Disable the submit button until the challenge is complete
Updated September 13, 2026
Disable Submit Button, under General Settings on Settings › Cloudflare Turnstile, greys out a form’s submit button and stops it responding to clicks until the Turnstile challenge has completed. It is a single site-wide switch that applies to every protected form.
What it changes
Each integration tells the plugin which element is the submit button for its form. While the challenge is unfinished, that button is dimmed and ignores clicks; once a token is issued it returns to normal. The visitor never gets as far as a rejected submission, so they do not lose what they typed.
This is presentational rather than a security measure. Server-side verification runs on every submission regardless, so turning the option off does not weaken the protection — it only changes what happens in the browser before the form is sent.
When to turn it on
It is most useful on long forms, where a visitor could otherwise fill in ten fields, submit, and be bounced back with an error. It also cuts down on duplicate submissions from impatient double-clicking.
When to leave it off
There are a few situations where it causes more confusion than it solves:
- Interaction Only mode on a slow connection. The challenge normally resolves before the visitor reaches the button, but if anything delays the script the button looks broken with no visible explanation.
- Forms with several submit-like buttons, such as a checkout with both a coupon apply button and a place order button. Only the button the integration targets is affected.
- Heavily customised themes that replace the standard submit markup, where the plugin may not find the right element.
If a button stays disabled after the challenge has clearly completed, that is a sign something is interfering with the plugin’s JavaScript — usually a caching or optimisation plugin deferring or combining it. See Caching and optimisation plugins.
A note on the login form
This option can gate the login button too, so a JavaScript failure on wp-login.php could in principle leave you unable to sign in. If that happens, rename the simple-cloudflare-turnstile folder inside wp-content/plugins over FTP or SFTP, or deactivate the plugin with WP-CLI. WordPress will deactivate it and let you log back in, and your settings are kept for when you reactivate.