Spam Protection

Sunshine Photo Cart protects your forms from spam bots in two ways: a built-in honeypot that works automatically, and an optional integration with Cloudflare Turnstile for stronger protection.

Built-in Honeypot

Every Sunshine account form includes a hidden honeypot field. This is a form field that is invisible to real visitors but gets filled in by automated spam bots. When a bot fills in the hidden field, Sunshine blocks the submission.

Your customers will never see or interact with this field. There is no setting to enable or disable it — it's always active.

Protected Forms

• Login
• Registration
• Password reset

Blocked attempts are logged with the message "spam detected" when logging is enabled in your Sunshine settings.

Cloudflare Turnstile

For stronger spam protection, you can add Cloudflare Turnstile to your Sunshine forms. Turnstile is a free, privacy-friendly alternative to traditional CAPTCHAs. In most cases it verifies visitors automatically without requiring them to solve a puzzle.

This works through the free Simple Cloudflare Turnstile WordPress plugin, which has a built-in Sunshine Photo Cart integration.

What You Need

1. A free Cloudflare account
2. A Turnstile site key and secret key from your Cloudflare dashboard
3. The Simple Cloudflare Turnstile plugin installed on your site

How to Set It Up

1. Install and activate the Simple Cloudflare Turnstile plugin from the WordPress plugin directory.
2. Go to Settings > Cloudflare Turnstile in your WordPress admin.
3. Enter your Turnstile Site Key and Secret Key.
4. Scroll down to the Sunshine Photo Cart section (this only appears when Sunshine is active).
5. Check the boxes for the forms you want to protect:
   • Sunshine Login — adds Turnstile to the login form
   • Sunshine Register — adds Turnstile to the registration form
   • Sunshine Reset Password — adds Turnstile to the password reset form
   • Sunshine Checkout — adds Turnstile to the checkout page
6. Save your settings.

Guest Checkout Only

When you enable Turnstile on the checkout form, an additional option appears: Guest Checkout Only. When checked, Turnstile is only shown to customers who are not logged in. Logged-in customers skip the Turnstile check since they've already been verified.

How It Works

Once enabled, a small Turnstile widget appears on the selected forms. In most cases, Turnstile verifies the visitor automatically in the background — your customers just see a brief loading animation followed by a checkmark. If Turnstile can't verify the visitor automatically, it shows a simple challenge.

If verification fails, the form submission is blocked and the customer sees an error message.

Using Both Together

The honeypot and Turnstile work together. The honeypot catches simple bots automatically, while Turnstile provides an additional layer of protection against more sophisticated spam. For most photographers, enabling Turnstile on the registration and checkout forms is a good starting point.