Cloudflare Turnstile
Cloudflare Turnstile adds bot protection on logins, forms, comments, and WooCommerce - low hassle for real people once your Cloudflare site key and secret key are saved.
What it does
Section titled “What it does”After you save valid Turnstile keys, the module can render and verify widgets on the surfaces you enable.
- Protects WordPress Login, Registration, Password reset, and Comments when those toggles are on.
- Optional WooCommerce: login, registration, lost password, checkout, product reviews.
- Form integrations (Premium section): Basic Forms, Contact Form 7, WPForms, Formidable, Fluent Forms, Elementor Pro Forms, plus Gravity Forms, Jetpack forms, bbPress, BuddyPress, Ultimate Member, MemberPress, EDD, Paid Memberships Pro, MC4WP when those plugins are present.
- Appearance options: theme, size/full width, language, visible appearance, disable submit until verified.
- Advanced: skip rules (roles/IPs/user agents), failsafe mode, performance compatibility, AJAX comment reset.
When to use it
Section titled “When to use it”Enable it if:
- You want Cloudflare Turnstile instead of (or alongside) other CAPTCHA modules.
- Login, comments, or checkout get automated spam or fake accounts.
- You already have a Cloudflare account and can create a Turnstile widget.
When not to use it
Section titled “When not to use it”Settings
Section titled “Settings”API & appearance
- Site Key, Secret Key, connection test
- Theme / layout options (theme, full width, language, visible appearance)
- Disable submit until verification completes
WordPress core - Login, Registration, Password reset, Comments
WooCommerce - Login, Registration, Lost password, Checkout, Product reviews
Forms & integrations (Premium) - Basic Forms, CF7, WPForms, Formidable, Fluent Forms, Elementor Pro Forms, and other listed plugins
Advanced options / Skip rules (Premium) - failsafe, perf compat, resource hints, Blocksy compat, trusted roles/IPs/user agents
How to enable it
Section titled “How to enable it”- Create a Turnstile widget in the Cloudflare dashboard and copy the site key and secret key.
- Go to WP PowerSuite -> Modules -> Security.
- Toggle Cloudflare Turnstile on.
- Paste keys, save, run the connection test, then enable the forms you want protected.
How to test it
Section titled “How to test it”- Save keys and run the built-in connection test until it succeeds.
- Enable Login, open
wp-login.phpin a private window. - ✅ Pass: Turnstile widget appears; login without completing it fails verification.
- ❌ Fail: confirm keys are saved, no conflicting CAPTCHA module on the same form, and skip rules are not matching your IP.
Troubleshooting
Section titled “Troubleshooting”- Widget missing. Keys empty, form toggle off, or skip rules matching the visitor.
- Always fails. Wrong secret key, domain not allowed in Cloudflare, or cache serving a stale login page.
- Premium section locked. Activate a license to configure form integrations, advanced options, and skip rules.
- Two CAPTCHAs on one form. Disable overlapping protection in Google reCAPTCHA or Simple CAPTCHA.
What does Cloudflare Turnstile do?
It adds Cloudflare Turnstile verification to selected WordPress, WooCommerce, and form plugin surfaces after you save API keys.
Is Cloudflare Turnstile free?
The module is free to enable. Form integrations, advanced options, and skip rules are Premium features.
Do I need Cloudflare keys?
Yes. Create a Turnstile widget in Cloudflare, then paste the site key and secret key in module settings.
Can it protect Contact Form 7?
Yes, when the Contact Form 7 integration is enabled (Premium section) and CF7 is active.
How do I turn Cloudflare Turnstile off?
Go to WP PowerSuite -> Modules, find Cloudflare Turnstile, and toggle it off.
Developer notes (hooks & filters)
Source: modules/cloudflare-turnstile/module.php.
Boot: critical · context: both.
Notable hooks: login_form, authenticate, registration_errors, preprocess_comment, wpps_verify_turnstile, wpps_verify_basic_forms_captcha, WooCommerce and form-plugin specific actions/filters.