Reduce email signup friction (no CAPTCHA; shorter confirm copy) - #206
Merged
Conversation
jimdc
changed the title
jimdc
enabled auto-merge
July 31, 2026 00:43
jimdc
force-pushed
the
reduce-perceived-friction-on-the-email-signup-ow
branch
2 times, most recently
from
July 31, 2026 01:18
afebb22 to
5bae9b6
Compare
Switch homepage and Alerts Turnstile widgets to interaction-only so most visitors never see a challenge, and shorten confirmation copy on both surfaces while keeping double opt-in and server-side Turnstile checks.
Drop the CAPTCHA from homepage and Alerts subscribe surfaces and stop requiring TURNSTILE_SECRET on /subscribe so signup works without the widget. Per-IP and per-address caps plus confirm-before-alerts remain.
Set the live Microsoft Clarity project id so heatmaps can load under the existing privacy controls, and replace docs/readme frames so the README matches the quieter homepage email CTA and current list detail views.
jimdc
force-pushed
the
reduce-perceived-friction-on-the-email-signup-ow
branch
from
July 31, 2026 01:18
5bae9b6 to
2dc0155
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
User feedback on the new homepage email CTA called out the Cloudflare human check and long confirmation ceremony. Turnstile is removed from the homepage CTA and Alerts subscribe path (client markup, client token gate, and worker verification).
/subscribeno longer requiresTURNSTILE_SECRET—it fails closed only untilTOKEN_SECRET,RESEND_API_KEY, andSUBSare set—so signup works without a CAPTCHA. Remaining protection is per-IP and per-address daily rate caps plus double opt-in (nothing is stored and digests do not start until the address confirms), which still limits third-party signup and confirmation-email abuse that would hurt sender reputation. Confirmation copy is shorter on both surfaces (and translated in all shipping locales). The about-page feedback form keeps Turnstile. If the sends dashboard later shows bot stuffing of confirm mail, Turnstile can return on this path behind an explicit config flag without changing the double-opt-in model.Microsoft Clarity is activated with project id
xusuca7gsvinsite/clarity.js(public id, not a secret). Heatmaps load only when the id is set and the browser is not signaling Do Not Track or Global Privacy Control; form fields stay masked. README screenshots underdocs/readme/were re-captured against the updated UI so the homepage frame shows the masthead email CTA (short confirm line, no CAPTCHA) instead of the pre-cleanup edition strip.Rebased onto
mainafter the Clarity wiring pull request merged (#202), so this branch no longer carries duplicate wiring commits—only the project-id activation, signup friction changes, and screenshot refresh.Test plan
node --test test/homepage_cta.test.mjsnode --test worker/test/home_cta_subscribe.test.mjs(includes no-TURNSTILE_SECRET case)node --test worker/test/multi_watch.test.mjsnode --test test/clarity.test.mjsmain(post-Add optional Microsoft Clarity heatmaps with privacy controls #202) + re-verify green; PR mergeable