- FixFixed an issue since 1.42.3 where the “Before Payment”, “After Payment” and “Before Pay Button” widget positions could place the Turnstile widget outside the WooCommerce block checkout, away from the form, on a checkout page whose saved content is missing the payment or place order blocks. The widget is now always placed inside the checkout, above the payment section.
- FixFixed an issue since 1.38.0 where the Turnstile widget was added twice to a form inside an Elementor popup, which could leave the form unable to be submitted. Elementor rebuilds a popup from a copy of its markup each time it opens, so the widget is now added when the popup opens rather than before it.
- NewAdded support for Elementor’s new Atomic forms, using the same “Enable Elementor Forms” setting as classic Elementor Pro forms.
- NewAdded support for Wordfence 9.0.0’s Login Security passkeys, which were rejected with a missing challenge error when the WordPress login check was enabled.
- TweakAdded the cfturnstile_is_partial_checkout_render filter, so other page builders can flag any extra renders of the checkout template.
- FixFixed an issue since 1.42.3 where WooCommerce orders paid with a card gateway such as Stripe or WooPayments could be rejected with a Turnstile error.
- FixFixed an issue since 1.42.3 where every order on a WooCommerce checkout built with the Divi Builder’s Checkout modules was rejected with a Turnstile error.
- FixFixed a WooCommerce checkout token remaining usable for up to two minutes when the request that used it ended unexpectedly, such as after a fatal error.
- FixFixed the Turnstile widget not being reset after a failed submission on forms that submit without a page reload, such as AJAX login forms and single page (SPA) themes.
- FixFixed the Turnstile widget not appearing on the WooCommerce checkout when the section chosen in the “Widget Position” setting was not part of the checkout. It now falls back to a position above the “Place Order” button.
- FixFixed the “After Payment” widget position removing the entire payment section, including the payment methods, from the WooCommerce block checkout.
- FixFixed the Turnstile widget not appearing on the WooCommerce app authorization screen (/wc-auth/). You are now sent to the WordPress login form to complete the challenge, then returned to the authorization screen.
- FixFixed the “cloudflare turnstile” button in the Contact Form 7 form editor inserting nothing when clicked.
- FixFixed the Turnstile error message not being shown on the Gravity Forms User Registration login form ([gravityform action=”login”]).
- SecurityFixed vulnerabilities where the Turnstile check on the WooCommerce checkout and lost password form, and WordPress login and lost password forms could be potentially be bypassed.
- SecurityFixed a vulnerability in the Contact Form 7 integration, where an unauthenticated visitor could run any shortcode registered on the site by submitting it as a field value. Reported by Jakub Herman via WPScan.
- SecurityFixed a vulnerability where the Turnstile check on Gravity Forms could be bypassed by adding a page number to the request. The check is now only skipped on forms that really do have more than one page.
- TweakThe Turnstile form-tag for Contact Form 7 is now [cf7_simple_turnstile]. Your existing [cf7-simple-turnstile] tags keep working and do not need to be changed.
- FixFixed an issue since 1.42.0 where the submit button could stay disabled after the Turnstile challenge was completed, when the “Disable Submit Button” option is enabled. On the login form this could lock you out of your site.
- FixFixed the submit button staying disabled after the widget was re-rendered, such as after an AJAX comment or on the Blocksy account modal.
- FixFixed the submit button staying disabled on Jetpack forms when the “Disable Submit Button” option is enabled.
- FixFixed WooCommerce checkout failing with a “please verify that you are human” error when using the GlobalPayments GPAPI gateway with 3D Secure enabled.
- FixFixed the Turnstile API script loading render-blocking, even with the “Defer Scripts” option enabled.
- TweakChanging the API keys programmatically, such as with WP-CLI or a provisioning script, no longer switches Turnstile off on every form until the manual test is run.
- TweakTightened the Forminator integration further, so a solved Turnstile challenge can no longer be re-used for up to 30 seconds.
- NewAdded support for CIDR ranges (IPv4 and IPv6) in the IP whitelist, e.g. 203.0.113.0/24 or 2001:db8::/32, so visitors can be whitelisted by subnet.
- FixFixed IP whitelist matching for IPv6 addresses written in a different format, and for IPv4-mapped IPv6 addresses such as ::ffff:203.0.113.5. A /0 range is now ignored.
- FixFixed an issue since 1.41 where the login widget could be reset while a two-factor prompt was open (e.g. Wordfence 2FA), causing the login to fail.
- FixTurnstile now always loads in explicit render mode, fixing the widget not appearing on slow connections, with a “delay JavaScript” optimization, or in AJAX-loaded forms such as comment forms and popups.
- FixFixed several WooCommerce issues, including the checkout script erroring when a “delay JavaScript” optimization runs it before jQuery, widgets not rendering on the block checkout, and the “Click here to login” toggle.
- FixFixed the Turnstile widget not appearing in the Blocksy theme’s header account modal, and the integration now also loads when a Blocksy child theme is active.
- FixFixed a conflict with FluentAuth’s email two-factor and magic login, where the second step could fail with a Turnstile error.
- FixFixed a conflict with Simple Membership where a member logging in was not also logged into their WordPress user account, breaking is_user_logged_in() checks, .htaccess protection and user synchronization.
- SecurityFixed a vulnerability in the Forminator integration where a solved Turnstile challenge could potentially be reused to bypass verification, as the validation was cached against a form value instead of the single-use token. (Reported by Meher Sudhakar Abbireddi via WPScan.)
- TweakAdded a view button to show the secret key in the settings page, which is hidden by default.
- TweakMade a few small changes to the settings page.
- TweakOn the Ultimate Member login form, added a check to prevent further login validation if Turnstile failed.
- FixFixed an issue with the Ultimate Member login form since the last update.
- NewAdded a new “Analytics” option which when enabled will start tracking some basic analytics data for Turnstile form submissions. This includes the number of successful and failed submissions, and the reasons for any failures.
- ImprovedAdded some new tabs to the settings page, with a “Settings” tab for all the main settings, a new “Analytics” tab for the new analytics feature and the debug logging, and an “Import” tab for the import/export feature.
- TweakUpdated the verified transient check to work better with certain 2FA plugins.
- TweakUpdated the Contact Form 7 integration to now show the correct error message when the Turnstile check fails.
- TweakThe “Widget Label Text” is now hidden when “Interaction Only” is selected, and only displayed when the widget actually requires an interaction.
- TweakAdded spacing below the widget when it shows in “Interaction Only” mode, which is hidden when the widget is not displayed.
- TweakThe Turnstile widget now re-renders shortly after clicking the login button on the wp-login.php page, to ensure a fresh token is ready in case of a failed login.
- FixFixed an issue with Turnstile not rendering on the block checkout “pay for order” page in some cases.
- FixFixed the “Show Widget Label Text” option not displaying on Elementor forms.
- FixFixed the “Logged In Users” whitelist option not bypassing Turnstile on Contact Form 7 submissions.
- FixFixed the “Appearance Mode” setting not being applied to Elementor forms and the WooCommerce block checkout, causing the widget to always display even when “Interaction Only” was selected.
- Other: Renamed the plugin from “Simple CAPTCHA Alternative with Cloudflare Turnstile” to “Simple CAPTCHA with Cloudflare Turnstile”.
- NewAdded an option to enable Turnstile on the WooCommerce Account Details form.
- TweakAdded a warning message to the “Logged In Users” whitelist option.
- TweakAdded an additional check to prevent the Turnstile widget from rendering twice on WooCommerce checkout in rare cases.
- TweakPrevent any kind of form submission (shortkeys etc) for the default login form when Turnstile is not completed, if the “Disable Submit Button” option is enabled.
- TweakPrevent any kind of form submission (shortkeys etc) for Elementor forms when Turnstile is not completed #84.
- TweakForce-render inline script now loads via wp_add_inline_script in the footer, fixing rendering issues in some cases when “Defer Scripts” is disabled.
- FixFixed widget size setting (Flexible/Compact) not being applied to Elementor forms.
- FixFixed a mobile performance issue in some cases. Replaced the fixed 200ms setTimeout fallback which could cause scroll-locking and double-rendering.
- FixPerformance plugin compatibility hooks now register correctly regardless of which performance plugin is active.
- FixImproved WooCommerce checkout login form Turnstile rendering, which was not working for some themes.
- FixFixed a JS error on WooCommerce classic checkout when the Blocks checkout store isn’t registered.
- FixFixed duplicate Turnstile widget on Paid Memberships Pro login page.
- FixFixed a JS error with wpDiscuz integration when Perfmatters plugin was active.
- FixFixed a potential issue with the Turnstile check on login forms failing in certain cases when it runs multiple checks in the same request.
- NewAdded integration for the “SureForms” plugin.
- NewAdded integration for the “Sunshine Photo Cart” plugin (#70).
- TweakAdjusted the “Widget Label Text” alignment in some cases so it always shows above the widget.
- FixFixed Turnstile verification failures on WooCommerce checkout caused by payment gateway plugins (e.g. PayPal Commerce, Amazon Pay, Mollie) consuming the single-use token during pre-checkout AJAX validation requests.
- FixFixed a fatal error occurring on pages where WooCommerce has been selectively disabled (e.g. via Plugin Organizer).
- TweakMade some tweaks to the WooCommerce checkout duplicate submission check, with a longer expiration for the transient, and improved the auto re-render for Turnstile on payment error in certain cases.
- TweakSmall tweak to the Contact Form 7 integration code with a basic static duplication check.
- TweakAdded the transient based duplicate submission check to WooCommerce checkout, to prevent potential duplicate submission check failing issues since the last update.
- TweakAdded improved support for Gravity Forms multi-page forms, to prevent the duplicate submission check from failing on page 2 and beyond.
- TweakReplaced all PHP session usage with WordPress transients for the duplicate submission checks, to prevent full-page caching from being broken by the PHPSESSID cookie and Cache-Control headers.
- TweakAn invalid-input-secret error from Cloudflare no longer disables Turnstile on all forms. Instead, the admin is notified and a soft re-test prompt is displayed on the settings page.
- SecurityFixed a broken authentication vulnerability on WooCommerce checkout potentially allowing one successful Turnstile submission to be reused for multiple checks. (Reported by David Marín via Patchstack.)
- NewAdded a “Refresh Timeout” option to the advanced settings.
- PerformanceThe Cloudflare health check (used by failover mode) is now cached for 2 minutes, preventing repeated HTTP requests on every form render.
- TweakAdded missing WooCommerce ‘cart_checkout_blocks’ and ‘product_block_editor’ feature compatibility declarations.
- FixFixed a text domain typo in the WooCommerce Store API integration.
- FixImproved the WP Discuz integration to properly validate and block submissions when the Turnstile check fails, and now honors the whitelist.
- FixFixed an issue with Turnstile not loading on Elementor popup forms in some cases.
- FixThe disable submit option should now work correctly on Elementor forms.
- FixThe disable submit option should now work correctly on Contact Form 7 forms.
- FixFix for WooCommerce block checkout sometimes rendering the Turnstile widget twice.
- FixFixed a “Invalid type for container” JavaScript error with the wpDiscuz integration.
- FixFixed the right alignment styling for bbpress.
- FixFixed an issue where Turnstile widgets would repeatedly render when a browser tab is left open for extended periods.
- FixFixed an issue where CF7 forms would show “One or more fields have an error” when SCT is active but the form doesn’t use the SCT turnstile shortcode.
- FixFixed an issue with scripts not being enqueued properly in some cases.
- DeveloperFixed the missing prefix for the add_data_attribute function.
- DeveloperChanged all include() calls to include_once() to prevent fatal errors if the plugin file is loaded more than once.
- DeveloperFixed cfturnstile_check() returning false instead of array( ‘success’ => false ) when API keys are not set.
- SecurityMade a few small precautionary security enhancements (missing ABSPATH check, and sanitized REQUEST_URI).
- ImprovedImproved the Elementor integration to work better in more cases, and with Elementor popups.
- ImprovedAdded an alignment option for the Elementor integration.
- TweakRemoved the “Integration Method” option for Elementor forms. It will now load globally but has an option to choose where scripts are loaded.
- TweakSmall tweaks to the settings page.
- TweakAdded a copy button for the debug log.
- FixFixed a new issue some websites were experiencing with WooCommerce block checkout not working with Turnstile.
- FixFixed an error “attempt to read property success on null” showing in some cases.
- FixFixed the widget label not showing in some cases, on the comments form.
- FixFixed WooCommerce checkout in some cases not re-rendering Turnstile after payment errors. It should now re-render correctly in all cases to prevent Turnstile errors.
- FixFixed an issue with Forminator forms when using file upload fields.
- FixFixed an issue with the disable submit feature not working in some cases.
- NewAdded new “Failsafe Mode” option in the advanced settings.
- NewAdded the ability to enable and set a custom “widget label text” that is shown above the Turnstile widget.
- NewAdded an option to enable “Resource Hint (Preconnect)” in the advanced settings.
- TweakImproved the code for getting the user IP address for the Turnstile verification request. Helps with certain server setups and proxy services.
- TweakChanged Turnstile default render to “auto” instead of “explicit”.
- TweakRemoved the user ID check on WordPress login Turnstile check, so it still runs if the username is invalid.
- TweakAdded “header” info to the debug log entries.
- FixFixed an issue with Kadence Forms integration in some cases.
- NewImprovement to Elementor integration to work better with Elementor element caching.
- NewAdded new “Integration Method” for the Elementor integration. The “Load Scripts Globally” option may work better for certain types of caching.
- TweakUpdated the Elementor JS code from using jQuery to vanilla JS.
- TweakAdded an option in the “Advanced Settings” to toggle “Performance Plugin Compatibility”.
- TweakUltimate Member forms now have a unique fixed ID instead of a random one each time.
- TweakFor WooCommerce checkout, added an alternative check for duplicate execution within a single request.
- TweakMade some changes to the settings page, updated the setup guide link, and updated donation/sponsor details.
- FixFixed an issue with Turnstile being ignored by certain payment methods like PayPal express, in some cases.
- FixFixed an issue when the “WordPress Login” option is enabled, but “WooCommerce Login” is disabled, the WooCommerce login still gave a verification failed error.
- FixFixed an issue with some express payment methods. These will now automatically skip the Turnstile check preventing the error message from showing.
- FixFixed an issue with WooCommerce checkout in some cases.
- FixFixed an issue with custom login forms causing an error since version 1.34.0.
- FixFixed an issue with the “Extra Failure Message” when using quotes in the text.
- NewAdded ability to define the Site Key and Secret Key in the wp-config.php file, using the constants “CF_TURNSTILE_SITE_KEY” and “CF_TURNSTILE_SECRET_KEY”. This is useful for developers, or if you want to prevent the keys from being changed in the admin settings page.
- NewAdded an export/import tool to the settings page, to allow you to easily export your settings and import them on another website.
- TweakUpdated the WooCommerce checkout “cfturnstile_checkout_checked” session to clear in more cases to prevent potential issues.
- FixAdded better support for smart payment buttons on WooCommerce checkout, to prevent Turnstile from blocking the checkout in some cases.
- FixFixed an issue with the “Pay for Order” page when using block checkout.
- FixFixed an issue with the wp_login_form() function integration.
- Other: Renamed the plugin from “Simple Cloudflare Turnstile” to “Simple CAPTCHA Alternative with Cloudflare Turnstile” due to trademark guidelines.
- TweakAdded some better compatibility with certain performance plugins that may be minifying/delaying JavaScript and causing issues with Turnstile loading.
- FixPotential fix for some websites experiencing issues with Elementor forms.
- FixFixed an issue with the CheckoutWC integration.
- FixFixed an issue with the Turnstile widget on Elementor forms always being forced to dark mode.
- FixFixed an issue with Turnstile rendering twice on CheckoutWC checkout page in some cases.
- ImprovedImproved the CheckoutWC integration (#53).
- TweakAdded missing MailPoet JS callback for the disable submit button.
- FixFixed a error in the woocommerce.js file.
- NewAdded support for the “WP User Manager” plugin.
- ImprovedFixed the Elementor integration (contact forms, login form, and popups) and made some improvements to the code.
- TweakAdded a check to see if the Turnstile script has already been enqueued.
- FixFixed an issue with some ajax form plugins, where the Turnstile widget was re-rending duplicates each time there was a failed submission.
- FixFixed a potential PHP error with the WP login.
- NewAdded support for the wp_login_form() function, so Turnstile can be added to the login form generated by this function.
- TweakMade a few design tweaks to the admin settings page.
- FixChange from gform_pre_submission to gform_validation hook for Gravity Forms integration. (#40).
- FixFixed “wp is not defined” error on WooCommerce checkout in some cases.
- NewAdded Kadence Forms integration.
- NewAdded MailPoet integration.
- FixFixed “Cannot read properties of null (reading ‘dataset’)” error with WooCommerce block checkout.
- FixFixed an issue with Turnstile loading twice in some cases.
- FixFixed an issue with the “Disable Submit Button” option not working.
- FixGravity Forms integration rerender on validation. (#38).
- Tested with WordPress 6.7.2
- Tested with WooCommerce 9.6.1
- NewAdded Jetpack Forms integration. (#30).
- FixFixed a undefined array key “error_code” error showing in some cases.
- FixFix CheckoutWC implementation. (#33).
- FixFix warning when cf-turnstile-response not present in Fluent Forms. (#32).
- NewAdded Checkout block and Store API support. (Thanks @senadir)
- FixFixed an issue with Turnstile re-rendering when it does not need to in some cases, on WooCommerce checkout.
- Other: Tested with WooCommerce 9.4.3
- NewAdded a “Widget Size” option to the advanced settings section.
- TweakMoved the “Appearance Mode” option to the advanced settings section.
- TweakAdded support for Elementor PRO Elements.
- TweakAdded the new supported languages.
- FixFixed a “WPCF7_TagGenerator::add()” error with the Contact Form 7 integration.
- FixPrevent Turnstile from showing on the order received page in some cases, such as with the CheckoutWC plugin.
- Other: Tested with WordPress 6.7.0
- Other: Tested with WooCommerce 9.3.3
- NewAdded a new option in the admin settings page to “enable debug logging of Turnstile form submission events”. This will add a log event every time a form is submitted with Turnstile enabled, and display the log at the bottom of the settings page.
- FixFixed issue with Turnstile not rendering on Elementor popup forms.
- FixFixed issue with Turnstile not resetting properly on Contact Form 7 causing it to display twice on submission error.
- FixFixed issue with Turnstile showing twice in some cases.
- FixFixed issue with Turnstile showing twice on Forminator forms in some cases.
- FixFixed issue with Turnstile showing twice on Elementor forms.
- FixTweak to help prevent some new rare cases where the Turnstile widget was being shown twice in some cases.
- FixFixed an issue with the WooCommerce password reset form when using a hide admin login URL plugin like “WPS Hide Login”.
- Other: Tested with WordPress 6.6.1
- TweakAdded a message to state that it is not currently compatible with WooCommerce “block-based” checkout.
- FixFixed an issue with not being able to save the WP Forms integration settings if using the Pro version of WP Forms.
- Other: Tested with WordPress 6.6.0
- Other: Tested with WooCommerce 9.1.2
- FixFixed an issue with the new “ONLY enable for these Membership IDs” option with the MemberPress integration.
- NewAdded option to whitelist certain “User Agents” in the “Whitelist Settings” section to the settings page.
- TweakMade a few small changes to the admin settings page.
- DeveloperAdded a filter (“cfturnstile_widget_disable”) to allow skipping Turnstile check and hiding the Turnstile widget programmatically.
- Code Fork: auutstudio/simple-cloudflare-turnstile-sometimes
- NewAdded compatibility with the “Clean Login” plugin.
- NewAdded an option to only show Turnstile on the default WordPress login and registration form, and not on any other similar forms added by plugins. This is enabled by default for new installs.
- NewAdded a new “Extra Failure Message” option, in advanced settings, which will show a custom notice to the user, under the widget, if the Turnstile challenge fails.
- NewAdded a new “Defer Scripts” option, in advanced settings, to decide whether the javascript files will be deferred or not. This is enabled by default.
- TweakModified the code for WooCommerce login check.
- TweakAdded some information about other form plugins that are not currently supported by our plugin, if they are installed.
- TweakRemoved 100ms delay on Turnstile widget render.
- TweakAdded an “Advanced Settings” tab to the settings page, and moved some settings into there.
- TweakA few small changes to the admin settings page.
- TweakThe “Language” setting is now ordered alphabetically.
- TweakImprovements to the Blocksy integration.
- FixFixed a compatibility issue with the EDD Auto Register plugin.
- DeveloperMoved around some of the plugin code into different files.
- DeveloperAdded some filters for the WP Login and WP Register check functions.
- Other: Tested with WordPress 6.4.0
- NewAdded integration with the “Paid Memberships Pro” plugin.
- TweakAdded some additional sanitization and escaping to the plugin code, as an extra security precaution, and to meet WordPress coding standards better.
- TweakAdded a class to the line break displayed below the Turnstile widget, so it can be hidden or edited with CSS if needed.
- FixFixed issue with Turnstile not loading on WooCommerce checkout login form in some cases.
- FixFixed a security vulnerability with the Gravity Forms integration.
- TweakMinified the inline scripts on Contact Form 7 and Gravity Forms integrations.
- TweakSmall tweak to styles on wp-login.php page in some cases.
- Other: Tested with WordPress 6.3.1
- Other: Tested with WooCommerce 8.1.1
- FixFixed an issue with “Payment Methods to Skip” toggle on settings page.
- NewAdded “Whitelist Settings” section to the settings page, with options to whitelist logged in users, or certain IP addresses.
- NewAdded support/integration for the CheckoutWC plugin.
- TweakTurnstile will now be disabled on all forms until the “Test Response” is successfully completed on the settings page. An admin error message will now show if the keys are set but the test is not complete.
- TweakIf Turnstile returns error code “invalid-input-secret” at any point, it will automatically disable itself and requires a “Test Response” to be completed again in the settings page.
- TweakModified the “Payment Methods to Skip” option (for WooCommerce) information to be easier to understand, and now displayed as checkboxes instead of a multi-select field.
- TweakAdded a session to WooCommerce checkout, to ensure the Turnstile check is only run once during checkout.
- TweakThe scripts loaded by the plugin are now automatically defered, to help improve performance.
- FixFixed undefined array key “mode” error with Ultimate Member integration.
- FixFixed issue with Turnstile not working on Contact Form 7 in some cases.
- Other: Tested with WordPress 6.3.0
- Other: Tested with WooCommerce 8.0.2
- TweakChanged the hook used for validation on Turnstile on the comments form, to an earlier hook, to prevent potential conflicts with other plugins.
- FixFixed an issue with the “Disable Submit Button” option on Forminator forms, when “Load for using AJAX” was enabled.
- FixFixed an error with WooCommerce reset password form since last update.
- TweakUpdated Turnstile to always load explicitly (instead of implicitly) in all instances. This helps prevent certain potential conflict issues, for example with performance plugins.
- FixFixed an issue with Forminator forms, where the Turnstile challenge stopped working if there was an error on the form after submitting once.
- FixFixed a PHP error with WP Forms, since a newer version of the WP Forms plugin.
- FixFixed the “cfturnstile_uninstall_remove” option no longer saving since last update, and a PHP error when it’s enabled and deleting the plugin.
- ImprovedSmall optimisation so that plugin options are no longer saved in the database for disabled integrations. Existing installs will need to re-save the plugin settings for this to apply.
- TweakAdded compatibility fix for Cloudflare “Rocket Loader” feature, which was causing the Turnstile challenge to appear in some cases. May remove this in the future, if Cloudflare fix the issue on their end.
- TweakRemove “cfturnstile_tested” option on plugin uninstall.
- TweakRemoved the “-2px” left margin on Turnstile widget, since it is no longer needed.
- FixFixed an issue with WooCommerce login form.
- TweakThe jQuery for AJAX comments forms support will now only load if needed, or the new option “AJAX comments form?” is enabled.
- FixFixed issue with BBPress new topic button staying disabled with the “Disable Submit Button” option enabled.
- NewAdded integration with the “WP User Frontend” plugin.
- TweakAdmin scripts and styles will now only load on the plugin settings page.
- FixFixed issue with Gravity Forms multi-page forms not being able to submit with Turnstile enabled.
- FixFixed issue …