Performance and script loading settings
Updated September 13, 2026
Three options in the Performance section of the Advanced Settings panel control how the Turnstile scripts load. All three are on by default and suit most sites, so change them only if you are chasing a specific problem.
Defer Scripts
Adds the defer strategy to the plugin’s JavaScript so it does not block page rendering. Leave this on unless your own optimisation setup handles script loading and the two are fighting each other.
The widget is rendered explicitly rather than automatically, with a small queue that waits for the Turnstile API to become available. That means deferring is safe even on slow connections — a widget added to the page before the API has loaded is still rendered once it arrives.
Performance Plugin Compatibility
Caching and optimisation plugins commonly delay, combine or lazy-load JavaScript, and doing that to the Turnstile scripts stops the widget appearing. With this option on, the plugin adds exclusions for the optimisation plugins it knows about, including WP Rocket, LiteSpeed Cache, Autoptimize, Perfmatters and SG Optimizer, so those tools leave its scripts alone.
The plugin also marks its script tags with data-cfasync="false", which tells Cloudflare Rocket Loader to skip them.
Turn this off only if it conflicts with something in your own setup. If you do, you will need to add the exclusions manually in your optimisation plugin — see Caching and optimisation plugins.
Resource Hint (Preconnect)
Adds preconnect and DNS prefetch hints for challenges.cloudflare.com, so the browser opens the connection early rather than waiting until the script is requested. This shaves time off the widget’s first appearance, and is most worthwhile on high-latency networks or when scripts are deferred.
The trade-off is that the hint may open a connection on pages that have no Turnstile widget at all. If you only protect one or two forms on an otherwise large site, turning this off avoids that small amount of unnecessary work.
What the plugin does not load
No Turnstile assets are enqueued on pages without a protected form, and nothing is loaded at all until both API keys are saved and the API test has passed. The plugin has no build step and no external dependencies beyond Cloudflare’s own script.