Gravity Forms, WPForms and other form plugins
Updated September 13, 2026
WPForms, Gravity Forms, Fluent Forms, Formidable Forms, Forminator, SureForms, Jetpack Forms and Kadence Forms all work the same way: one panel each on Settings › Cloudflare Turnstile, with a single switch that adds the widget to every form that plugin renders.
The common options
- Enable on all <plugin> forms — the main switch. On by form plugin, not per form.
- Widget Location — Before Button or After Button, on the plugins that support a choice. Fluent Forms, SureForms, Kadence and MailPoet place the widget above the submit button; Jetpack places it after.
- Disabled Form IDs — a comma-separated list such as
5,10. Every form is protected except the IDs you list here. This is how you exempt an internal form without switching the integration off.
Find a form’s ID in the form plugin’s own list table, usually in a column called ID or shown in the shortcode.
WPForms
WPForms has its own Turnstile option on its Settings › CAPTCHA tab. Enable it in one place only — either here or there, never both, or the form ends up with two widgets and submissions fail.
Gravity Forms
As well as the global switch, there is a shortcode for placing the widget yourself. It takes a required form ID:
[gravity-simple-turnstile id="3"]Multi-page forms are handled: the check only applies on the final page. Version 1.42.3 fixed a bypass where adding a page number to the request skipped the check on single-page forms, so make sure you are current.
The error message also now appears correctly on the Gravity Forms User Registration login form rendered with [gravityform action="login"].
Forminator
Forminator’s validation is cached against the single-use token rather than a form value, which closed a vulnerability in 1.42.0 where a solved challenge could be reused. If you are running an older version, update.
Elementor Pro Forms
Elementor has enough of its own quirks to warrant separate notes — see the Elementor panel’s Load Scripts option, which controls whether the Turnstile assets load on all pages, only on autodetected pages with forms, or only on specific page IDs. If a widget does not appear inside a popup or a global template, set it to All pages and disable Elementor’s element caching for that form.
Mailchimp for WordPress
MC4WP has no global switch. Add the shortcode to each form in the MC4WP form editor:
[mc4wp-simple-turnstile]