By default, Bot Protection uses its own built-in puzzle, which needs no account and shares nothing with outside services. If you prefer, a site can show a third-party CAPTCHA instead: Cloudflare Turnstile, Google reCAPTCHA (v2 checkbox) or hCaptcha. You provide your own keys, choose which sites use them, and can mix services.
Please note that a third-party CAPTCHA sends visitor data to that service on the sites that use it.
Setting up a CAPTCHA
- Create a site key and secret key in your chosen service's dashboard, and make sure every domain you will use it on is listed there.
- In cPanel open "Bot Protection" and go to the "CAPTCHA" tab. Click the service you want under "Services" (1) to open it, enter a description and both keys, and click "Add key."
- Open the "Sites" tab (the link at (2) takes you there), choose the key in that site's CAPTCHA dropdown, and click "Apply."
If something goes wrong
If the CAPTCHA service has a problem (wrong keys, a domain not listed on the key, or an outage), visitors automatically get the built-in puzzle instead, so a key mistake will not lock you out of your site.
Some visitors' browsers block the CAPTCHA entirely (some ad blockers and privacy extensions). By default they are told the check could not run. Under "When the CAPTCHA cannot load" (3) you can choose to give them the built-in puzzle instead, optionally at a harder level.
Related Bot Protection Articles
You can find these in the Bot Protection category of our knowledgebase:
- Getting Started with Bot Protection
- Bot Protection Settings Explained
- Troubleshooting Bot Protection
Need More Help?
If you have questions about Bot Protection or something isn't working the way you expect, please open a support ticket from our Client Area and our team will be happy to help. To help us get you an answer quickly, please include:
- The website (domain) affected.
- Any Reference code shown on a blocked page.
- Roughly when it happened and what you or your visitor were trying to do.
