WooCommerce forms and checkout
Updated September 13, 2026
The WooCommerce Forms panel on Settings › Cloudflare Turnstile covers checkout, pay for order, account details, and the login, registration and password reset forms. The checkout has the most options, and a few behaviours that are worth understanding before you deploy it on a live shop.
Checkout
Tick WooCommerce Checkout to protect the main checkout form. Two extra controls appear:
- Guest Checkout Only — show the challenge only to shoppers who are not logged in.
- Widget Location — Before Payment, After Payment, Before Pay Button, Before Billing or After Billing.
Before Payment is the safest default. If the position you choose does not exist on your checkout — a common situation on customised or page-builder checkouts — the widget falls back to a position above the Place Order button rather than disappearing.
Both the classic shortcode checkout and the block checkout are supported.
Express payment methods
Apple Pay, Google Pay, PayPal, Amazon Pay and similar express buttons open their own payment sheet without ever rendering the checkout form, so there is no widget and no token to verify. Turnstile skips these automatically rather than rejecting the order.
A Payment Methods to Skip list lets you exempt specific gateways yourself, with individual toggles for WooPayments Express (Apple Pay, Google Pay and Link by Stripe). Use it if a gateway on your site behaves the same way but is not detected.
Card gateways and 3D Secure
Some gateways pause the checkout to run a 3D Secure step, then resubmit the same form carrying the same token. Turnstile tokens are single-use, so a naive second check would fail a perfectly good order. The plugin recognises this and holds the original verification open for a limited window instead.
If you use a gateway with 3DS and see orders rejected with a Turnstile error on the second attempt, that gateway’s marker may need adding — see Filter reference for the relevant filter.
Page builders
Divi’s WooCommerce modules each render the whole checkout template, producing several renders per page that look like a real form but are not. The plugin detects the Divi modules and only places the widget on the real one. Other builders that do the same thing can be handled with a filter.
Account and login forms
The remaining options are straightforward toggles. Note that WooCommerce Login and the WordPress login check are deliberately kept from both running on the same submission, since the second would spend an already-used token.