How to Add Cloudflare Turnstile to WordPress Forms (Free)

Cloudflare Turnstile is a free alternative to CAPTCHA. It checks whether a visitor is human in the background, so most people never see a puzzle, and at most they tick a box. You don’t need to move your site to Cloudflare to use it: Turnstile works on any website, whoever hosts it.

This guide shows you how to add Turnstile to your WordPress login, registration, comment, WooCommerce and contact forms using our free plugin, Simple CAPTCHA with Cloudflare Turnstile. It’s used on over 200,000 sites and takes about ten minutes to set up.

What you need

• A free Cloudflare account. Sign up here if you don’t have one. Your domain doesn’t need to use Cloudflare’s DNS or proxy.
• Admin access to your WordPress site, so you can install a plugin.

Both are free. Cloudflare’s free Turnstile plan allows up to 20 widgets, 10 hostnames per widget and unlimited challenges, which is more than enough for most sites. The plugin has no paid version.

Step 1: Create a Turnstile widget in Cloudflare

Log in to the Cloudflare dashboard, open Turnstile from the menu, and click Add widget. You’ll be asked for:

• Widget name: anything that helps you recognise it later, such as your site name.
• Hostnames: the domain your forms are on. Add every version the widget will load on, including www and any staging domain. A missing hostname is the most common reason the widget shows up but form submissions fail.
• Widget mode: choose Managed, which Cloudflare recommends. It decides for each visitor whether to run the check automatically or show a checkbox. Non-interactive always shows the widget with a loading spinner but never asks the visitor to click, and Invisible runs the check with nothing shown at all.

You can leave pre-clearance switched off. Click Create, and Cloudflare will show you a Site Key and a Secret Key. The site key is public and appears in your page source. The secret key is private, so don’t share it. Keep this page open for the next step.

Step 2: Install the plugin

In your WordPress admin, go to Plugins › Add New Plugin, search for “Simple CAPTCHA with Cloudflare Turnstile”, then click Install Now and Activate. You can also download it from WordPress.org.

Once it’s active, go to Settings › Cloudflare Turnstile.

Step 3: Add your keys

Paste the two keys from Cloudflare into the Site Key and Secret Key fields under API Key Settings, then click Save Changes.

If you’d rather not store the keys in the database, you can define them in wp-config.php instead.

Step 4: Choose which forms to protect

Turnstile is off on every form until you turn it on. Scroll down to Enable Turnstile on your forms. There’s a Default WordPress Forms panel for the login, registration, password reset and comment forms, plus a panel for each supported plugin that’s active on your site, such as WooCommerce or Contact Form 7. Open each panel, tick the forms you want to protect, and save again.

Some panels have extra options that are worth knowing about:

• Guest Checkout Only: on checkout and registration forms, only show the check to visitors who aren’t logged in.
• Widget Location: where the widget appears, for example before or after the submit button. The WooCommerce checkout has extra positions, such as before the payment methods.
• Disabled Form IDs: a comma-separated list of form IDs to skip, if you want to leave one form unprotected without turning off the whole integration.

Step 5: Test the API response

At the top of the settings page, complete the Turnstile check and click TEST RESPONSE. This sends a real check to Cloudflare using your secret key, which is the only way to confirm both keys work together.

Turnstile won’t appear on any of your forms until this test passes. That’s deliberate: a wrong secret key would otherwise block every genuine submission on your site. If the test fails, the error message tells you why. The most common cause is a wrong secret key or a hostname missing from your Cloudflare widget. The test the API response guide explains each error.

Step 6: Check one of your forms

Open one of the forms you protected in a private browser window, so you see it as a visitor would. If you’ve set the plugin to skip logged-in users, the widget will be hidden while you’re logged in as an admin, so the private window matters.

Optional settings worth a look

The defaults work for most sites, but there are a few settings you may want to change.

• Appearance: choose a light, dark or automatic theme, a normal, flexible or compact size, and the language. Setting Appearance Mode to “Interaction Only” hides the widget unless Cloudflare needs the visitor to click. See change the widget’s appearance.
• Disable Submit Button: greys out the submit button until the check is complete.
• Whitelist: skip the check for logged-in users, specific IP addresses or ranges, or user agents such as an uptime monitor.
• Failsafe mode: decides what happens if your server can’t reach Cloudflare. You can let submissions through, or fall back to Google reCAPTCHA v2. It’s off by default. See keep forms working when Cloudflare is unreachable.
• Analytics: once you turn it on, it counts how many checks passed and failed on each form, so you can see which forms bots are targeting.

Which forms are supported?

• WordPress: login, registration, password reset and comments.
• WooCommerce: checkout, pay for order, account details, login, registration and password reset. CheckoutWC and Flux Checkout are supported too.
• Form plugins: WPForms, Fluent Forms, Contact Form 7, Gravity Forms, Formidable Forms, Forminator, Jetpack Forms, Kadence Forms, SureForms and Elementor Pro Forms.
• Membership and community: MemberPress, Paid Memberships Pro, Ultimate Member, WP-Members, WP User Manager, WP User Frontend, Simple Membership, BuddyPress, bbPress and wpDiscuz.
• Other: Easy Digital Downloads, Mailchimp for WordPress, MailPoet and Sunshine Photo Cart.

For a form that isn’t on the list, a developer can add Turnstile to a custom form using the plugin’s two helper functions, one to show the widget and one to check the result.

If the widget doesn’t appear

Check these three things first:

1. The API test hasn’t passed. Turnstile stays off until it does, and WordPress shows an admin notice saying so.
2. You’re whitelisted. If logged-in users are whitelisted, you won’t see the widget as an admin. Check the form in a private window.
3. An optimisation plugin is delaying scripts. Delaying or combining JavaScript can stop the Turnstile script from loading. The plugin adds exclusions for WP Rocket, LiteSpeed Cache, Autoptimize, Perfmatters and SiteGround Optimizer automatically. For other plugins, see caching and optimisation plugins.

If the widget appears but submissions fail with “Please verify that you are human”, see submissions fail verification. The widget not appearing guide covers the less common causes.

Turnstile or reCAPTCHA?

Most of the time, Turnstile doesn’t ask visitors to do anything, and when it does, it’s a single checkbox rather than picking out traffic lights. That matters most on checkout and login forms, where a failed or annoying challenge can cost you an order.

The other difference is privacy. Cloudflare says Turnstile doesn’t use cookies to collect information and that it doesn’t harvest data for ad retargeting. Verification still sends the visitor’s IP address to Cloudflare, so you should mention Cloudflare in your privacy policy. The privacy and GDPR guide has the details.

If you run a WooCommerce store, our guide to stopping spam orders, fake accounts and card testing compares Turnstile and reCAPTCHA in more detail, along with the other steps that help.

Getting started

Install Simple CAPTCHA with Cloudflare Turnstile from WordPress.org, create your widget in Cloudflare, and your forms can be protected in about ten minutes. The plugin page has the full feature list, and every setting is covered in the documentation. If you get stuck, you can ask in the WordPress.org support forum.