Simple CAPTCHA with Cloudflare Turnstile

How can we help?

Search the documentation or ask the AI agent anything about the plugin.

Define your API keys in wp-config.php

Updated September 13, 2026

The site key and secret key can be defined as constants in wp-config.php instead of being saved in the database. This suits version-controlled or multi-environment setups, where staging and production need different keys without either one carrying the other’s values in its options table.

The constants

Add these above the line that reads /* That's all, stop editing! Happy publishing. */:

define( 'CF_TURNSTILE_SITE_KEY',   'your-site-key' );
define( 'CF_TURNSTILE_SECRET_KEY', 'your-secret-key' );

You can define one without the other, though in practice you will want both. The settings page shows a notice telling you which of the two is coming from wp-config.php.

How they interact with the saved settings

Two behaviours are worth knowing:

  • The constants win everywhere. Every place the plugin reads a key — rendering the widget, verifying a token, the API test — gets the constant value, not whatever is in the database.
  • Saving the settings page does not overwrite the stored values. Whatever was in the database before stays there untouched. Remove the constants later and the previous keys come back.

The same protection applies to importing settings: a JSON import will not overwrite a key that is defined as a constant.

Per-environment keys

Because the constants live in wp-config.php, which is normally outside version control or environment-specific, each environment can carry its own pair. A common pattern is production keys on live and Cloudflare’s dummy “always passes” test keys locally, so forms submit on a hostname Cloudflare cannot reach.

Things to watch

  • Editing wp-config.php is not required. Only do this if you are comfortable with it — a syntax error there takes the whole site down.
  • Always test your forms after adding the constants. The settings page will show the keys as coming from wp-config.php, but it cannot tell you whether they are the right ones.
  • The site key is public by design and appears in your page source. Only the secret key is genuinely sensitive.

Related

Was this article helpful?