Uppush

Appearance

Protect Your Popups from Bot Signups ​

Bots crawl the web filling in every form they find. When they reach your popup, they leave behind fake email addresses that sit in your list, get sent campaigns that bounce, and slowly damage your sender reputation — while also burning through the discount codes meant for real customers.

Uppush protects your popups in two layers: one that is always on and needs no setup, and one you can add in about two minutes for stronger protection.

Always-on protection ​

Every Uppush popup already blocks the most common automated signups. This runs silently in the background, your customers never see it, and there is nothing to turn on.

It stops bots that fill forms automatically, but it cannot stop a bot built specifically to target your store. If you are still receiving fake signups, add a captcha.

Add a captcha ​

Uppush uses Cloudflare Turnstile, a privacy-friendly captcha that is free and does not show puzzles to your customers.

Why you create your own keys ​

Turnstile requires every widget to list the domains it is allowed to run on, and a free widget can list only a small number of them. Because every Uppush store has its own domain, we cannot share one widget across all stores — so each store creates its own.

It is free, takes about two minutes, and you only do it once.

Step 1: Create a Turnstile widget ​

  • Sign in to Cloudflare. Go to dash.cloudflare.com and create a free account if you do not already have one. You do not need to move your store's DNS to Cloudflare — Turnstile works with any domain.

  • Open Turnstile. In the left sidebar, select Turnstile, then click Add widget.

  • Name your widget. Anything works — for example, Uppush popup.

  • Add your hostnames. This is the step that matters most. Add both of your store domains:

    • Your Shopify domain, for example your-store.myshopify.com
    • Your custom domain, for example yourstore.com

    Subdomains are included automatically, so adding yourstore.com also covers www.yourstore.com. If your widget is missing a domain, the captcha will not load on that domain and your customers will not be able to subscribe.

  • Choose the widget mode. Select Managed. This lets Cloudflare decide who needs to be challenged, so almost all of your customers are never interrupted.

  • Create the widget. Cloudflare then shows you a Site Key and a Secret Key. Keep this page open for the next step.

Step 2: Add the keys to Uppush ​

  • In Uppush, go to Settings → Bot protection.

  • Tick Enable captcha for this store.

  • Paste your Site key and Secret key from Cloudflare.

  • Click Test secret key. Uppush checks the key with Cloudflare straight away and tells you if it was copied incorrectly — much easier than discovering it later.

  • Click Save. The badge at the top of the page turns to Ready once both keys are in place.

Step 3: Turn the captcha on for a popup ​

Adding your keys does not switch the captcha on by itself. You choose which popups use it, so you can protect the one that is attracting spam and leave the others untouched.

  • Go to Popups and open the popup you want to protect.

  • In the Content tab, tick Bot protection.

  • Save and publish the popup.

Repeat for any other popup you want to protect.

What your customers see ​

In most cases, nothing at all. Cloudflare checks the visitor quietly in the background and the popup looks exactly as it did before.

Only visitors that look suspicious are asked to tick a single checkbox before they can submit. There are no images to identify and no puzzles to solve.

Notes ​

  • Your secret key is never shown again after you save it. Uppush stores it securely and only displays whether a key is set. To replace it, paste a new one over the empty field. To keep the current one, leave the field empty when saving.

  • Your keys belong to your Cloudflare account. You can see how many visitors were challenged, and how many were blocked, in the Turnstile section of your Cloudflare dashboard.

  • Customers Uppush subscribes automatically are not challenged. When a signed-in customer is added to your list without filling in a form, there is no submission to verify, so the captcha does not apply. A signed-in customer who submits the popup themselves is treated like any other visitor.

  • If you remove your keys, your popups keep working. The captcha is simply skipped — your popups never stop collecting signups because of a configuration problem.

  • Changed your store domain? Add the new domain to your widget's hostname list in Cloudflare. The captcha only runs on the domains listed there.

Troubleshooting ​

Customers say they cannot submit the popup, or you see "Please complete the verification" and nothing happens.

The domain they are on is almost certainly missing from your Turnstile widget. In Cloudflare, open your widget's settings and check the hostname list contains both your .myshopify.com domain and your custom domain. This is by far the most common cause.

The Test secret key button says the key was rejected.

Copy the secret key from Cloudflare again. It is easy to copy the site key into the secret key field by mistake — the secret key is the one Cloudflare labels Secret Key, and it is not the same value that appears in your storefront.

The Bot protection checkbox in the popup editor is greyed out.

Your store does not have both keys saved yet. Go to Settings → Bot protection, complete Step 2 above, then come back to the popup.

You submitted your own popup while testing and were told to try again.

Uppush blocks submissions made within two seconds of the popup opening, because no real customer can read a form and type an email address that fast. Simply submit again — it will go through.