Put a gate in a worker Link to heading

1. Create a Turnstile widget. In the Cloudflare dashboard, open Turnstile → Add worker-captcha manually. Add forex-proxy.ps4bp.workers.dev as an allowed hostname and copy the sitekey and secret key. The sitekey is public; keep the secret private.
2. Store the keys as Worker variables. In Workers & Pages → forex-proxy → Settings → Runtime variables and Secrets, add:
   • TURNSTILE_SITE_KEY as a regular text variable.
   • TURNSTILE_SECRET_KEY as a secret.
3. Make the Worker handle requests before serving the page. Have it:
   • Check for a valid pass cookie on each page request.
   • If there isn’t one, return a small HTML verification page containing the Turnstile widget.
   • Accept the widget token at a verification endpoint and send it to https://challenges.cloudflare.com/turnstile/v0/siteverify.
   • Only after Siteverify returns success: true, issue a short-lived, signed pass cookie and redirect back to /.
   • Serve index.html when the cookie is valid.
4. Protect every route that should be gated. If only the landing page needs protection, gate /. If API routes also need protection, gate those separately so the verification endpoint stays reachable.
5. Deploy and check both paths. Test that a fresh browser sees the challenge, a successful verification reaches the page, and a request without a valid cookie cannot fetch the protected content directly.