What is Cloudflare Turnstile?
Updated September 13, 2026
Cloudflare Turnstile is a free anti-spam check that confirms a visitor is a real person without making them pick out traffic lights or read distorted text. This plugin adds it to your WordPress forms. Everything is configured at Settings › Cloudflare Turnstile.
How it differs from a traditional CAPTCHA
Instead of setting a puzzle, Turnstile runs a set of small browser checks in the background and scores the result. Most visitors see a box that ticks itself after a second or two, and many never see anything at all if you switch the widget to interaction-only mode. Only visitors that look suspicious get asked to interact.
Cloudflare states that Turnstile does not look for or set cookies, and does not harvest data for ad retargeting. See Privacy, GDPR and what data Turnstile collects for the detail.
What the plugin does
Turnstile itself is a service. The plugin is the bridge between that service and WordPress, and it handles two jobs on every protected form:
- Render — it places the widget in the right spot on the form, in the theme, size and language you choose.
- Verify — when the form is submitted, it sends the token the widget produced to Cloudflare and blocks the submission if Cloudflare rejects it.
Both sides matter. A widget that renders but is never verified protects nothing, which is why the plugin asks you to run a test of the API response before it starts adding Turnstile to your forms.
What it costs
Nothing. Turnstile is a free Cloudflare service and the plugin is free with no paid tier, no upsells and no extra tracking. You do need a Cloudflare account to generate the keys, but you do not need to move your site’s DNS to Cloudflare or use any other Cloudflare product.
Requirements
- WordPress 4.7 or later.
- WooCommerce 3.4 or later, if you want to protect WooCommerce forms.
- A Cloudflare account, to generate a site key and secret key.
- Outbound HTTPS from your server to
challenges.cloudflare.com, so verification requests can reach Cloudflare.
The plugin works on WordPress Multisite and alongside most two-factor authentication plugins.