diff --git a/app/Services/Auth/UserService.php b/app/Services/Auth/UserService.php
index f4df159d8..09a902051 100644
--- a/app/Services/Auth/UserService.php
+++ b/app/Services/Auth/UserService.php
@@ -128,9 +128,22 @@ public function registerUser(array $payload, ?OAuth2OTP $otp = null):User
     {
         return $this->tx_service->transaction(function () use ($payload, $otp) {
 
-            Log::debug(sprintf("UserService::registerUser payload %s", json_encode($payload)));
-
             $email = trim($payload['email']);
+
+            // The payload is the raw sign-up form (password, confirmation, captcha and CSRF
+            // tokens): log field names only, never values. Field names are client-controlled, so
+            // they are JSON-encoded to escape control characters. They stay in the message: with
+            // inline line breaks allowed (Laravel's default), Monolog turns an escaped newline in
+            // a JSON-encoded context back into a real one.
+            Log::debug
+            (
+                sprintf
+                (
+                    "UserService::registerUser email %s fields %s",
+                    json_encode($email),
+                    json_encode(array_keys($payload))
+                )
+            );
             $former_user = $this->user_repository->getByEmailOrName($email);
 
             if (!is_null($former_user))
diff --git a/resources/js/components/turnstile_captcha.js b/resources/js/components/turnstile_captcha.js
new file mode 100644
index 000000000..3658adc7d
--- /dev/null
+++ b/resources/js/components/turnstile_captcha.js
@@ -0,0 +1,147 @@
+import React, { useEffect, useRef, useState } from "react";
+import { Turnstile } from "@marsidev/react-turnstile";
+import Button from "@material-ui/core/Button";
+import Grid from "@material-ui/core/Grid";
+
+// Turnstile does not always invoke onError when its iframe cannot be loaded (e.g. a network
+// error reaching challenges.cloudflare.com): the widget just never renders and never issues a
+// token. Without a token the backend rejects the form, so after this long without one we treat
+// the security check as failed and let the user retry it.
+export const CAPTCHA_LOAD_TIMEOUT_MS = 15000;
+
+export const CAPTCHA_STATUS = {
+  VERIFYING: "verifying",
+  // Turnstile is showing a challenge the user has to complete: not a load failure.
+  INTERACTIVE: "interactive",
+  SOLVED: "solved",
+  FAILED: "failed",
+};
+
+export const CAPTCHA_MESSAGES = {
+  VERIFYING: "Please wait while we verify you are human, then submit again.",
+  INTERACTIVE: "Complete the security check, then submit again.",
+  FAILED:
+    "We couldn't load the security check. Check your connection or disable any content blocker, then retry.",
+};
+
+// Id of the <script> that @marsidev/react-turnstile injects for api.js (its default).
+export const TURNSTILE_SCRIPT_ID = "cf-turnstile-script";
+
+/**
+ * State for a Turnstile-protected form. With an empty siteKey the captcha is disabled:
+ * nothing renders and ensureToken() always lets the form through.
+ */
+export const useTurnstileCaptcha = (siteKey) => {
+  const ref = useRef(null);
+  const [status, setStatus] = useState(CAPTCHA_STATUS.VERIFYING);
+  const [submitAttempted, setSubmitAttempted] = useState(false);
+  // Bumped to remount the widget when api.js itself has to be loaded again.
+  const [widgetKey, setWidgetKey] = useState(0);
+
+  useEffect(() => {
+    if (!siteKey || status !== CAPTCHA_STATUS.VERIFYING) {
+      return undefined;
+    }
+    const timer = setTimeout(
+      () => setStatus(CAPTCHA_STATUS.FAILED),
+      CAPTCHA_LOAD_TIMEOUT_MS
+    );
+    return () => clearTimeout(timer);
+  }, [siteKey, status]);
+
+  // Call before posting the form: true when it may be posted, otherwise it surfaces why not.
+  const ensureToken = () => {
+    if (!siteKey || ref.current?.getResponse()) {
+      return true;
+    }
+    setSubmitAttempted(true);
+    return false;
+  };
+
+  const onSuccess = () => {
+    setStatus(CAPTCHA_STATUS.SOLVED);
+    setSubmitAttempted(false);
+  };
+
+  const restart = () => {
+    setStatus(CAPTCHA_STATUS.VERIFYING);
+    ref.current?.reset();
+  };
+
+  const retry = () => {
+    setSubmitAttempted(false);
+    if (!window.turnstile) {
+      // api.js never loaded (blocked or a network error), so there is no widget for reset()
+      // to act on, and the library will not inject the script again while the failed
+      // <script> element is still in the DOM. Drop it and remount the widget to reload it.
+      document.getElementById(TURNSTILE_SCRIPT_ID)?.remove();
+      setStatus(CAPTCHA_STATUS.VERIFYING);
+      setWidgetKey((key) => key + 1);
+      return;
+    }
+    restart();
+  };
+
+  const onBeforeInteractive = () => setStatus(CAPTCHA_STATUS.INTERACTIVE);
+
+  const onError = () => setStatus(CAPTCHA_STATUS.FAILED);
+
+  let message = null;
+  if (status === CAPTCHA_STATUS.FAILED) {
+    message = CAPTCHA_MESSAGES.FAILED;
+  } else if (submitAttempted && status === CAPTCHA_STATUS.VERIFYING) {
+    message = CAPTCHA_MESSAGES.VERIFYING;
+  } else if (submitAttempted && status === CAPTCHA_STATUS.INTERACTIVE) {
+    message = CAPTCHA_MESSAGES.INTERACTIVE;
+  }
+
+  return {
+    siteKey,
+    ref,
+    widgetKey,
+    status,
+    message,
+    ensureToken,
+    onSuccess,
+    onBeforeInteractive,
+    restart,
+    retry,
+    onError,
+  };
+};
+
+/**
+ * Renders the Turnstile widget plus its status message and retry action.
+ * `captcha` is the object returned by useTurnstileCaptcha().
+ */
+export const TurnstileCaptcha = ({ captcha, className, errorClassName }) => {
+  if (!captcha.siteKey) {
+    return null;
+  }
+  return (
+    <Grid container item justifyContent="center">
+      <Turnstile
+        key={captcha.widgetKey}
+        ref={captcha.ref}
+        className={className}
+        siteKey={captcha.siteKey}
+        options={{ responseFieldName: "cf-turnstile-response" }}
+        onSuccess={captcha.onSuccess}
+        onBeforeInteractive={captcha.onBeforeInteractive}
+        onExpire={captcha.restart}
+        onTimeout={captcha.restart}
+        onError={captcha.onError}
+      />
+      {captcha.message && (
+        <div className={errorClassName} role="alert">
+          {captcha.message}
+        </div>
+      )}
+      {captcha.status === CAPTCHA_STATUS.FAILED && (
+        <Button type="button" size="small" color="primary" onClick={captcha.retry}>
+          Retry security check
+        </Button>
+      )}
+    </Grid>
+  );
+};
diff --git a/resources/js/email_verification/email_verification.js b/resources/js/email_verification/email_verification.js
index 9d5b82ae0..5e355a64d 100644
--- a/resources/js/email_verification/email_verification.js
+++ b/resources/js/email_verification/email_verification.js
@@ -1,6 +1,5 @@
-import React, { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef } from "react";
 import ReactDOM from "react-dom";
-import { Turnstile } from "@marsidev/react-turnstile";
 import Button from "@material-ui/core/Button";
 import Card from "@material-ui/core/Card";
 import CardHeader from "@material-ui/core/CardHeader";
@@ -15,6 +14,7 @@ import { MuiThemeProvider, createTheme } from "@material-ui/core/styles";
 import { useFormik } from "formik";
 import { object, string, ref } from "yup";
 import Banner from "../components/banner/banner";
+import { TurnstileCaptcha, useTurnstileCaptcha } from "../components/turnstile_captcha";
 
 import styles from "./email_verification.module.scss";
 
@@ -37,8 +37,7 @@ const EmailVerificationPage = ({
   submitButtonText,
 }) => {
   const formEl = useRef(null);
-  const captcha = useRef(null);
-  const [captchaConfirmation, setCaptchaConfirmation] = useState(null);
+  const captcha = useTurnstileCaptcha(captchaPublicKey);
 
   useEffect(() => {
     if (emailVerificationError) {
@@ -56,20 +55,13 @@ const EmailVerificationPage = ({
     initialValues: initialValues,
     validationSchema: validationSchema,
     onSubmit: () => {
-      if (!captcha.current?.getResponse()) {
-        setCaptchaConfirmation("Remember to check the captcha");
+      if (!captcha.ensureToken()) {
         return;
       }
       doHtmlFormPost();
     },
   });
 
-  const onChangeCaptchaProvider = () => {
-    if (captcha.current?.getResponse()) {
-      setCaptchaConfirmation(null);
-    }
-  };
-
   return (
     <Container component="main" maxWidth="xs" className={styles.main_container}>
       <CssBaseline />
@@ -120,22 +112,11 @@ const EmailVerificationPage = ({
                 />
               </Grid>
               <Grid item container alignItems="center" justifyContent="center">
-                <Grid container item justify='center'>
-                  <Turnstile
-                    ref={captcha}
-                    className={styles.turnstile}
-                    siteKey={captchaPublicKey}
-                    options={{ responseFieldName: "cf-turnstile-response" }}
-                    onSuccess={onChangeCaptchaProvider}
-                    onExpire={() => { captcha.current?.reset(); }}
-                    onError={() => setCaptchaConfirmation('The security check encountered an error. Please refresh the page and try again.')}
-                  />
-                  {captchaConfirmation && (
-                    <div className={styles.error_label}>
-                      {captchaConfirmation}
-                    </div>
-                  )}
-                </Grid>
+                <TurnstileCaptcha
+                  captcha={captcha}
+                  className={styles.turnstile}
+                  errorClassName={styles.error_label}
+                />
                 <Grid container item justify='center'>
                   <Button
                     variant="contained"
@@ -174,9 +155,14 @@ const theme = createTheme({
   },
 });
 
-ReactDOM.render(
-  <MuiThemeProvider theme={theme}>
-    <EmailVerificationPage {...config} />
-  </MuiThemeProvider>,
-  document.querySelector("#root")
-);
+export { EmailVerificationPage };
+
+const root = document.querySelector("#root");
+if (root) {
+  ReactDOM.render(
+    <MuiThemeProvider theme={theme}>
+      <EmailVerificationPage {...config} />
+    </MuiThemeProvider>,
+    root
+  );
+}
diff --git a/resources/js/forgot_password/forgot_password.js b/resources/js/forgot_password/forgot_password.js
index d8ba50537..7f5fd863e 100644
--- a/resources/js/forgot_password/forgot_password.js
+++ b/resources/js/forgot_password/forgot_password.js
@@ -1,6 +1,5 @@
-import React, { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef } from "react";
 import ReactDOM from "react-dom";
-import { Turnstile } from "@marsidev/react-turnstile";
 import Button from "@material-ui/core/Button";
 import Card from "@material-ui/core/Card";
 import CardHeader from "@material-ui/core/CardHeader";
@@ -15,6 +14,7 @@ import { MuiThemeProvider, createTheme } from "@material-ui/core/styles";
 import { useFormik } from "formik";
 import { object, string, ref } from "yup";
 import Banner from "../components/banner/banner";
+import { TurnstileCaptcha, useTurnstileCaptcha } from "../components/turnstile_captcha";
 
 import styles from "./forgot_password.module.scss";
 
@@ -39,8 +39,7 @@ const ForgotPasswordPage = ({
   submitButtonText,
 }) => {
   const formEl = useRef(null);
-  const captcha = useRef(null);
-  const [captchaConfirmation, setCaptchaConfirmation] = useState(null);
+  const captcha = useTurnstileCaptcha(captchaPublicKey);
 
   useEffect(() => {
     if (forgotPasswordError) {
@@ -58,21 +57,13 @@ const ForgotPasswordPage = ({
     initialValues: initialValues,
     validationSchema: validationSchema,
     onSubmit: (values) => {
-      const turnstileResponse = captcha.current?.getResponse();
-      if (!turnstileResponse) {
-        setCaptchaConfirmation("Remember to check the captcha");
+      if (!captcha.ensureToken()) {
         return;
       }
       doHtmlFormPost();
     },
   });
 
-  const onChangeCaptchaProvider = () => {
-    if (captcha.current?.getResponse()) {
-      setCaptchaConfirmation(null);
-    }
-  };
-
   return (
     <Container component="main" maxWidth="xs" className={styles.main_container}>
       <CssBaseline />
@@ -136,22 +127,11 @@ const ForgotPasswordPage = ({
                 />
               </Grid>
               <Grid item container alignItems="center" justifyContent="center">
-                <Grid container item justify='center'>
-                  <Turnstile
-                    ref={captcha}
-                    className={styles.turnstile}
-                    siteKey={captchaPublicKey}
-                    options={{ responseFieldName: "cf-turnstile-response" }}
-                    onSuccess={onChangeCaptchaProvider}
-                    onExpire={() => { captcha.current?.reset(); }}
-                    onError={() => setCaptchaConfirmation('The security check encountered an error. Please refresh the page and try again.')}
-                  />
-                  {captchaConfirmation && (
-                    <div className={styles.error_label}>
-                      {captchaConfirmation}
-                    </div>
-                  )}
-                </Grid>
+                <TurnstileCaptcha
+                  captcha={captcha}
+                  className={styles.turnstile}
+                  errorClassName={styles.error_label}
+                />
                 <Grid container item justify='center'>
                   <Button
                     variant="contained"
@@ -198,9 +178,14 @@ const theme = createTheme({
   },
 });
 
-ReactDOM.render(
-  <MuiThemeProvider theme={theme}>
-    <ForgotPasswordPage {...config} />
-  </MuiThemeProvider>,
-  document.querySelector("#root")
-);
+export { ForgotPasswordPage };
+
+const root = document.querySelector("#root");
+if (root) {
+  ReactDOM.render(
+    <MuiThemeProvider theme={theme}>
+      <ForgotPasswordPage {...config} />
+    </MuiThemeProvider>,
+    root
+  );
+}
diff --git a/resources/js/reset_password/reset_password.js b/resources/js/reset_password/reset_password.js
index 6356d4224..247e83770 100644
--- a/resources/js/reset_password/reset_password.js
+++ b/resources/js/reset_password/reset_password.js
@@ -1,6 +1,5 @@
-import React, { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef } from "react";
 import ReactDOM from "react-dom";
-import { Turnstile } from "@marsidev/react-turnstile";
 import Button from "@material-ui/core/Button";
 import Card from "@material-ui/core/Card";
 import CardHeader from "@material-ui/core/CardHeader";
@@ -17,6 +16,7 @@ import {MuiThemeProvider, createTheme} from "@material-ui/core/styles";
 import {useFormik} from "formik";
 import {object, string} from "yup";
 import Banner from "../components/banner/banner";
+import { TurnstileCaptcha, useTurnstileCaptcha } from "../components/turnstile_captcha";
 
 import styles from "./reset_password.module.scss";
 import {buildPasswordValidationSchema} from "../validator";
@@ -37,8 +37,7 @@ const ResetPasswordPage = ({
 }) => {
 
   const formEl = useRef(null);
-  const captcha = useRef(null);
-  const [captchaConfirmation, setCaptchaConfirmation] = useState(null);
+  const captcha = useTurnstileCaptcha(captchaPublicKey);
 
   useEffect(() => {
     if (resetPasswordError) {
@@ -61,21 +60,13 @@ const ResetPasswordPage = ({
     initialValues: initialValues,
     validationSchema: buildValidationSchema(passwordPolicy),
     onSubmit: (values) => {
-      const turnstileResponse = captcha.current?.getResponse();
-      if (!turnstileResponse) {
-        setCaptchaConfirmation("Remember to check the captcha");
+      if (!captcha.ensureToken()) {
         return;
       }
       doHtmlFormPost();
     },
   });
 
-  const onChangeCaptchaProvider = () => {
-    if (captcha.current?.getResponse()) {
-      setCaptchaConfirmation(null);
-    }
-  };
-
   return (
     <Container component="main" maxWidth="xs" className={styles.main_container}>
       <CssBaseline />
@@ -171,22 +162,11 @@ const ResetPasswordPage = ({
                 </Typography>
               </Grid>
               <Grid item container alignItems="center" justifyContent="center">
-                <Grid container item justify='center'>
-                  <Turnstile
-                    ref={captcha}
-                    className={styles.turnstile}
-                    siteKey={captchaPublicKey}
-                    options={{ responseFieldName: "cf-turnstile-response" }}
-                    onSuccess={onChangeCaptchaProvider}
-                    onExpire={() => { captcha.current?.reset(); }}
-                    onError={() => setCaptchaConfirmation('The security check encountered an error. Please refresh the page and try again.')}
-                  />
-                  {captchaConfirmation && (
-                      <div className={styles.error_label}>
-                        {captchaConfirmation}
-                      </div>
-                  )}
-                </Grid>
+                <TurnstileCaptcha
+                  captcha={captcha}
+                  className={styles.turnstile}
+                  errorClassName={styles.error_label}
+                />
                 <Grid container item justify='center'>
                   <Button
                       variant="contained"
@@ -227,9 +207,14 @@ const theme = createTheme({
   },
 });
 
-ReactDOM.render(
-  <MuiThemeProvider theme={theme}>
-    <ResetPasswordPage {...config} />
-  </MuiThemeProvider>,
-  document.querySelector("#root")
-);
+export { ResetPasswordPage };
+
+const root = document.querySelector("#root");
+if (root) {
+  ReactDOM.render(
+    <MuiThemeProvider theme={theme}>
+      <ResetPasswordPage {...config} />
+    </MuiThemeProvider>,
+    root
+  );
+}
diff --git a/resources/js/set_password/set_password.js b/resources/js/set_password/set_password.js
index f9507f54c..448f77a3d 100644
--- a/resources/js/set_password/set_password.js
+++ b/resources/js/set_password/set_password.js
@@ -1,6 +1,5 @@
-import React, { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef } from "react";
 import ReactDOM from "react-dom";
-import { Turnstile } from "@marsidev/react-turnstile";
 import Button from "@material-ui/core/Button";
 import Card from "@material-ui/core/Card";
 import CardHeader from "@material-ui/core/CardHeader";
@@ -19,6 +18,7 @@ import {MuiThemeProvider, createTheme} from "@material-ui/core/styles";
 import {useFormik} from "formik";
 import { object, string, ref } from "yup";
 import Banner from "../components/banner/banner";
+import { TurnstileCaptcha, useTurnstileCaptcha } from "../components/turnstile_captcha";
 import {buildPasswordValidationSchema} from "../validator";
 
 import styles from "./set_password.module.scss";
@@ -41,8 +41,7 @@ const SetPasswordPage = ({
   token
 }) => {
   const formEl = useRef(null);
-  const captcha = useRef(null);
-  const [captchaConfirmation, setCaptchaConfirmation] = useState(null);
+  const captcha = useTurnstileCaptcha(captchaPublicKey);
 
   useEffect(() => {
     if (setPasswordError) {
@@ -75,21 +74,13 @@ const SetPasswordPage = ({
     initialValues: initialValues,
     validationSchema: buildValidationSchema(passwordPolicy),
     onSubmit: (values) => {
-      const turnstileResponse = captcha.current?.getResponse();
-      if (!turnstileResponse) {
-        setCaptchaConfirmation("Remember to check the captcha");
+      if (!captcha.ensureToken()) {
         return;
       }
       doHtmlFormPost();
     },
   });
 
-  const onChangeCaptchaProvider = () => {
-    if (captcha.current?.getResponse()) {
-      setCaptchaConfirmation(null);
-    }
-  };
-
   return (
     <Container component="main" maxWidth="xs" className={styles.main_container}>
       <CssBaseline />
@@ -280,22 +271,11 @@ const SetPasswordPage = ({
                 </Typography>
               </Grid>
               <Grid item container alignItems="center" justifyContent="center">
-                <Grid container item justify='center'>
-                  <Turnstile
-                    ref={captcha}
-                    className={styles.turnstile}
-                    siteKey={captchaPublicKey}
-                    options={{ responseFieldName: "cf-turnstile-response" }}
-                    onSuccess={onChangeCaptchaProvider}
-                    onExpire={() => { captcha.current?.reset(); }}
-                    onError={() => setCaptchaConfirmation('The security check encountered an error. Please refresh the page and try again.')}
-                  />
-                  {captchaConfirmation && (
-                    <div className={styles.error_label}>
-                      {captchaConfirmation}
-                    </div>
-                  )}
-                </Grid>
+                <TurnstileCaptcha
+                  captcha={captcha}
+                  className={styles.turnstile}
+                  errorClassName={styles.error_label}
+                />
                 <Grid container item justify='center'>
                   <Button
                     variant="contained"
@@ -351,9 +331,14 @@ const theme = createTheme({
   },
 });
 
-ReactDOM.render(
-  <MuiThemeProvider theme={theme}>
-    <SetPasswordPage {...config} />
-  </MuiThemeProvider>,
-  document.querySelector("#root")
-);
+export { SetPasswordPage };
+
+const root = document.querySelector("#root");
+if (root) {
+  ReactDOM.render(
+    <MuiThemeProvider theme={theme}>
+      <SetPasswordPage {...config} />
+    </MuiThemeProvider>,
+    root
+  );
+}
diff --git a/resources/js/signup/signup.js b/resources/js/signup/signup.js
index 1d595e2aa..e9b116e29 100644
--- a/resources/js/signup/signup.js
+++ b/resources/js/signup/signup.js
@@ -1,6 +1,5 @@
-import React, { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef } from "react";
 import ReactDOM from "react-dom";
-import { Turnstile } from "@marsidev/react-turnstile";
 import Button from "@material-ui/core/Button";
 import Card from "@material-ui/core/Card";
 import CardHeader from "@material-ui/core/CardHeader";
@@ -22,6 +21,8 @@ import { object, string, ref } from "yup";
 import Banner from "../components/banner/banner";
 import {buildPasswordValidationSchema} from "../validator";
 
+import { TurnstileCaptcha, useTurnstileCaptcha } from "../components/turnstile_captcha";
+
 import styles from "./signup.module.scss";
 
 const SignUpPage = ({
@@ -42,8 +43,7 @@ const SignUpPage = ({
   tenantName,
 }) => {
   const formEl = useRef(null);
-  const captcha = useRef(null);
-  const [captchaConfirmation, setCaptchaConfirmation] = useState(null);
+  const captcha = useTurnstileCaptcha(captchaPublicKey);
 
   useEffect(() => {
     if (signUpError) {
@@ -84,21 +84,13 @@ const SignUpPage = ({
       return errors;
     },
     onSubmit: (values) => {
-      const turnstileResponse = captcha.current?.getResponse();
-      if (!turnstileResponse) {
-        setCaptchaConfirmation("Remember to check the captcha");
+      if (!captcha.ensureToken()) {
         return;
       }
       doHtmlFormPost();
     },
   });
 
-  const onChangeCaptchaProvider = () => {
-    if (captcha.current?.getResponse()) {
-      setCaptchaConfirmation(null);
-    }
-  };
-
   return (
     <Container component="main" maxWidth="xs" className={styles.main_container}>
       <CssBaseline />
@@ -274,22 +266,11 @@ const SignUpPage = ({
                 </Typography>
               </Grid>
               <Grid item container alignItems="center" justifyContent="center">
-                <Grid container item justify='center'>
-                  <Turnstile
-                    ref={captcha}
-                    className={styles.turnstile}
-                    siteKey={captchaPublicKey}
-                    options={{ responseFieldName: "cf-turnstile-response" }}
-                    onSuccess={onChangeCaptchaProvider}
-                    onExpire={() => { captcha.current?.reset(); }}
-                    onError={() => setCaptchaConfirmation('The security check encountered an error. Please refresh the page and try again.')}
-                  />
-                  {captchaConfirmation && (
-                    <div className={styles.error_label}>
-                      {captchaConfirmation}
-                    </div>
-                  )}
-                </Grid>
+                <TurnstileCaptcha
+                  captcha={captcha}
+                  className={styles.turnstile}
+                  errorClassName={styles.error_label}
+                />
                 {codeOfConductUrl && (
                   <Grid container item justify='center'>
                     <Checkbox
@@ -372,9 +353,14 @@ const theme = createTheme({
   },
 });
 
-ReactDOM.render(
-  <MuiThemeProvider theme={theme}>
-    <SignUpPage {...config} />
-  </MuiThemeProvider>,
-  document.querySelector("#root")
-);
+export { SignUpPage };
+
+const root = document.querySelector("#root");
+if (root) {
+  ReactDOM.render(
+    <MuiThemeProvider theme={theme}>
+      <SignUpPage {...config} />
+    </MuiThemeProvider>,
+    root
+  );
+}
diff --git a/tests/UserServiceRegisterLoggingTest.php b/tests/UserServiceRegisterLoggingTest.php
new file mode 100644
index 000000000..4bf34645d
--- /dev/null
+++ b/tests/UserServiceRegisterLoggingTest.php
@@ -0,0 +1,122 @@
+<?php namespace Tests;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use App\Services\Auth\IUserService;
+use Illuminate\Support\Facades\Log;
+use Monolog\Formatter\LineFormatter;
+use Monolog\Handler\TestHandler;
+use Monolog\Level;
+use Monolog\LogRecord;
+
+/**
+ * Class UserServiceRegisterLoggingTest
+ *
+ * Registration receives the raw sign-up form (password, confirmation, Turnstile token,
+ * CSRF token). None of those secrets may reach the application log, at any level.
+ */
+final class UserServiceRegisterLoggingTest extends BrowserKitTestCase
+{
+    public function testRegisterUserDoesNotLogCredentialsOrTokens(): void
+    {
+        $email    = 'register-logging@example.com';
+        $password = 'Zx9!plainTextSecret';
+        $captcha  = 'turnstile-token-must-not-be-logged';
+        $csrf     = 'csrf-token-must-not-be-logged';
+
+        // Capture on the logger UserService writes to (the default channel, via the Log facade),
+        // at debug level, whatever level the channel's own handlers are configured with. The
+        // test handler keeps records in memory, so the secrets are never written to disk.
+        $capture = new TestHandler(Level::Debug);
+        $logger  = Log::getLogger();
+        $logger->pushHandler($capture);
+
+        try {
+            $user = $this->app->make(IUserService::class)->registerUser([
+                'first_name'            => 'Log',
+                'last_name'             => 'Safe',
+                'email'                 => $email,
+                'country_iso_code'      => 'US',
+                'password'              => $password,
+                'password_confirmation' => $password,
+                'cf-turnstile-response' => $captcha,
+                '_token'                => $csrf,
+            ]);
+        } finally {
+            $logger->popHandler();
+        }
+
+        $this->assertSame($email, $user->getEmail());
+
+        $log = implode("\n", array_map(
+            fn (LogRecord $record) => $record->message . ' ' . json_encode($record->context),
+            $capture->getRecords()
+        ));
+        $this->assertStringContainsString(
+            'UserService::registerUser',
+            $log,
+            'registerUser log lines must be captured for this test to be meaningful'
+        );
+        $this->assertStringNotContainsString($password, $log, 'password leaked to the log');
+        $this->assertStringNotContainsString($captcha, $log, 'Turnstile token leaked to the log');
+        $this->assertStringNotContainsString($csrf, $log, 'CSRF token leaked to the log');
+
+        $record = $this->registerUserRecord($capture);
+        $this->assertStringContainsString(json_encode($email), $record->message);
+        $this->assertStringContainsString('"email"', $record->message);
+        $this->assertStringContainsString('"password"', $record->message);
+    }
+
+    public function testRegisterUserDoesNotLetFieldNamesForgeLogLines(): void
+    {
+        // PHP keeps a %0A in a form field name as a real newline, and Laravel's line formatter
+        // allows inline line breaks, so an interpolated field name could forge a log line.
+        $forged = "extra\n[2026-01-01 00:00:00] production.ERROR: forged";
+
+        $capture = new TestHandler(Level::Debug);
+        $logger  = Log::getLogger();
+        $logger->pushHandler($capture);
+
+        try {
+            $this->app->make(IUserService::class)->registerUser([
+                'first_name'            => 'Log',
+                'last_name'             => 'Forge',
+                'email'                 => '  register-forge@example.com ',
+                'country_iso_code'      => 'US',
+                'password'              => 'Zx9!plainTextSecret',
+                'password_confirmation' => 'Zx9!plainTextSecret',
+                $forged                 => '1',
+            ]);
+        } finally {
+            $logger->popHandler();
+        }
+
+        $record = $this->registerUserRecord($capture);
+        $this->assertStringNotContainsString("\n", $record->message);
+        $this->assertStringContainsString('"register-forge@example.com"', $record->message);
+        $this->assertStringContainsString(json_encode($forged), $record->message);
+        // Written with the formatter Laravel gives its file channels, the record stays one line.
+        $line = (new LineFormatter(null, null, true, true, true))->format($record);
+        $this->assertSame(1, substr_count($line, "\n"), "registerUser log record spans several lines: {$line}");
+    }
+
+    private function registerUserRecord(TestHandler $capture): LogRecord
+    {
+        foreach ($capture->getRecords() as $record) {
+            if (str_starts_with($record->message, 'UserService::registerUser')) {
+                return $record;
+            }
+        }
+        $this->fail('no UserService::registerUser log record was captured');
+    }
+}
diff --git a/tests/js/components/turnstile_captcha.test.js b/tests/js/components/turnstile_captcha.test.js
new file mode 100644
index 000000000..f4e0b3af3
--- /dev/null
+++ b/tests/js/components/turnstile_captcha.test.js
@@ -0,0 +1,207 @@
+import React from 'react';
+import { render, screen, fireEvent, act } from '@testing-library/react';
+
+jest.mock('@marsidev/react-turnstile', () => require('../helpers/turnstile_mock'));
+
+import { mockTurnstile } from '../helpers/turnstile_mock';
+import {
+  TurnstileCaptcha,
+  useTurnstileCaptcha,
+  CAPTCHA_LOAD_TIMEOUT_MS,
+  CAPTCHA_MESSAGES,
+  TURNSTILE_SCRIPT_ID,
+} from '../../../resources/js/components/turnstile_captcha';
+
+// Minimal Turnstile-protected form, wired the way the auth pages wire it.
+const ProtectedForm = ({ siteKey, onPost }) => {
+  const captcha = useTurnstileCaptcha(siteKey);
+  return (
+    <form
+      onSubmit={(e) => {
+        e.preventDefault();
+        if (captcha.ensureToken()) onPost();
+      }}
+    >
+      <TurnstileCaptcha captcha={captcha} errorClassName="error" />
+      <button type="submit">Submit</button>
+    </form>
+  );
+};
+
+const submit = () => fireEvent.click(screen.getByRole('button', { name: 'Submit' }));
+const retryButton = () => screen.queryByRole('button', { name: /retry security check/i });
+const solve = () => {
+  mockTurnstile.token = 'turnstile-token';
+  act(() => mockTurnstile.props.onSuccess('turnstile-token'));
+};
+
+describe('TurnstileCaptcha / useTurnstileCaptcha', () => {
+  let onPost;
+
+  beforeEach(() => {
+    mockTurnstile.clear();
+    onPost = jest.fn();
+    // api.js loaded: the global Turnstile API exists (cases below delete it when needed).
+    window.turnstile = {};
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    delete window.turnstile;
+    document.getElementById(TURNSTILE_SCRIPT_ID)?.remove();
+  });
+
+  it('asks the user to wait, instead of to "check the captcha", when submitted before a token exists', () => {
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    submit();
+
+    expect(screen.getByRole('alert')).toHaveTextContent(CAPTCHA_MESSAGES.VERIFYING);
+    expect(screen.queryByText(/remember to check the captcha/i)).not.toBeInTheDocument();
+    expect(onPost).not.toHaveBeenCalled();
+  });
+
+  it('lets the form through and clears the waiting message once a token is issued', () => {
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    submit();
+    solve();
+    expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+
+    submit();
+    expect(onPost).toHaveBeenCalledTimes(1);
+  });
+
+  it('posts the response under the field name the backend validates', () => {
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    expect(mockTurnstile.props.siteKey).toBe('site-key');
+    expect(mockTurnstile.props.options).toEqual({ responseFieldName: 'cf-turnstile-response' });
+  });
+
+  it('reports a failed security check with a retry when no token arrives (iframe never loaded)', () => {
+    jest.useFakeTimers();
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS - 1));
+    expect(screen.queryByText(CAPTCHA_MESSAGES.FAILED)).not.toBeInTheDocument();
+
+    act(() => jest.advanceTimersByTime(1));
+    expect(screen.getByRole('alert')).toHaveTextContent(CAPTCHA_MESSAGES.FAILED);
+
+    fireEvent.click(retryButton());
+    expect(mockTurnstile.reset).toHaveBeenCalledTimes(1);
+    expect(screen.queryByText(CAPTCHA_MESSAGES.FAILED)).not.toBeInTheDocument();
+    expect(retryButton()).not.toBeInTheDocument();
+
+    // The retried widget gets a fresh timeout window.
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS));
+    expect(screen.getByText(CAPTCHA_MESSAGES.FAILED)).toBeInTheDocument();
+  });
+
+  it('reloads api.js on retry when the script itself never loaded', () => {
+    jest.useFakeTimers();
+    delete window.turnstile;
+    const failedScript = document.createElement('script');
+    failedScript.id = TURNSTILE_SCRIPT_ID;
+    document.head.appendChild(failedScript);
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+    expect(mockTurnstile.mounts).toBe(1);
+
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS));
+    fireEvent.click(retryButton());
+
+    // The failed <script> is dropped and the widget remounted, so the library injects
+    // api.js again; reset() would be a no-op without a widget.
+    expect(document.getElementById(TURNSTILE_SCRIPT_ID)).toBeNull();
+    expect(mockTurnstile.mounts).toBe(2);
+    expect(mockTurnstile.reset).not.toHaveBeenCalled();
+    expect(screen.queryByText(CAPTCHA_MESSAGES.FAILED)).not.toBeInTheDocument();
+
+    // The reloaded widget can still succeed and unblock the form.
+    solve();
+    submit();
+    expect(onPost).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not report a load failure while the user is completing an interactive challenge', () => {
+    jest.useFakeTimers();
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    act(() => mockTurnstile.props.onBeforeInteractive());
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS * 2));
+
+    expect(screen.queryByText(CAPTCHA_MESSAGES.FAILED)).not.toBeInTheDocument();
+    submit();
+    expect(onPost).not.toHaveBeenCalled();
+    expect(screen.getByRole('alert')).toHaveTextContent(CAPTCHA_MESSAGES.INTERACTIVE);
+
+    solve();
+    expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+  });
+
+  it('re-arms the load timeout when the widget restarts after an interactive challenge', () => {
+    jest.useFakeTimers();
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    act(() => mockTurnstile.props.onBeforeInteractive());
+    act(() => mockTurnstile.props.onTimeout());
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS));
+
+    expect(screen.getByText(CAPTCHA_MESSAGES.FAILED)).toBeInTheDocument();
+  });
+
+  it('does not report a failure once a token arrived before the timeout', () => {
+    jest.useFakeTimers();
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    solve();
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS * 2));
+
+    expect(screen.queryByText(CAPTCHA_MESSAGES.FAILED)).not.toBeInTheDocument();
+  });
+
+  it('reports a failed security check with a retry when Turnstile raises an error', () => {
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    act(() => mockTurnstile.props.onError('200500'));
+
+    expect(screen.getByRole('alert')).toHaveTextContent(CAPTCHA_MESSAGES.FAILED);
+    expect(retryButton()).toBeInTheDocument();
+  });
+
+  it('recovers if Turnstile succeeds on its own after an error', () => {
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    act(() => mockTurnstile.props.onError('200500'));
+    solve();
+
+    expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    expect(retryButton()).not.toBeInTheDocument();
+  });
+
+  it('re-runs the widget when the token expires and blocks the post until a new one arrives', () => {
+    render(<ProtectedForm siteKey="site-key" onPost={onPost} />);
+
+    solve();
+    mockTurnstile.token = undefined;
+    act(() => mockTurnstile.props.onExpire());
+
+    expect(mockTurnstile.reset).toHaveBeenCalledTimes(1);
+    submit();
+    expect(onPost).not.toHaveBeenCalled();
+    expect(screen.getByRole('alert')).toHaveTextContent(CAPTCHA_MESSAGES.VERIFYING);
+  });
+
+  it('renders nothing and never blocks the post when no site key is configured', () => {
+    jest.useFakeTimers();
+    render(<ProtectedForm siteKey="" onPost={onPost} />);
+
+    expect(screen.queryByTestId('turnstile')).not.toBeInTheDocument();
+    act(() => jest.advanceTimersByTime(CAPTCHA_LOAD_TIMEOUT_MS * 2));
+    expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+
+    submit();
+    expect(onPost).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/tests/js/helpers/turnstile_mock.js b/tests/js/helpers/turnstile_mock.js
new file mode 100644
index 000000000..175bb728c
--- /dev/null
+++ b/tests/js/helpers/turnstile_mock.js
@@ -0,0 +1,30 @@
+// Test double for @marsidev/react-turnstile. Use it with:
+//   jest.mock('@marsidev/react-turnstile', () => require('<relative path>/helpers/turnstile_mock'));
+// It records the callbacks the page wires up (so a test can fire onSuccess / onError) and
+// exposes the imperative handle (getResponse / reset) the page reads through its ref.
+import React, { forwardRef, useEffect, useImperativeHandle } from 'react';
+
+export const mockTurnstile = {
+  props: null,
+  token: undefined,
+  mounts: 0,
+  reset: jest.fn(),
+  clear() {
+    this.props = null;
+    this.token = undefined;
+    this.mounts = 0;
+    this.reset.mockClear();
+  },
+};
+
+export const Turnstile = forwardRef((props, ref) => {
+  mockTurnstile.props = props;
+  useEffect(() => {
+    mockTurnstile.mounts += 1;
+  }, []);
+  useImperativeHandle(ref, () => ({
+    getResponse: () => mockTurnstile.token,
+    reset: mockTurnstile.reset,
+  }));
+  return <div data-testid="turnstile" />;
+});
diff --git a/tests/js/turnstile_pages.test.js b/tests/js/turnstile_pages.test.js
new file mode 100644
index 000000000..49b548e54
--- /dev/null
+++ b/tests/js/turnstile_pages.test.js
@@ -0,0 +1,168 @@
+import React from 'react';
+import { render, screen, fireEvent, waitFor, act } from '@testing-library/react';
+
+jest.mock('@marsidev/react-turnstile', () => require('./helpers/turnstile_mock'));
+jest.mock('react-password-strength-bar', () => () => null);
+
+import { mockTurnstile } from './helpers/turnstile_mock';
+import { CAPTCHA_MESSAGES } from '../../resources/js/components/turnstile_captcha';
+import { SignUpPage } from '../../resources/js/signup/signup';
+import { ForgotPasswordPage } from '../../resources/js/forgot_password/forgot_password';
+import { ResetPasswordPage } from '../../resources/js/reset_password/reset_password';
+import { SetPasswordPage } from '../../resources/js/set_password/set_password';
+import { EmailVerificationPage } from '../../resources/js/email_verification/email_verification';
+
+// Every Turnstile-protected auth page must gate its HTML form post on the shared captcha:
+// no post (and a "please wait" message, not "check the captcha") until a token exists.
+// The captcha's own states (timeout, error, retry) are covered in components/turnstile_captcha.test.js.
+
+const PASSWORD = 'Abcdef123!';
+const PASSWORD_POLICY = {
+  min_length: 10,
+  max_length: 30,
+  shape_pattern: '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*+\\-])[A-Za-z0-9#?!@$%^&*+\\-]+$',
+  allowed_special_characters: '[A-Za-z0-9#?!@$%^&*+-]',
+  shape_warning: 'Password must include upper, lower, number and special character',
+};
+const COUNTRIES = [{ value: 'US', text: 'United States' }];
+const COMMON = {
+  appLogo: '',
+  captchaPublicKey: 'site-key',
+  csrfToken: 'csrf-token',
+  infoBannerContent: '',
+  showInfoBanner: false,
+  sessionStatus: '',
+  submitButtonText: 'Submit form',
+};
+
+const PAGES = [
+  {
+    name: 'SignUpPage',
+    Page: SignUpPage,
+    submitLabel: /register now/i,
+    props: {
+      ...COMMON,
+      clientId: '',
+      codeOfConductUrl: '',
+      countries: COUNTRIES,
+      initialValues: {
+        first_name: 'Ada', last_name: 'Lovelace', email: 'ada@example.com',
+        country_iso_code: 'US', password: PASSWORD, password_confirmation: PASSWORD,
+      },
+      passwordPolicy: PASSWORD_POLICY,
+      redirectUri: '',
+      signInAction: '/auth/login',
+      signUpAction: '/auth/register',
+      signUpError: '',
+      tenantName: 'FNTECH',
+    },
+  },
+  {
+    name: 'ForgotPasswordPage',
+    Page: ForgotPasswordPage,
+    submitLabel: 'Submit form',
+    props: {
+      ...COMMON,
+      clientId: '',
+      forgotPasswordAction: '/auth/password/email',
+      forgotPasswordError: '',
+      initialValues: { email: 'ada@example.com' },
+      redirectUri: '',
+    },
+  },
+  {
+    name: 'ResetPasswordPage',
+    Page: ResetPasswordPage,
+    submitLabel: 'Submit form',
+    props: {
+      ...COMMON,
+      token: 'reset-token',
+      initialValues: { email: 'ada@example.com', password: PASSWORD, password_confirmation: PASSWORD },
+      passwordPolicy: PASSWORD_POLICY,
+      resetPasswordAction: '/auth/password/reset',
+      resetPasswordError: '',
+    },
+  },
+  {
+    name: 'SetPasswordPage',
+    Page: SetPasswordPage,
+    submitLabel: 'Submit form',
+    props: {
+      ...COMMON,
+      clientId: '',
+      countries: COUNTRIES,
+      initialValues: {
+        email: 'ada@example.com', first_name: 'Ada', last_name: 'Lovelace', company: 'Acme',
+        country_iso_code: 'US', password: PASSWORD, password_confirmation: PASSWORD,
+      },
+      passwordPolicy: PASSWORD_POLICY,
+      redirectUri: '',
+      setPasswordAction: '/auth/password/set',
+      setPasswordError: '',
+      token: 'set-token',
+    },
+  },
+  {
+    name: 'EmailVerificationPage',
+    Page: EmailVerificationPage,
+    submitLabel: 'Submit form',
+    props: {
+      ...COMMON,
+      emailVerificationAction: '/auth/verification/resend',
+      emailVerificationError: '',
+      initialValues: { email: 'ada@example.com' },
+    },
+  },
+];
+
+describe.each(PAGES)('$name security check wiring', ({ Page, props, submitLabel }) => {
+  let formSubmit;
+  const clickSubmit = () => fireEvent.click(screen.getByRole('button', { name: submitLabel }));
+
+  beforeEach(() => {
+    mockTurnstile.clear();
+    formSubmit = jest.spyOn(HTMLFormElement.prototype, 'submit').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    formSubmit.mockRestore();
+  });
+
+  it('does not post before Turnstile issues a token and asks the user to wait', async () => {
+    render(<Page {...props} />);
+
+    clickSubmit();
+
+    expect(await screen.findByText(CAPTCHA_MESSAGES.VERIFYING)).toBeInTheDocument();
+    expect(screen.queryByText(/remember to check the captcha/i)).not.toBeInTheDocument();
+    expect(formSubmit).not.toHaveBeenCalled();
+  });
+
+  it('posts the form once Turnstile has issued a token', async () => {
+    render(<Page {...props} />);
+
+    mockTurnstile.token = 'turnstile-token';
+    act(() => mockTurnstile.props.onSuccess('turnstile-token'));
+    clickSubmit();
+
+    await waitFor(() => expect(formSubmit).toHaveBeenCalledTimes(1));
+  });
+
+  it('offers a retry when Turnstile fails', () => {
+    render(<Page {...props} />);
+
+    act(() => mockTurnstile.props.onError('200500'));
+
+    expect(screen.getByText(CAPTCHA_MESSAGES.FAILED)).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /retry security check/i })).toBeInTheDocument();
+  });
+
+  it('neither renders the widget nor blocks the post when no site key is configured', async () => {
+    render(<Page {...props} captchaPublicKey="" />);
+
+    expect(screen.queryByTestId('turnstile')).not.toBeInTheDocument();
+    clickSubmit();
+
+    await waitFor(() => expect(formSubmit).toHaveBeenCalledTimes(1));
+  });
+});