如何用 n8n、Cloudflare Turnstile 和 Telegram 自動處理網站客戶查詢

Most small-business websites still treat the contact form as an afterthought. A visitor fills it in, and an email lands in a shared inbox where it waits next to newsletters and invoices. Someone notices it hours later, or never. Meanwhile, half the messages are spam.

When I rebuilt my own site, I replaced that whole chain with one n8n workflow. Every real enquiry now gets stored in a spreadsheet and pings my phone on Telegram within a few seconds. Bots get rejected before they cost me anything. Here is exactly how it is built, so you can copy the pattern.

The shape of the workflow

The workflow has fourteen nodes, but the logic is simple:

1. Webhook: receives the form POST from the website.
2. Normalize: a Code node that trims and cleans the fields.
3. Honeypot check: drops obvious bots quietly.
4. Validation: rejects incomplete submissions with a clear error.
5. Turnstile verification: asks Cloudflare whether the visitor is human.
6. Save to Google Sheets: one row per lead.
7. Telegram message: an instant notification.
8. Respond: tells the website whether it worked, so the visitor sees a thank-you page or an error.

Each step does one job, and the order matters. The cheap checks come first and the external calls come last.

Step 1: a webhook that only does one thing

The site is a static build on Cloudflare Pages, so there is no backend of its own. The form posts JSON straight to an n8n Webhook node set to "respond using a Respond to Webhook node". That setting is important. The browser waits for n8n to decide, which means you can return a real 200, 400 or 403 instead of always saying "thanks".

Step 2: normalize before you check anything

Forms send messy data: trailing spaces, uppercase emails, empty strings that should be missing. A short Code node fixes that once, so every later node can trust the shape of the data:

const b = $json.body || {};
return [{ json: {
  name: (b.name || '').trim(),
  email: (b.email || '').trim().toLowerCase(),
  message: (b.message || '').trim(),
  company: (b.company || '').trim(),      // honeypot field
  token: b['cf-turnstile-response'] || ''
}}];

Step 3: the honeypot, the cheapest spam filter there is

The form has a hidden field that real people never see. Bots that blindly fill every input fill it in too. If the honeypot is not empty, the workflow returns a normal 200 and stops. The bot thinks it succeeded and moves on, and nothing reaches the sheet or my phone. It costs zero API calls.

Step 4: validate and fail loudly

If the name, email or message is missing, or the email does not look like an email, the workflow responds with 400. The front end shows "please check the form" instead of pretending everything went fine. Silent failures are the main reason small businesses lose leads without ever knowing.

Step 5: Cloudflare Turnstile, verified on the server

Turnstile is Cloudflare's free CAPTCHA alternative. Most visitors never click anything. The widget in the browser produces a token, but the token means nothing until your server checks it. An HTTP Request node posts the token and the secret key to https://challenges.cloudflare.com/turnstile/v0/siteverify. An IF node then reads success.

Two practical tips:

• Keep the secret in a Set ("Config") node or in n8n credentials, never in the front end.
• If the check fails, return 403. Real users almost never see it, but headless browsers and scripted tests often will. I learned that while testing my own form from an automated browser.

Step 6: store every lead somewhere boring and reliable

A Google Sheets node appends a row with the timestamp, name, email, message and the page the visitor came from. A spreadsheet is not a CRM, but it is searchable, shareable and impossible to lose. Later you can add a node that pushes the same data into SuiteCRM, HubSpot or whatever you use, without touching the website.

Step 7: Telegram, because email is where leads go to die

The last action is a Telegram node that sends me a short message: who, what, and a link to the sheet. I see it on my phone within seconds, wherever I am. For a one-person business, replying in ten minutes instead of the next morning is the cheapest conversion boost there is.

Step 8: tell the browser what happened

Every branch ends in a Respond to Webhook node: 200 for success (and for the honeypot), 400 for invalid input, 403 for a failed Turnstile check. The front end turns these into a thank-you redirect or a clear error message. You can also fire a generate_lead event to Google Analytics only on a real 200, so your conversion numbers are honest.

What it costs and what it saves

• Cost: Turnstile is free, Telegram is free, and Google Sheets is free. n8n runs self-hosted on a small server I already pay for.
• Saves: no spam in the inbox, no missed enquiries, and no paid form tool with a monthly fee per seat.
• Ownership: the workflow, the data and the server are mine. If I change the website, the workflow stays the same.

Make it yours

This pattern works for any static site: Astro, Next.js, Hugo or plain HTML. Start with the webhook, honeypot and Telegram nodes, which take about 30 minutes. Then add Turnstile and storage. Once leads arrive reliably, you can add AI steps, such as classifying the enquiry or drafting a first reply.

I build workflows like this for small businesses in the Netherlands and across the EU. If you would rather not wire it up yourself, here is what an n8n automation project with me looks like, or see more of my work.