diff --git a/.env.example b/.env.example
index 6269e0c1..bd7c8ae4 100644
--- a/.env.example
+++ b/.env.example
@@ -94,10 +94,14 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
 CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 
 # --- CAPTCHA (env fallback; admin settings win when set) ---
-# Enable Turnstile on register/login/forgot/resend without touching the DB.
-# "none" (default), "turnstile", "recaptcha" or "hcaptcha".
+# Enable a captcha on register/login/forgot/resend without touching the DB.
+# "none" (default), "turnstile", "recaptcha" or "hcaptcha". Example:
+#   CAPTCHA_PROVIDER=turnstile
 CAPTCHA_PROVIDER=
-# Cloudflare Turnstile keys from https://dash.cloudflare.com/turnstile
+# Provider keys. The SITE key is public (it ships to every browser), the
+# SECRET is server-only and must never be committed — set it on the host or as
+# a masked CI/CD variable. Cloudflare Turnstile keys:
+# https://dash.cloudflare.com/turnstile
 TURNSTILE_SITE_KEY=
 TURNSTILE_SECRET_KEY=