Summary
I would like to propose adding support for Cloudflare Turnstile as an alternative CAPTCHA provider alongside Google reCAPTCHA across the Public Knowledge Project (PKP) applications (OJS, OMP, and OPS).
Background
Currently, PKP applications primarily support Google reCAPTCHA for protecting user registration, login, password reset, and other public-facing forms from automated abuse. While reCAPTCHA is widely adopted, many institutions are seeking alternatives due to concerns regarding:
- User privacy and data collection.
- Dependence on Google services, which may be restricted or unavailable in some regions.
- Accessibility and user experience.
- Compliance with institutional or governmental privacy policies.
Cloudflare Turnstile has emerged as a mature, privacy-focused alternative that provides equivalent bot protection without requiring users to solve traditional CAPTCHA challenges in most cases.
Proposed Enhancement
Introduce Cloudflare Turnstile as a configurable CAPTCHA provider.
Suggested configuration options:
- CAPTCHA Provider
- None
- Google reCAPTCHA
- Cloudflare Turnstile
For Turnstile, administrators would configure:
- Site Key
- Secret Key
- Widget mode (Managed, Non-Interactive, Invisible, if applicable)
The integration should use Cloudflare’s server-side verification API in the same manner that reCAPTCHA verification is currently implemented.
Benefits
Improved Privacy
Turnstile is designed to minimize user tracking while still providing effective bot detection. This aligns well with many universities, research institutions, and public organizations that prioritize privacy.
Better User Experience
Most legitimate users pass verification without solving image or text challenges, reducing friction during registration and submission workflows.
Reduced Dependence on Google
Many PKP installations are operated by universities or government organizations where Google services are discouraged, unavailable, or blocked. Supporting an additional provider increases deployment flexibility.
Alignment with Existing Cloudflare Usage
Many PKP installations already use Cloudflare for:
- CDN
- DDoS protection
- Web Application Firewall (WAF)
- Rate limiting
- Zero Trust
- DNS management
Allowing Turnstile would integrate naturally into existing infrastructure without requiring another third-party service.
Open and Free Availability
Cloudflare Turnstile is available without cost for most academic publishing workflows, making it attractive for non-profit journals and university presses.
Scope
This feature could protect all existing CAPTCHA-enabled forms, including:
- User registration
- Login
- Password reset
- Contact forms
- Reviewer registration (where applicable)
- Any future public forms that currently use CAPTCHA
Implementation Suggestion
The current CAPTCHA implementation could be refactored into a provider-based architecture, allowing multiple CAPTCHA backends.
For example:
- CAPTCHA Interface
- Google reCAPTCHA Provider
- Cloudflare Turnstile Provider
This design would make it easier to support additional providers in the future without major architectural changes.
References
Cloudflare Turnstile Documentation: