Adding Cloudflare Turnstile to Zoho Form HTML Exports

Zoho Forms lets you export your form as a standalone HTML package — but that exported form posts directly to Zoho's servers with no spam protection. This guide walks you through adding Cloudflare Turnstile using a single drop-in script, with optional server-side verification via a Cloudflare Worker. What we're building Browser → Turnstile challenge → token issued → form submitted → Cloudflare Worker → token verified server-side → payload forwarded to Zoho The library (zoho-turnstile.js) works in two modes: Client-only — blocks submissions with no token. Stops browser-based bots. No backend needed. Full verification — routes submissions through a Cloudflare Worker that verifies the token before anything reaches Zoho. Stops everything. ⚠️ Client-only mode cannot stop direct POST attacks. For production forms, full verification is strongly recommended. Prerequisites A Cloudflare account (free tier is fine) A Zoho Form exported as HTML (index.html, css/form.css, js/validation.js) A domain