Bot Protection (reCAPTCHA v3 and Cloudflare Turnstile)

Public booking and registration forms can be targeted by spambots that create fake meetings or accounts. LockMyCal supports two invisible protections that don't bother visitors with clicking on pictures:

• Google reCAPTCHA v3 – evaluates the visitor's behaviour and assigns a score from 0.0 (bot) to 1.0 (human); below the threshold (default 0.3) the request is rejected.
• Cloudflare Turnstile – protection from Cloudflare without tracking visitors for advertising purposes.

You choose the provider separately for registration and separately for bookings – off (disabled), google or cloudflare.

1. Getting the keys

• reCAPTCHA v3: At google.com/recaptcha/admin, choose reCAPTCHA v3, add the instance's domain and copy the Site Key and Secret Key.
• Turnstile: In the Cloudflare dashboard, open Turnstile, add a site with the instance's domain and copy the Site Key and Secret Key.

2. Configuration in LockMyCal

# The provider separately for registration and bookings: off / google / cloudflare
RECAPTCHA_SIGNUP_PROVIDER=cloudflare
RECAPTCHA_BOOKING_PROVIDER=google

# Google reCAPTCHA v3
RECAPTCHA_SITE_KEY=your_recaptcha_site_key
RECAPTCHA_SECRET_KEY=your_recaptcha_secret_key
RECAPTCHA_SIGNUP_MIN_SCORE=0.3
RECAPTCHA_BOOKING_MIN_SCORE=0.3

# Cloudflare Turnstile
TURNSTILE_SITE_KEY=your_turnstile_site_key
TURNSTILE_SECRET_KEY=your_turnstile_secret_key

The provider can also be switched at runtime without a restart in Administration → Application settings → Authentication (the Bot protection section).

3. Behaviour During an Outage

• reCAPTCHA is loaded only once a visitor starts filling in a form, and when Google is unreachable, bookings and sign-ups go through.
• Cloudflare Turnstile rejects a submission while Cloudflare is unreachable.
• Turnstile's origin is added to the Content-Security-Policy header only while Turnstile is configured for booking or sign-up.