Keep forms working when Cloudflare is unreachable
Updated September 13, 2026
Failsafe mode decides what happens to your forms if your server cannot reach Cloudflare. Without it, every submission is rejected while the outage lasts. The options are in the Failsafe Settings panel on Settings › Cloudflare Turnstile, and the feature is off by default.
How an outage is detected
The plugin checks whether Cloudflare’s challenge endpoint responds, and caches the answer for a couple of minutes so a busy site is not making that check on every page load. Failsafe engages when the request fails outright or comes back with a server error. A verification that Cloudflare answers normally — including one it rejects — is not an outage, so a genuine spam submission is still blocked.
In practice this covers your server losing outbound access to challenges.cloudflare.com as much as it covers a Cloudflare incident, and a firewall rule is the more common cause of the two.
Enable Failsafe Mode
Tick this to switch the feature on, then choose a Failsafe Type.
Allow submissions (skip verification)
No widget is rendered and submissions go through unchecked for the duration of the outage. Your forms keep working; you may collect spam while it lasts.
This is the right choice for checkout and other revenue-carrying forms, where turning away real customers costs more than a handful of junk orders. It is a poor choice for a public comment form, which is exactly what a spam run is waiting for.
Fallback to reCAPTCHA
Renders a Google reCAPTCHA v2 widget instead and verifies against Google, so submissions stay screened. Enter a reCAPTCHA Site Key (v2) and reCAPTCHA Secret Key (v2) from the reCAPTCHA admin console — v2 specifically, not v3 or Enterprise.
Worth knowing before you choose it: reCAPTCHA has the data-collection profile Turnstile was picked to avoid. If you moved to Turnstile for privacy or GDPR reasons, adding a Google fallback partly undoes that, and it belongs in your privacy policy even though it only activates during an outage.
If you pick this type but leave the keys empty, no fallback widget renders and submissions are rejected — the same as having failsafe off.
The trade-off
Both modes loosen your protection at exactly the moment you cannot verify anything, which is unavoidable: the choice is between rejecting genuine visitors and admitting some spam. Decide per site based on what the affected forms do. If you run both a shop and a busy blog, the checkout argues for failsafe and the comment form argues against it.
The settings page shows a warning banner when it detects the API is unreachable, so you will see an outage in the admin as well as in your forms.