Export and import your settings
Updated September 13, 2026
The Import tab on Settings › Cloudflare Turnstile moves a configuration between sites as a JSON file. It is the quickest way to take a setup you are happy with on staging and apply it to production, or to reuse the same configuration across several sites.
Export
Click Download JSON to get a file containing every current setting. There is one checkbox to consider first.
Include API keys (sensitive) is off by default, and the export leaves the site key and secret key out. Leaving it off is usually right: the two sites almost certainly need different keys anyway, because the Cloudflare widget is tied to a hostname.
Tick it only if you are cloning a site that will serve the same domain, and treat the resulting file as a secret — it contains your secret key in plain text. Do not commit it to a repository or attach it to a support thread.
The analytics counters and the debug log are never exported, regardless of that checkbox.
Import
Choose a .json file and click Import JSON. A notice confirms how many options were updated, or explains why the import was rejected.
Import replaces the settings it finds in the file and leaves anything else alone. It is not a full reset — if the source site had an integration configured that the destination does not, that setting is simply skipped.
Two safeguards are worth knowing:
- Only recognised settings are applied. Anything in the file that is not a known plugin option is ignored, so a hand-edited or unrelated file cannot inject arbitrary options.
- Constants are never overwritten. If the destination site defines its keys in
wp-config.php, an import will not replace them, even if the file includes keys.
An import fails if the file is not valid JSON, is empty, is larger than 2 MB, or was clearly exported by a different plugin. The notice names which of those applied.
After importing
Check two things on the destination site:
- The API keys. If you did not include them, enter the destination site’s own keys and run TEST RESPONSE. Turnstile stays off the forms until that test passes.
- The enabled forms. Integration settings only take effect where the matching plugin is active, so confirm the panels you expect are actually showing and ticked.