Petitions served behind Cloudflare

What it does

• Filters automated traffic before it reaches the petition page or the signature form.
• Absorbs denial-of-service attacks. A flood aimed at the site is handled by Cloudflare's network, not by the server that holds your signatures.
• Carries traffic spikes. Pages are served from Cloudflare's network, so a petition that reaches a large audience in an hour stays open.
• Protects the forms with Cloudflare Turnstile, which looks for signals from the browser instead of asking a person to read distorted letters.

A check that is not a puzzle

Turnstile is used on our forms, including the petition signing form. For most visitors it is a small box that completes itself: there is no image grid to click and no text to decipher. That matters on a signature form, because every extra obstacle loses signatures, and the people most likely to give up on a puzzle are often the ones using an older phone or a screen reader.

Turnstile also protects the other places where abuse would hurt: reporting a petition, confirming a signature with a code, managing your own signatures and requesting the deletion of your personal data.

Why it matters for your petition

A petition is only as useful as its signature count is believable. If a decision-maker suspects the numbers, the petition stops being an argument. Filtering automated traffic is one of the layers that keeps the count defensible, alongside the email confirmation every signature with an email address has to pass and the rule that one email address signs once.

The second reason is simpler. A petition about a contested local decision sometimes attracts someone who would rather the page were unavailable. Running behind a large network means that attempt is absorbed somewhere else, and your petition keeps collecting signatures.

Data protection

Cloudflare processes technical data on our behalf as a data processor: the visitor's IP address, request headers and security log data. Turnstile processes the IP address and technical signals from the browser and device. It is not used to track visitors across websites or for advertising.

Cloudflare is based in the United States and runs a global network. Transfers of personal data outside the EU are covered by the EU-U.S. Data Privacy Framework and the standard contractual clauses in Cloudflare's data processing addendum. The details are in our privacy policy.