Turnstile error codes explained
Updated September 13, 2026
When a verification fails, Cloudflare returns a short error code. The plugin records it in the debug log, counts it on the Analytics tab under Blocked Reasons, and shows it under the API test if that is where the failure happened. These are the codes you will see.
invalid-input-secret
The secret key was rejected. Your site key is fine, so the widget renders normally, but every submission fails. Re-copy the secret from the Cloudflare dashboard and run the API test.
This is the one code the plugin escalates: it raises a dismissible admin warning and emails the site administrator once, throttled so a busy site does not generate a flood.
missing-input-secret
No secret was sent at all. Normally means the secret key field is empty.
invalid-input-response
The token was malformed or had expired before it reached Cloudflare. Seen occasionally, this is harmless. Seen constantly, check that the site key and secret key come from the same Cloudflare widget.
missing-input-response
No token was submitted. Either the visitor submitted before completing the challenge, the widget never rendered for them, or the field was stripped in transit. A low background level on a public form is normal and represents bots being blocked.
timeout-or-duplicate
The token had already been validated. Tokens are single-use, so this points at something checking the same submission twice, or a visitor resubmitting a form with a stale token. Analytics counts these separately as retries rather than as ordinary blocks.
bad-request
Cloudflare rejected the request as malformed. Rare, and usually transient.
internal-error
Something went wrong on Cloudflare’s side. The request can be retried. If you see these in volume, consider whether failsafe mode is worth enabling.
Client-side errors in the browser console
Codes logged by the widget in the browser are a separate set from the server-side ones above, and Cloudflare documents them in its client-side error codes reference.
One to ignore: a 401 in the console during a challenge. That is a request for a Private Access Token that the device or browser does not support yet, and it does not indicate a problem.