Bot protection for downloads (Turnstile) Pro

A public document library is a scraping target: one script can walk every download link on the page. FileDeck Pro can put a Cloudflare Turnstile check in front of downloads — the visitor confirms they’re human once, then downloads normally for an hour. Turnstile is free, sets no advertising cookies, and usually verifies without the visitor clicking anything.

FileDeck Pro — Documents → Settings → Downloads → Bot protection.

Setting it up

1. Create a free Turnstile widget at dash.cloudflare.com → Turnstile and copy the site key and secret key.
2. Paste both keys under Documents → Settings → Submissions (the same keys also protect front-end submission, if you use it).
3. Under Documents → Settings → Downloads, tick Require a quick Cloudflare Turnstile check before the first download of a visit. Save.

Until both keys are saved, the switch does nothing — the gate never fails closed on a missing configuration.

How it behaves

• The first download click opens a small dialog with the check. Passing it unlocks downloads for one hour; most visitors never see it again.
• Logged-in users are never challenged — they already passed a login.
• Signed share links skip the check, like every FileDeck gate: the link’s signature is its authorisation.
• Multi-select zip downloads are covered by the same check.
• The check is enforced on the server, not just in the browser: a script that calls the download URL directly is refused until it holds a grant.

What it does and doesn’t stop

Be clear-eyed about the strength of this: it is friction, not access control. The grant that a passed check issues is a cookie bound to nothing — not your visitor’s address, not their browser, not a download count — so one person solving one challenge can hand that cookie to a script and download for an hour. What the check buys you is that a scraper must now solve a CAPTCHA to start at all, which defeats the naive ones and costs the determined ones money. If the files themselves matter, restrict them — pair this with access control rather than relying on it.

Within that limit it does stop casual scripted bulk downloading through FileDeck’s download routes and keeps your download counts honest (search-engine crawlers are already excluded from counts, with or without this gate). Like the terms and form gates, it guards the FileDeck download route — a document with no access restriction still has a directly reachable file URL, so pair bot protection with an access restriction when the file itself must not be fetchable.

For metering rather than bot-blocking — "each visitor may download N files a day" — use download quotas; the two work well together.