To add Cloudflare Turnstile to WordPress, create a free widget in your Cloudflare dashboard (Turnstile > Add widget) to get a site key and secret key. Then install the free Simple CAPTCHA with Cloudflare Turnstile plugin, paste both keys into Settings > Cloudflare Turnstile, and pick the forms to protect. Your site doesn’t need to use Cloudflare’s DNS or CDN.
Turnstile is Cloudflare’s replacement for CAPTCHA puzzles. In its recommended Managed mode, it decides whether a visitor needs to click a checkbox at all, and there are no images or text to decipher. It stops bots on login, registration and contact forms, and it pairs well with Akismet if you also want to stop comment spam. SmartWP uses it on its own Gravity Forms contact form.
- Turnstile is free for up to 20 widgets with unlimited challenges, and it works on any site, whether or not the site runs through Cloudflare.
- The free Simple CAPTCHA with Cloudflare Turnstile plugin (200,000+ active installs) adds it to WordPress login, registration, password reset and comment forms, WooCommerce, and about 25 form and membership plugins.
- Managed mode is Cloudflare’s recommended setting. Most visitors never see a checkbox.
- Cloudflare publishes test keys that always pass, so you can try the setup on a staging site first.
- WPForms and Gravity Forms also have their own Turnstile options. Turn it on in only one place per form, or you can end up with two widgets.
What Turnstile costs
Nothing for most sites. Cloudflare’s free plan includes up to 20 widgets, unlimited challenges, up to 10 hostnames per widget and 7 days of analytics. The Enterprise plan adds things like unlimited widgets and removing the Cloudflare branding. The WordPress plugin is free too, with no paid version.
Step 1: Create a Turnstile widget in Cloudflare
You need a free Cloudflare account, but your domain doesn’t have to use Cloudflare. Cloudflare’s documentation says Turnstile “can be embedded into any website without sending traffic through Cloudflare.”
- Log in to the Cloudflare dashboard (or create a free account) and open the Turnstile page.
- Click Add widget.
- Give the widget a name, such as your site’s name, and add your domain under hostname management. Add a staging domain too if you want to test there.
- Choose a widget mode. Managed is the recommended default. Non-Interactive always shows the widget but never asks for a click, and Invisible runs entirely in the background.
- Create the widget, then copy the site key and the secret key.
Keep the secret key private. It goes in your WordPress settings, never in your theme or front-end code.
Step 2: Install Simple CAPTCHA with Cloudflare Turnstile
The easiest way to connect Turnstile to WordPress is Simple CAPTCHA with Cloudflare Turnstile by Elliot Sowersby (RelyWP), formerly called Simple Cloudflare Turnstile. It has more than 200,000 active installs and is tested with WordPress 7.1.
- Log in to WordPress and go to Plugins > Add Plugin.
- Search for “Simple CAPTCHA with Cloudflare Turnstile”, then install and activate it.
- Go to Settings > Cloudflare Turnstile and paste your site key and secret key.
- Save, then use the plugin’s test button to confirm the keys work. A working setup shows “Success! Turnstile is working correctly with your API keys.”
Step 3: Choose which forms to protect
Lower on the same settings page, turn Turnstile on for the forms you use. Start with the default WordPress forms:
- WordPress: login, registration, password reset and comments.
- WooCommerce: checkout, pay for order, account details, login, registration and password reset.
- Form plugins: WPForms, Fluent Forms, Contact Form 7, Gravity Forms, Formidable Forms, Forminator, Jetpack Forms, Kadence Forms and SureForms.
- Others, including Elementor Pro forms, Easy Digital Downloads, MemberPress, Paid Memberships Pro, Ultimate Member, BuddyPress, bbPress, MailPoet and wpDiscuz.
Save, and the widget appears on those forms. Here is the WordPress login form with Turnstile, set up with Cloudflare’s test keys:
If you also use a contact form plugin, it is worth checking that its Reply-To address is set correctly while you are in there, since a form that blocks spam but sends replies to the wrong inbox is its own kind of broken.
Settings worth knowing about
- Appearance mode: show the widget all the time, or only when Turnstile needs the visitor to interact.
- Disable submit button: keeps the button disabled until the challenge passes. SmartWP has this on for its contact form.
- Whitelist: skip Turnstile for logged-in users or specific IP addresses (wildcards aren’t supported).
- Failsafe mode: if Cloudflare is down, either allow submissions or fall back to reCAPTCHA.
- Theme and language: match the widget to light or dark designs and your site’s language.
Test Turnstile before going live
Cloudflare publishes test keys that work on any domain, which is handy on a staging or local site. The site key 1x00000000000000000000AA always passes with a visible widget, and the secret key 1x0000000000000000000000000000000AA always passes validation. There are also keys that always fail, for testing error messages. The widget labels itself as testing-only, so switch to your real keys before launch.
Using a form plugin’s built-in Turnstile instead
Some form plugins can add Turnstile on their own. WPForms has a Turnstile setup guide for its CAPTCHA settings, and Gravity Forms has an official Cloudflare Turnstile Add-On. If you only need to protect one form plugin, that can be all you need. If you use the Simple CAPTCHA plugin as well, enable Turnstile in only one of the two for each form.
Check your Turnstile stats
Each widget has analytics in the Cloudflare dashboard, showing how many challenges were issued and solved. On the free plan you can look back 7 days. The WordPress plugin also has its own Analytics tab next to Settings.
Frequently asked questions
Is Cloudflare Turnstile free?
Yes. The free plan includes up to 20 widgets, unlimited challenges and up to 10 hostnames per widget. The Simple CAPTCHA with Cloudflare Turnstile plugin is free as well, with no paid version.
Do I need to use Cloudflare for my DNS or CDN?
No. You need a free Cloudflare account to create the widget, but Cloudflare says Turnstile can be embedded into any website without sending traffic through Cloudflare.
Does Turnstile work with WooCommerce?
Yes. The Simple CAPTCHA with Cloudflare Turnstile plugin can protect the WooCommerce checkout, pay for order, account details, login, registration and password reset forms.
Will visitors have to solve a puzzle?
No. Turnstile never shows image or text puzzles. In Managed mode, most visitors pass without doing anything, and some are asked to click a checkbox. Invisible mode never shows a widget at all.
Does Turnstile replace Akismet?
Not exactly. Turnstile stops bots before a form is submitted, while Akismet checks the content of comments and form entries for spam. Many sites run both. If spam keeps getting through, you can also disable WordPress comments entirely.
Developers can find the full API, including server-side validation, in the Turnstile developer documentation.
6 Responses
i just hear about turnstile and sound interesting.
can we use this service without using any cloudflare product (cdn) ?
You don’t need to use their CDN to use turnstile (plus it’s free!)
can I have just one key for every wpms domain? Its painful to add one per domain… tks! 😉
Sadly you need to use a new key for each domain I think.
Unfortunately, it doesn’t work with multi-page forms using Formidable Forms.
The Turnstile check appears with the Next button on page one, then on page two the Next button is greyed out.
This page looks to be full of comment spam, if you ask me. Just read the over-appreciative, perfectly phrased comments that interestingly all have a link to their author’s website.
Maybe follow your own guide 😉