The TEST RESPONSE button at the top of Settings › Cloudflare Turnstile runs a real challenge and verifies the resulting token against Cloudflare using your secret key. Until that test succeeds, the plugin does not load any of its form integrations, so no widget appears anywhere on the site.

Why the test is required

The site key and secret key are a pair, and they fail in different ways. A wrong site key stops the widget from rendering, which is obvious. A wrong secret key lets the widget render normally but makes every verification fail, which would silently block every genuine submission on your site. The test exercises both halves in one go, so a mismatch is caught before your visitors run into it.

Whenever you change either key through the settings page, the flag resets and the test has to be run again. Changing the keys programmatically — with WP-CLI or a provisioning script — does not switch Turnstile off.

What the results mean

• Success — a green confirmation appears and the integrations load. Nothing else to do.
• Failed — the error message below the button names the Cloudflare error code. invalid-input-secret means the secret key is wrong. invalid-input-response usually means the token expired before you clicked; complete the challenge and click straight away.
• The widget does not appear next to the button — the site key is wrong, or the hostname in your Cloudflare widget configuration does not match the domain you are testing on.

See Turnstile error codes explained for the full list.

The “not currently showing on your forms” notice

If keys are saved but the test has never passed, WordPress shows a dismissible admin notice on other screens warning that Turnstile is not showing on your forms, with a link back to the settings page. Running a successful test clears it.

The invalid secret key warning

Separately, if Cloudflare rejects your secret key during a real submission, the plugin raises a warning notice in the admin and emails the site administrator once. This is throttled so a busy site does not generate repeated writes or a flood of email. The notice stays until you dismiss it, and Turnstile keeps protecting your forms in the meantime — but verifications may be failing, so re-test the keys as soon as you see it.

Testing on a local or staging site

Cloudflare publishes dummy site keys and secret keys for development, including an “always passes” pair, which let forms submit on a hostname that is not reachable from the internet. Use those on local environments rather than your production keys.

Related

• Set up Turnstile on your site
• Turnstile error codes explained
• The Turnstile widget is not appearing