WordPress login, registration and comment forms
Updated September 13, 2026
The Default WordPress Forms panel on Settings › Cloudflare Turnstile covers the four forms WordPress ships with: login, registration, password reset and comments. This panel is always present, whatever else is installed.
WordPress Login
Protects the login form. The small arrow beside the option reveals Only enable on default wp-login.php page.
Leave that sub-option off and the check applies to any login form on the site, because it hooks WordPress’s authentication globally. That is usually what you want, since it catches front-end login forms your theme or another plugin renders. Turn it on if a custom login form is being checked twice, or if you only want the core screen covered.
Several bundled integrations — WooCommerce, Ultimate Member, Simple Membership, FluentAuth, Wordfence and Sunshine Photo Cart — already suppress the global check while they handle their own form, so the single-use token is not spent twice.
WordPress Register
The registration counterpart, with the same Only enable on default wp-login.php page sub-option and the same reasoning.
WordPress Reset Password
Protects the lost password form. Note that when Paid Memberships Pro is active, Turnstile cannot currently be applied to the lost password form, and the option is disabled with an explanation.
WordPress Comment
Adds the widget to the comment form. The arrow beside it reveals AJAX comments form, which you need to tick if your theme or a plugin submits comments without a page reload — otherwise the widget is not reset after a submission and a second comment fails.
This integration is compatible with wpDiscuz. It does not work when the Jetpack comments form is enabled, which is a Jetpack limitation rather than something the plugin can work around.
Two-factor authentication
The plugin works alongside most 2FA plugins. The widget is deliberately not reset while a two-factor prompt is open, so a Wordfence or FluentAuth second step does not fail because the token changed underneath it. Wordfence Login Security passkeys are handled specifically, having previously been rejected with a missing challenge error.
A word of caution on the login form
Anything that breaks the login form locks you out of your own site. Before enabling Turnstile on login, confirm the API test passes, and keep a way back in — renaming the plugin folder over FTP deactivates it and restores normal login, with your settings intact.