How To Add Cloudflare Turnstile to WordPress Forms [CAPTCHA Alternative]

Editorial Note: We may earn a commission when you visit links on our website.

Are you looking to add greater security to your WordPress forms? With WPForms’ introduction of Cloudflare Turnstile, WordPress forms are more secure.

In this post, we’ll show you how quick and easy it is to set up Cloudflare Turnstile on your WordPress site.

Fix Your WordPress Emails Now

What Is Cloudflare Turnstile?

Cloudflare Turnstile is a CAPTCHA alternative that eliminates users needing to identify images the way tools like hCaptcha and Google reCAPTCHA do.

It keeps your forms spam-free by quietly rotating browser challenges and running non-interactive JavaScript challenges.

Many argue that it improves the user experience because they’re not slowed down by identifying images in CAPTCHAs.

You don’t need to be a Cloudflare customer to use this service. Any site owner can sign up for free.

How To Add Cloudflare Turnstile to WordPress Forms

Now that you know a bit about this CAPTCHA alternative, let’s look at how you can set up Cloudflare Turnstile to protect the forms on your WordPress site.

Step 1: Download & Install WPForms

The WPForms homepage

For this tutorial, you’ll need to have WPForms installed on your WordPress website.

If you need some help with this step, check out this step-by-step guide to installing a WordPress plugin.

Step 2: Create & Configure a Cloudflare Account

The Cloudflare website

After activating WPForms on your website, open a new tab or window and go the Cloudflare website.

On Cloudflare’s site, you should either sign up for an account or log in to an existing one if you have it. Note that it is free to have an account on Cloudflare.

Once you’re logged in and viewing your Cloudflare dashboard, select the Turnstile option in the right sidebar menu and then click Add site.

Add a site to Cloudflare Turnstile

Next, enter a site name. This is for internal use only.

Entering a site name on Cloudflare Turnstile

After that, you’ll enter your website’s URL in the Domain field.

Adding a website domain to Cloudflare Turnstile

Note that you can enter multiple domains here and use a single set of API keys across all of them.

The final step in setup on Cloudflare’s site is to select a widget type. With these options, you have the ability to choose how Cloudflare should process CAPTCHA requests.

There are 3 options: managed, non-interactive, and invisible

Selecting widget type options in Cloudflare Turnstile

  • Managed: This option lets Cloudflare use visitor information to determine whether to show an interactive challenge or to verify automatically based on browser data. The only interactive challenge it shows is a checkbox. No images or text.
  • Non-interactive: The user doesn’t interact with this challenge in any way. They only see a widget with a loading bar while the browser challenge runs to verify the user.
  • Invisible: This options runs unseen in the background and requires no interaction from the user.

After you select your widget type, click the create button.

Click the blue Create button

Doing this will generate a unique set of API keys.

API keys in Cloudflare Turnstile

Keep these open in this tab or window and return to the tab or window containing your WordPress dashboard and WPForms account.

Step 3: Configure Cloudflare Turnstile in WPForms

Now it’s time to paste the site key and secret key into WPForms to connect your account.

From your WordPress dashboard, click on WPForms » Settings. Then select the tab for CAPTCHA. This is where the Cloudflare Turnstile connection lives.

Navigating to the CAPTCHA settings in WPForms

Next, select Turnstile from the options provided.

Select Turnstile from the options

Below that, you’ll need to enter the Site Key and Secret Key to connect your Cloudflare account to WPForms to prevent form spam.

Copy these values exactly from your other tab with your Cloudflare account open, and paste them into the Turnstile setup in WPForms.

Entering your Site Key and Secret Key from Cloudflare to WPForms

Once you’ve entered both keys, you can configure additional settings.

Fail Message

Configuring the fail message in WPForms

In this setting, you can customize the message that users will see if they fail the verification process.


Setting the Type for your Cloudflare widget

The Type settings let you choose from dark, light, or auto to determine the appearance of the Cloudflare widget on your form. If you select auto, it will toggle back and forth based on users’ device settings.

Preview & No-Conflict Mode

Accessing the preview and enabling No-Conflict Mode in WPForms

After updating the Type, you’ll see a section previewing the widget. Note that this will update after you save your settings.

Below that is No-Conflict Mode. If Cloudflare Turnstile or any of the CAPTCHA options is loading multiple times on your site, it can present problems that keep your anti-spam option from working properly.

An example of this is if WPForms and your site theme are both using Turnstile.

If you select No-Conflict Mode, it will automatically remove Turnstile code that’s not loaded by WPForms.

If you’re not sure or not comfortable making that call, reach out to the support team and they can help answer your questions.

Once you’ve done that, click the Save Settings button.

Saving your Turnstile settings in WPForms

After that, you should be able to see the preview of your Turnstile widget and how it will appear to users.

After saving your settings, you can preview your Turnstile widget

Step 4: Add Cloudflare Turnstile to a Form in WPForms

Your keys are set up, and your Cloudflare account is linked to WPForms. The next step is to create a form to test it.

For this, open WPForms in WordPress. You can either create a new form or work with an existing one.

Upon entering the form builder, you should now see a Turnstile option in the Standard Fields. Use this option to add Turnstile to your form.

The Turnstile field will appear in the Standard Fields section of the form builder

Once Turnstile is turned on for the form, you can easily turn it off and back on if needed. To do this, go to Settings » Spam Protection and Security.

To toggle Turnstile on or off, go to Spam Protection and Security in your WPForms settings

From there, use the toggle switch to enable or disable Turnstile for that particular form.

Use the toggle switch to enable or disable Turnstile on your form

Note that, despite the Turnstile option appearing in the Standard Fields section, there will not be a specific field on your form that displays Turnstile. Rather, once Turnstile is properly enabled on the form, you’ll see a badge in the upper right corner of the form builder.

The badge in the top right corner indicates that Turnstile is enabled on your form.

When your form is complete, publish it so you can run a test to ensure it’s in working order.

Step 5: Test Cloudflare Turnstile

The only thing left to do is test your work! To make sure everything is running as expected, simply submit an entry to your form.

If you’d like more information about testing your forms, check out this full form testing checklist.

Next, Improve Your Email Deliverability

Wondering how to make sure the emails you send from WordPress end up where they’re supposed to be? Check out our article on best practices for WordPress email deliverability.

And don’t forget to read up on how to send test emails from WordPress to be sure you can test your emails properly.

Fix Your WordPress Emails Now

Ready to fix your emails? Get started today with the best WordPress SMTP plugin. If you don’t have the time to fix your emails, you can get full White Glove Setup assistance as an extra purchase, and there’s a 14-day money-back guarantee for all paid plans.

If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.

Add a Comment

We're glad you have chosen to leave a comment. Please keep in mind that all comments are moderated according to our privacy policy, and all links are nofollow. Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.