Choose which forms are protected
Updated September 13, 2026
Turnstile is off on every form until you turn it on. The Enable Turnstile on your forms section of Settings › Cloudflare Turnstile holds one collapsible panel per integration, and each panel lists the individual forms that integration supports.
Which panels you see
Default WordPress Forms is always present and covers the login, registration, password reset and comment forms. Every other panel only appears when the matching plugin is active on the site — install WooCommerce and a WooCommerce Forms panel appears, deactivate it and the panel goes again. Plugins that are supported but not installed are listed at the bottom of the section as links, so you can see what else is covered.
Options you will meet repeatedly
The panels vary, but a few controls turn up in several of them:
- Guest Checkout Only — on checkout and registration forms, show the challenge only to visitors who are not logged in. Useful when you trust existing customers but want new orders screened.
- Widget Location — where the widget sits relative to the submit button. Most form plugins offer Before Button or After Button; the WooCommerce checkout offers Before Payment, After Payment, Before Pay Button, Before Billing and After Billing.
- Disabled Form IDs — a comma-separated list, for example
5,10. The integration protects every form it can find, and anything listed here is skipped. This is how you exempt an internal or low-risk form without turning the whole integration off. - Alignment — left, centre or right, on the integrations where the widget would otherwise inherit an awkward alignment from the theme.
Login and registration on the default forms
The small arrow next to WordPress Login and WordPress Register reveals an extra option: Only enable on default wp-login.php page. Leave it off and the challenge also applies to login and registration forms rendered elsewhere by your theme or another plugin. Turn it on if a front-end login form is being double-checked or you only want to protect the core screens.
WordPress Comment has a similar toggle for AJAX comments form, which you need if your theme or a plugin submits comments without reloading the page.
Save, then check the form
Click Save Changes and load one of the forms you enabled in a private window. Viewing as a logged-in administrator can be misleading if you have the logged-in whitelist turned on, because the widget is deliberately hidden for whitelisted visitors.