Cloudflare Turnstile

Summarize with AI

Cloudflare Turnstile is a freemium WP PowerSuite security module that adds Cloudflare’s privacy-friendly bot check to WordPress and WooCommerce — usually without a puzzle for real people.

Create a widget in the Cloudflare Turnstile dashboard, paste the keys into WP PowerSuite, choose which forms to protect, and let server-side siteverify enforce every submission. Product overview: Cloudflare Turnstile.

Protect forms without stacking another captcha plugin

Core WordPress and WooCommerce coverage is free. Unlock form integrations, failsafe, and skip rules with WP PowerSuite Pro.

View pricing

Why teams choose it

Automated signups, comment spam, and checkout abuse still hit WordPress stores every day. Standalone captcha plugins add updates, overlap, and risk. Turnstile inside WP PowerSuite gives you:

A modern challenge that is usually invisible for humans
Free coverage for WordPress core and WooCommerce
Pro coverage for the form plugins agencies already ship
Failsafe behavior when Cloudflare is unreachable
One license, one Modules hub, enable only what you need

Who it is for

Stores fighting fake accounts and checkout bots
Membership and LMS sites protecting registration and login
Agencies standardizing spam protection across client sites
Teams that prefer Cloudflare over Google reCAPTCHA for privacy or UX
Sites that already use Cloudflare and want matching bot protection

What it does

Free — WordPress core

Protect any combination of:

Login — wp-login.php and custom login URLs
Registration
Password reset — lost-password request and set-new-password
Comments — guest and logged-in forms, with a clear error redirect when verification fails

Magic Login screens are skipped so passwordless flows are not interrupted.

Free — WooCommerce

Login, registration, and lost password
Checkout — classic shortcode checkout and block checkout (Store API)
Product reviews (when Comments protection is off)
Express / wallet payments (Apple Pay, Google Pay, Link) are skipped so those orders are not blocked
HPOS and cart/checkout Blocks compatibility declared

Pro — form integrations (auto-inject)

When the matching plugin is active and the integration is enabled:

Basic Forms (WP PowerSuite)
Contact Form 7
WPForms
Formidable Forms
Fluent Forms
Elementor Pro Forms (including popups)
Gravity Forms (final page only on multi-page forms)
Jetpack forms
bbPress (topics and replies)
BuddyPress registration
Ultimate Member (login, register, reset)
MemberPress (login and checkout)
Easy Digital Downloads (login, register, checkout)
Paid Memberships Pro (checkout, frontend login, lost password, reset password)

Pro — MC4WP (shortcode only)

Mailchimp for WordPress does not auto-inject a widget. After you enable the MC4WP integration:

Open MC4WP → Forms and edit your form.
Place this shortcode above the submit button:

[wpps-mc4wp-turnstile]

Save the form and hard-refresh the front end.

Verification runs only when that shortcode is present in the form. If you see the shortcode as plain text, the integration is off at runtime (usually missing WP PowerSuite Pro license) or the form has not been saved with the shortcode.

Option	What it controls
Site Key / Secret Key	Cloudflare credentials. Secret is stored encrypted and never shown in cleartext.
Theme	Auto, Light, or Dark
Full width widget	Flexible size that matches narrow forms (recommended)
Appearance mode	Interaction-only (default, quieter UX) or Always visible
Widget language	Optional ISO language code (Pro)
Refresh timeout	Maps to Cloudflare refresh behavior (Pro)
Disable submit until solved	Locks the submit control until Turnstile succeeds (Pro)
Test connection	Loads Turnstile, obtains a token, and verifies it with Cloudflare

Scripts load with Rocket Loader protection (data-cfasync="false") and common optimizer exclusions so caches/minifiers are less likely to break the challenge.

Advanced options (Pro)

AJAX comment reset — refresh the widget when replying to comments via AJAX
Canonical-only login / registration — protect only the real wp-login.php paths
WooCommerce checkout: guests only — skip logged-in shoppers
Failsafe mode when Cloudflare is unreachable:
- Off — normal behavior
- Allow submissions — signed server marker (use carefully)
- Fallback to Google reCAPTCHA — separate failsafe keys
Performance compatibility — keep Turnstile out of SG Optimizer, LiteSpeed, Autoptimize, Perfmatters, and WP Rocket combine/delay/minify
Resource hints — dns-prefetch / preconnect to Cloudflare
Blocksy compatibility — reset widgets in the Blocksy account modal

Skip rules (Pro)

Skip both the widget and verification for trusted traffic:

WordPress roles
IP addresses / CIDR ranges (IPv4 and IPv6)
User-Agent substrings

Use this for staff, office networks, or monitoring bots — not as a substitute for real access control.

Free vs Pro at a glance

Capability	Free	Pro
API keys, theme, full width, appearance	✅	✅
WordPress login, register, reset, comments	✅	✅
WooCommerce login, register, reset, checkout, reviews	✅	✅
Form-plugin integrations	—	✅
MC4WP shortcode	—	✅
Failsafe / skip rules / optimizer & theme extras	—	✅
Disable submit / AJAX comment reset / guest-only checkout	—	✅

Without WP PowerSuite Pro, Pro-tier toggles are forced off at runtime even if they still appear saved in the UI. Install WP PowerSuite Pro and activate under WP PowerSuite → License.

When to enable it

Turn it on when you want to:

Stop bots on login, registration, comments, or checkout
Prefer Cloudflare’s quieter challenge over a checkbox puzzle
Cover classic and block checkout in one module
Standardize spam protection across agency sites under one suite

When to leave it off

How to get started

Create a Turnstile widget in the Cloudflare dashboard and copy the Site Key and Secret Key.
Go to WP PowerSuite → Modules → Security and enable Cloudflare Turnstile.
Open the module settings → API & appearance, paste keys, choose theme/appearance, and save.
Click Run test until the connection test succeeds.
Enable WordPress core and WooCommerce surfaces you need.
With a WP PowerSuite Pro, enable form integrations. For MC4WP, also add [wpps-mc4wp-turnstile] in the form editor.
Hard-refresh protected front-end pages (and purge page cache if you use one).

Multisite

If site-level keys are empty, the module can fall back to network options wpps_network_cloudflare-turnstile_site_key and wpps_network_cloudflare-turnstile_secret_key. Prefer ENC2-encrypted storage for network secrets.

How to verify it works

Save keys and pass Run test.
✅ The test reports a successful siteverify.
Enable Login, open wp-login.php in a private window, and submit without completing Turnstile.
✅ Login is blocked with a security verification message.
Enable Checkout, add a product, and place an order on classic and block checkout.
✅ The widget appears before Place Order; failing verification blocks the order; wallet/express paths still complete.
Enable a Pro form (for example Contact Form 7), submit empty/invalid without solving.
✅ The form is rejected for captcha.
For MC4WP, confirm the shortcode renders a widget (not literal text), then submit without solving.
✅ Subscription is rejected with the Turnstile error message.
For Paid Memberships Pro, open checkout, login, and lost-password pages.
✅ Widgets appear on each; checkout does not show an error before you submit.

Troubleshooting

Widget missing. Keys empty, that form’s toggle is off, skip rules match the visitor, or Pro integration is gated by WP PowerSuite Pro.
Always fails verification. Wrong secret, domain not allowed on the Cloudflare widget, or a cache/optimizer mangling the script — enable Performance compatibility and purge caches.
Blocks checkout widget after Place Order / React errors. Update to the latest Turnstile module build; the widget mounts before Place Order outside React-owned rows.
MC4WP shows [wpps-mc4wp-turnstile] as text. Enable the MC4WP integration with a valid WP PowerSuite Pro, keep the shortcode in the form editor, save, and hard-refresh.
PMP shows “Please complete the security verification” before submit. Update the module; validation belongs on submit (pmpro_registration_checks), not page load.
Two CAPTCHAs on one form. Disable the overlapping toggle in Google reCAPTCHA or Simple CAPTCHA.
Pro section locked or ignored. Install WP PowerSuite Pro and activate under WP PowerSuite → License, then re-save settings.

Manage with WP-CLI

Prefer the command line? You can turn this module on or off with WP-CLI instead of the dashboard:

# Turn the module on
wp powersuite module enable cloudflare-turnstile

# Turn the module off
wp powersuite module disable cloudflare-turnstile

# Check whether it is on, its category, and where its settings live
wp powersuite module get cloudflare-turnstile

Managing more than one site? Add --url=https://example.com to point a command at one site. If this is a Pro module, install WP PowerSuite Pro and activate your license first. New to WP-CLI? See the full command guide.

FAQ

What does Cloudflare Turnstile do in WP PowerSuite?

It adds Cloudflare Turnstile verification to WordPress core forms, WooCommerce surfaces, and Pro form-plugin integrations after you save site and secret keys.

Is Cloudflare Turnstile free in WP PowerSuite?

Yes. Core WordPress and WooCommerce protection is free. Form integrations, advanced options, failsafe, and skip rules require an active WP PowerSuite Pro license.

Does Turnstile show a puzzle to every visitor?

Usually no. Interaction-only appearance (the default) keeps the widget quiet for most real visitors and challenges only when needed.

Does it protect WooCommerce Blocks checkout?

Yes. Classic checkout and block checkout (including Store API) are supported. Wallet/express payments such as Apple Pay, Google Pay, and Link are skipped so those flows are not blocked.

How do I add Turnstile to MC4WP forms?

Enable the MC4WP integration (Pro), then place [wpps-mc4wp-turnstile] in the MC4WP form editor above the submit button. There is no auto-injection.

What happens if Cloudflare is unreachable?

By default verification fails closed. With Pro failsafe you can allow signed submissions or fall back to Google reCAPTCHA using separate keys.

Can I use Turnstile and Google reCAPTCHA together?

You can enable both modules, but do not protect the same form in both. Overlapping challenges create a poor checkout or login experience.

How do I turn Cloudflare Turnstile off?

Go to WP PowerSuite → Modules, find Cloudflare Turnstile, and toggle it off. Disabled modules do not load at runtime.

Developer notes (hooks & filters)

Source: modules/cloudflare-turnstile/module.php, ExtendedIntegrations.php, FeatureGate.php.
Boot: critical · context: both.

Verify filter: wpps_verify_turnstile
Error copy filter: wpps_captcha_error_message
Optional hostname enforcement: wp_powersuite_turnstile_enforce_hostname (default off), allowlist wp_powersuite_turnstile_allowed_hostnames
Token filter: wp_powersuite_turnstile_response_token
Comment/review skip: wp_powersuite_turnstile_skip_verification
Woo Store API namespace: wp-powersuite-turnstile (extension field token)
Blocks mount: render_block_woocommerce/checkout-actions-block + assets/woo-checkout.js
MC4WP shortcode: wpps-mc4wp-turnstile (expanded via mc4wp_form_content + do_shortcode)
Siteverify memoizes per request so single-use tokens survive WordPress double-validation paths
Cloudflare published test keys are honored via metadata.result_with_testing_key

Ready for quieter bot protection?

Enable Cloudflare Turnstile in WP PowerSuite, protect the forms that matter, and keep everything else off the critical path.

Get WP PowerSuite