Bot protection on public forms and booking pages

Public submissions to QuickCasa now have to pass a Cloudflare Turnstile check before the server accepts them. Turnstile is a light challenge that most visitors never have to interact with, and it is there to keep automated junk out of your lead list.

Where it applies

• Custom forms hosted on forms.quickcasa.ai. The widget sits near the submit button, and a submission without a valid token is rejected.
• Flow forms, on the final step only. Partial saves and the AI questions mid-flow are not gated, so somebody working through a long form is not challenged over and over.
• Calendar bookings, on the guest booking page and on an embedded custom or flow form where the calendar uses one. Looking up availability, rescheduling and cancelling are not gated, so a guest who already has a booking is never blocked from changing it.

If you use the capture snippet, re-copy it

Bringing your own form with the paste-in snippet and data-qc-field attributes is gated the same way, and this is the one part that needs action from you. An older snippet will have its captures rejected. Open your form, go to Integrate, and copy the snippet again.

The snippet handles the challenge by embedding a small frame from forms.quickcasa.ai, which means the Turnstile domain allowlist only ever has to know about that one host. You do not have to add your own site to anything, and you do not need a Cloudflare account of your own. If you want to control where the widget appears, put a data-qc-turnstile host element on your form and it will render there.

If you call the capture API directly rather than letting the snippet handle the submit, pass the token as the second argument: window.QuickCasaCapture.send(values, turnstileToken).