossible.
• Hostname: when you create the widget in Cloudflare, list only your domain.

A side benefit of retiring reCAPTCHA: its widget loads several scripts from Google domains, while Turnstile’s is a single script served from Cloudflare’s CDN — noticeably lighter. It’s not the reason to switch, but you’ll feel it on pages with forms.

Your baseline: measure before the change (or use your history)

To know how much spam Turnstile is removing, you need to know how much you had. Ideally, measure a fixed period before the change; if you’ve already installed it, rebuild the baseline from your history. What to count, per channel:

• New account registrations per month — and of those, how many are bots: emails on disposable domains, generated name patterns, accounts with no orders and no activity afterwards.
• Contact form messages — how many are obvious spam (links, generated text, languages you don’t serve).
• Product reviews — how many arrive with URLs or automated text.
• False positives — complaints from real customers who couldn’t complete a form. This counter is almost always at zero because nobody measures it: switch it on (a tagged support channel is enough).

With the baseline in place, measuring is straightforward: same counts, same period length, after enabling the module. Note: Zeyvro Turnstile currently protects the contact form; you won’t see a module effect on registrations or reviews, and that count works as your control group.

Reading the logs: what the error codes tell you

The module records Cloudflare’s error-codes for every failed verification, and that distribution is the profile of the bots attacking your specific store:

• invalid-input-response with no token: bots that don’t even try to obtain a valid token — good old brute-force spam.
• timeout-or-duplicate: bots that solve the challenge but take too long to submit, or that try to reuse the same token several times.
• invalid-input-response with a failed challenge: bots that give it a go and don’t pass Cloudflare’s checks.

The ratio between these three varies from store to store — there’s no “normal” distribution to copy. The useful one is your own: if failed challenges dominate, you have attackers going specifically after you.

The honest limit: what no CAPTCHA blocks

Some spam is going to keep getting through, and it’s worth knowing which: bots operating in real browsers on residential IPs are indistinguishable from human users to any verification system — Turnstile included. If you still see a trickle of fake registrations after deployment, it’s not that the module is misconfigured: it’s that category.

For that remainder, the tool is post-registration behavior detection: active email verification, anomalous usage patterns, analysis of first-hours activity. Turnstile is not the last line of defense — its job is to eliminate the volume of noise that makes working at that level of detail impossible.

Frequently asked questions

How much spam does Turnstile block in a PrestaShop store?

It depends on the profile of bots attacking your store — which is why this guide focuses on measuring it with your own data: a per-channel baseline (registrations, contact, reviews) before the change and the same count afterwards, plus the error codes from the module’s log.

Is Turnstile free?

Yes, for a normal store’s usage: Cloudflare’s free tier covers 1M challenges per month. The Zeyvro Turnstile module is also free and open source under the MIT license.

Can Turnstile block real customers?

False positives are rare and tend to be concentrated in very restrictive browsing environments (JavaScript partially blocked by privacy extensions). With the default setting (“Block”), if Cloudflare doesn’t respond the message isn’t sent; if you’d rather never block anyone, choose “Log only”.

Is Turnstile a better fit for the GDPR than reCAPTCHA?

Turnstile states that it does no cross-site tracking and processes on European edge infrastructure, which simplifies the legal basis compared with reCAPTCHA, whose use requires documenting data transfers to the US after Schrems II. For a formal assessment, check with your legal counsel.

Download the module

Zeyvro Turnstile is free and open source under the MIT license. Direct download and Back Office configuration, with the error-code logging you need for the measurement part of this guide.

Zeyvro builds PrestaShop 8 modules out of a real store running in production. Unobfuscated code.