Submissions fail with “Please verify that you are human”
Updated September 13, 2026
This is the opposite problem to a missing widget: the challenge renders, the visitor completes it, and the form still rejects the submission. The widget is working and the verification step is failing, so start by finding out which error code Cloudflare returned.
Find the error code first
Enable debug logging on the Analytics tab of Settings › Cloudflare Turnstile, reproduce the failure, and read the recorded response. Without the code you are guessing. See Turnstile error codes explained for what each one means.
invalid-input-secret
Your secret key is wrong. This is the failure mode where the widget looks perfect and every genuine submission is blocked, because the site key is fine and only the secret is bad.
The plugin raises an admin warning and emails the site administrator once when it sees this. Re-enter the secret from the Cloudflare dashboard, making sure you have copied the secret and not the site key, and run the API test.
timeout-or-duplicate
The token had already been used, or had expired. Turnstile tokens are single-use by design. Common causes:
- Two integrations checking the same submission. The second check spends a token that is already gone. The plugin avoids this for its own bundled integrations, but enabling Turnstile in both this plugin and a form plugin’s own CAPTCHA settings — WPForms is the usual culprit — produces exactly this.
- The visitor sat on the page a long time before submitting, and the token expired. Setting Refresh Timeout to Auto handles most of this.
- A 3D Secure card payment resubmitting the checkout with the same token. Recent versions handle the known gateways; see WooCommerce forms and checkout.
missing-input-response
No token reached the server. Either the widget never rendered for that visitor, or the form submitted before the challenge completed, or the field was stripped somewhere between the browser and PHP. A steady background level of this on a public form is normal — it is bots submitting without loading the widget.
invalid-input-response
The token was malformed or had expired. If you see this consistently rather than occasionally, check that the site key and secret key are from the same Cloudflare widget. Mixing keys from two different widgets produces this.
Hostname mismatches
If verification fails on one domain but works on another, check the hostname list on your Cloudflare widget. It needs to include every domain that serves the form, including www and non-www variants and any staging domain.