Title here
Summary here
Cloudflare Turnstile
Turnstile is Cloudflare’s privacy-focused alternative to traditional CAPTCHAs. It validates users without puzzles, doesn’t track visitors, and is completely free. This module integrates Turnstile with WordPress login, registration, comments, and popular form plugins.
Use Cases
- Protect login forms from brute force attacks
- Prevent spam user registrations
- Stop bot comments without annoying human visitors
- Secure contact forms on your site
How It Works
- You add your Cloudflare Turnstile API keys
- Select which forms to protect
- Turnstile widget appears on those forms
- Most legitimate users pass invisibly
- Suspicious traffic gets additional checks
- Bots and spam are blocked
Getting API Keys
- Go to Cloudflare Dashboard
- Click Add Widget
- Enter your site domain
- Copy the Site Key and Secret Key
- Paste them in module settings
Turnstile is completely free with unlimited verifications. You don’t need a Cloudflare account for your domain — just create a free Cloudflare account.
Protected Forms
WordPress Core Forms
| Form | Setting |
|---|---|
| Login | protect_login |
| Registration | protect_registration |
| Password Reset | protect_password_reset |
| Comments | protect_comments |
Switchboard Integrations
| Integration | Setting |
|---|---|
| Simple Forms | protect_simple_forms |
| Magic Login | protect_magic_login |
| OTP Login | protect_otp_login |
Third-Party Forms
| Plugin | How to Add |
|---|---|
| Contact Form 7 | Add [switchboard_turnstile] tag to your form |
| Fluent Forms | Add “Cloudflare Turnstile” field from Advanced fields |
Appearance Modes
| Mode | Description |
|---|---|
| Always Visible | Widget always shown. Most reliable. (Recommended) |
| On Interaction | Shows only when user interacts with form |
| Invisible | No visible widget. May cause issues — use at your own risk |
Invisible mode can cause verification failures depending on your hosting, caching, or other plugins. If you must use it, add the CSS class sb-turnstile-protect to submit buttons.
Settings
| Setting | Type | Default | Description |
|---|---|---|---|
| Site Key | Text | — | Your Turnstile public site key |
| Secret Key | Text | — | Your Turnstile secret key (kept private) |
| Appearance | Select | Always | When to show the widget |
| Skip Logged-in Users | Toggle | On | Don’t show CAPTCHA to logged-in users |
| Error Message | Text | Custom | Message shown on verification failure |
| Whitelisted IPs | Textarea | — | IPs that bypass Turnstile (one per line) |
Contact Form 7 Integration
- Enable “Contact Form 7” in module settings
- Edit your CF7 form
- Add the tag:
[switchboard_turnstile] - Place it before the submit button
Example form:
[text* your-name]
[email* your-email]
[textarea your-message]
[switchboard_turnstile]
[submit "Send"]Fluent Forms Integration
- Enable “Fluent Forms” in module settings
- Edit your form in Fluent Forms
- Find “Cloudflare Turnstile” under Advanced fields
- Drag it into your form before the submit button
Conflict with Other CAPTCHAs
If you have multiple CAPTCHA modules enabled (Turnstile, reCAPTCHA, Simple CAPTCHA), only one will render per form. We recommend using only one CAPTCHA solution to avoid confusion.
FAQ
Is Turnstile really free?
Yes. Cloudflare offers Turnstile free with unlimited verifications. There are no usage limits or paid tiers for basic functionality.Does Turnstile track my visitors?
No. Turnstile is designed to be privacy-preserving. It doesn’t use cookies for tracking and doesn’t collect personal data about your visitors.Why do some users still see a challenge?
Turnstile automatically shows challenges to suspicious traffic — VPNs, Tor, certain browsers, or unusual behavior patterns. Most legitimate users pass without seeing anything.Can I use Turnstile with WooCommerce?
The module doesn’t have built-in WooCommerce support. For WooCommerce checkout protection, consider a dedicated WooCommerce anti-fraud solution.What if Turnstile blocks legitimate users?
Add their IP to the whitelist, or enable “Skip Logged-in Users” if they have accounts. You can also try switching appearance modes.Turnstile requires your site to be accessible from the internet. It won’t work on localhost or sites behind HTTP basic auth.
PRO
Upgrade to Pro
Get access to all 166 modules with a single license