Filter reference
Updated September 13, 2026
The plugin exposes a small set of filters for changing its behaviour from a theme or plugin. All function and hook names use the cfturnstile_ prefix. Everything below is verified against version 1.43.1.
cfturnstile_widget_disable
Return true to disable Turnstile for the current request. This both suppresses the widget markup and makes the verification return success without contacting Cloudflare.
add_filter( 'cfturnstile_widget_disable', function ( $disable ) {
return is_page( 'internal-request-form' ) ? true : $disable;
} );This is a complete bypass of the spam protection, not a visual change. Gate it as narrowly as you can, and never on something an anonymous visitor controls — a query string, a cookie or a request header.
cfturnstile_whitelisted
Seeds the whitelist decision before the configured rules run. The built-in rules can only escalate the value to true, so returning false does not override a visitor who is whitelisted by settings, while returning true does force a whitelist.
add_filter( 'cfturnstile_whitelisted', function ( $whitelisted ) {
return ! empty( $_SERVER['HTTP_X_INTERNAL_PROXY'] ) ? true : $whitelisted;
} );The whitelist check short-circuits on the plugin’s own settings screen, so this filter never fires there.
cfturnstile_wp_login_checks
Return exactly true (the comparison is strict) to skip the global WordPress login check for this request. The login check hooks authenticate globally, so it also fires for login forms owned by other plugins. Use this when you render your own login form and call the verification yourself — otherwise the global check spends the single-use token first and your own check fails.
cfturnstile_wp_register_checks
The registration counterpart, hooked on registration_errors. Same strict true requirement and same reasoning.
cfturnstile_token_refresh_skip_forms
A comma-separated CSS selector list of forms excluded from the post-submit widget reset. Defaults to form.checkout, form.woocommerce-checkout.
add_filter( 'cfturnstile_token_refresh_skip_forms', function ( $selectors ) {
return $selectors . ', form.my-multi-step-form';
} );Add any form that resubmits itself after asynchronous work, where a reset mid-flight would swap the token out from under a pending submission.
WooCommerce filters
cfturnstile_woo_deferred_checkout_markers— an array of WooCommerce notice markers that identify a gateway deferring checkout for 3D Secure. A marker only extends an existing pass; it never grants one.cfturnstile_woo_deferred_checkout_expiry— how long, in seconds, a deferred verification stays valid. Defaults to 900. The deadline is fixed at the first deferral, so repeated markers cannot extend it indefinitely.cfturnstile_skip_on_express_pay— whether to skip verification for an express payment method. Receives the payment method id, the payment data and the Store API request.cfturnstile_is_partial_checkout_render— mark the current checkout render as a throwaway fragment rather than the real form. The built-in detection covers Divi’s Checkout modules; use this to extend it to other page builders.
cfturnstile-settings-not-installed
Filters the array of HTML links shown on the settings page for supported plugins that are not active. Pairs with the cfturnstile-settings-section action for add-ons that register their own integration.