How can we help?

Change the widget’s appearance Theme, language, widget size, appearance mode, refresh timeout and the optional label text above the widget. Filter reference Every filter the plugin exposes, what it receives, and the cases each one is meant for. Supported forms and plugins Every form and plugin the Turnstile integration covers, plus the ones that are not supported and why. The Turnstile widget is not appearing A checklist for when no widget shows on a form, from the API test through whitelisting, caching and page builders. What is Cloudflare Turnstile? What Cloudflare Turnstile is, how it differs from a traditional CAPTCHA, and what the plugin adds to WordPress. Whitelist visitors from the Turnstile challenge Skip Turnstile for logged-in users, specific IP addresses or CIDR ranges, and named user agents — and the risks of each. Action reference Actions fired around rendering and verification, their parameters, and the two you are meant to fire yourself. Disable the submit button until the challenge is complete What the Disable Submit Button option does, when it helps, and the cases where it is better left off. Keep forms working when Cloudflare is unreachable Keep forms working when Cloudflare is unreachable, by allowing submissions through or falling back to reCAPTCHA v2. Set up Turnstile on your site Generate your Cloudflare keys, enter them at Settings › Cloudflare Turnstile, pick your forms and test the API response. Submissions fail with “Please verify that you are human” When the widget renders but the form still rejects the submission, and what each underlying error code points to. WooCommerce forms and checkout Checkout widget positions, guest-only mode, express payment methods, 3D Secure gateways and page-builder checkouts. Analytics and debug logging Track verification counts per form and per error code, and record individual events while troubleshooting. Contact Form 7 Protect every Contact Form 7 form at once, or place the [cf7_simple_turnstile] form-tag in individual forms. Customise the error messages The difference between the Custom Error Message and the Extra Failure Message, and which parts of the widget cannot be changed. Shortcodes and helper functions The four shortcodes, the render and verify helpers, and the supporting functions an integration can call. Test the API response Why the API test is required before Turnstile appears on your forms, and what each failure message means. Turnstile error codes explained What each Cloudflare verification error code means, and which browser console errors are safe to ignore. Add Turnstile to a custom form Render the widget and verify the token on a form the plugin does not support out of the box. Choose which forms are protected How the "Enable Turnstile on your forms" panels work, including guest-only options, widget position and disabling specific form ID… Export and import your settings Move a Turnstile configuration between sites as a JSON file, including what is deliberately left out of the export. Gravity Forms, WPForms and other form plugins Enabling Turnstile across form plugins, exempting specific form IDs, and the per-plugin quirks worth knowing. Performance and script loading settings Defer Scripts, Performance Plugin Compatibility and the preconnect resource hint, and when to change each one. Privacy, GDPR and what data Turnstile collects What Cloudflare processes, what the plugin stores locally, and the privacy implications of the reCAPTCHA failsafe. Caching and optimisation plugins Why optimisation plugins break the widget, which ones are handled automatically, and what to exclude manually. Define your API keys in wp-config.php Store the site key and secret key as PHP constants instead of in the database, for version-controlled or multi-environment setups. Remove plugin settings when you delete the plugin What the plugin stores, what happens on deactivation versus deletion, and how to have everything cleaned up. WordPress login, registration and comment forms Protecting the built-in login, registration, password reset and comment forms, including AJAX comments and 2FA. Membership and community plugins Ultimate Member, MemberPress, bbPress, BuddyPress, MailPoet and the rest — including which delegate to the WordPress settings.