Turnstill suddenly stopped working on two of my Grav sites. The widget displays, but get the message "Human verification has identified this form submission is problematic" after submitting.
I have changed the keys on the form plugin after refreshing on turnstile and have checked the whole form config, but I cannot see my problem. The only site that does not have the problem is still on the older version 2.0.23 of Grav while the two that do not work are at 2.0.26. All use version 9.1.24 of the form plugin. I am not saying that the newer version of Grav has caused this, just observing the difference.
I have turned on the basic-captcha for now, but I don't want to keep it that way.
Solved by Marcel View solution
Hi Marcel, thanks for including the version comparison. That message is a generic CAPTCHA verification failure; it doesn’t necessarily mean Cloudflare has classified your submission as suspicious. The widget can display successfully while the server-side verification fails.
Could you reproduce it once on an affected site, then check logs/grav.log for entries containing Turnstile validation failed, Turnstile validation error, or Form Captcha (turnstile)? Form 9.1.24 already logs the underlying error, so there’s no need to enable the frontend debugger. Please share the relevant error lines, with any secrets or personal information removed.
The error should narrow this down:
invalid-input-secretpoints to the secret key used by the server.invalid-input-responsemeans the submitted token is invalid.timeout-or-duplicatemeans the token expired or has already been verified. Turnstile tokens last five minutes and can only be used once.- An SSL, DNS, or connection error means the server couldn’t complete its request to Cloudflare.
Please also share the form’s CAPTCHA field and process: configuration, with keys removed, and whether it uses AJAX submission. In particular, check that process: doesn’t contain both turnstile: true and captcha: true, since both invoke CAPTCHA validation and could verify the same token twice.
The Grav version difference is a useful clue, but the log should tell us which part is failing before we attribute it to the update.
Hi,
Sorry I did not answer earlier, I had some personal matters and did not get around to fix this problem.
Actually now I looked at it, the problem was not as great as I thought. I had changed the keys via the admin page, but when I opened the form.yaml file this morning, I still saw the old key. So I'm guessing for whatever reason the admin did not save my new key. In the logs it was clear that the token was sent to Turnstile and then it failed on site verification, so the secret was not correct.
I am not sure why the key was not saved from the admin page, I am really sure I changed it and I should have checked the files directly. So that part was problem between keyboard and chair.
I'm now off to fix the other page.
Log in to reply.
Suggested topics
| Topic | Participants | Replies | Views | Activity |
|---|---|---|---|---|
| 4 | 234 | 5 days ago | ||
| 4 | 439 | 5 days ago | ||
| 6 | 278 | 1 week ago | ||
| 1 | 251 | 2 weeks ago | ||
| 6 | 330 | 2 weeks ago |