Website bot check
An invisible check your website's visitors pass before a chat or call starts — Cloudflare Turnstile or reCAPTCHA Enterprise, verified by Graine. Report-only first, then enforce; what happens while the provider is down.
Your website's snippet works for anyone who opens your page — including scripts. The website bot check asks the provider you choose to tell people from bots before a conversation starts, and Graine checks the provider's answer on its servers. Visitors see nothing; a managed check (a box to tick) appears only when the provider insists. Your apps are not affected.
Requires website loader 1.5.0 (every page that loads /embed/v1.js gets it).
1. Get the provider's keys
- Cloudflare Turnstile: in your Cloudflare dashboard, add a Turnstile widget for your website's domains (Invisible or Managed). You get a site key and a secret key.
- reCAPTCHA Enterprise: in your Google Cloud project, create a score-based key for your website's domains and an API key allowed to call the reCAPTCHA Enterprise API. You need the site key, the API key and the project ID.
2. Save them in the dashboard
Agent → Embed & Widgets → Install → Website bot check: choose the provider, paste the site key, and paste the secret (or API key) and save it. Graine checks the secret with the provider before keeping it, keeps it sealed, and never shows it again — paste a new one to replace it.
3. Report only, then Enforce
Choose Report only first: every conversation start is counted as passed, failed or missing, and nobody is
refused. When your visitors pass, choose Enforce; the dashboard states the effect and asks you to confirm. From
then on a website visitor who does not pass is refused with bot_check_failed.
When the provider is down
| Mode | New conversations | Conversations in progress |
|---|---|---|
| Report only | Go ahead, and are counted as "could not check" | Never interrupted |
| Enforce | Refused (bot_check_failed, reason unavailable) until the provider answers again | Never interrupted |
A passed check is remembered for 30 minutes for that visitor and site, so they are not challenged again on every conversation.
The bot check applies to websites only. An attacker who sends no web address claims to be an app, so if this agent also serves your app, protect the app with Your apps and Server tokens too — or give your website its own agent.
If your site sends a Content Security Policy, allow the provider's script and frame: challenges.cloudflare.com for
Turnstile, www.google.com/recaptcha/ for reCAPTCHA Enterprise.