Title: Simple CAPTCHA with Cloudflare Turnstile Author: Elliot Sowersby / RelyWP Published: 15 outubro, 2022 Last modified: 29 setembro, 2026 --- Pesquisar plugins ![](https://ps.w.org/simple-cloudflare-turnstile/assets/banner-772x250.png?rev=3356659) ![](https://ps.w.org/simple-cloudflare-turnstile/assets/icon-128x128.gif?rev=2937121) # Simple CAPTCHA with Cloudflare Turnstile Por [Elliot Sowersby / RelyWP](https://profiles.wordpress.org/elliotvs/) [Baixar](https://downloads.wordpress.org/plugin/simple-cloudflare-turnstile.1.44.0.zip) * [Detalhes](https://br.wordpress.org/plugins/simple-cloudflare-turnstile/#description) * [Avaliações](https://br.wordpress.org/plugins/simple-cloudflare-turnstile/#reviews) * [Instalação](https://br.wordpress.org/plugins/simple-cloudflare-turnstile/#installation) * [Desenvolvimento](https://br.wordpress.org/plugins/simple-cloudflare-turnstile/#developers) [Suporte](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/) ## Descrição Easily add Cloudflare Turnstile to all your WordPress website forms to protect them from spam! A user-friendly, privacy-preserving reCAPTCHA alternative. 100% free! ### Supported Forms You can currently enable Turnstile on the following forms: **WordPress** * Login Form * Registration Form * Password Reset Form * Comments Form **WooCommerce** * Checkout * Pay For Order * Account Details Form * Login Form * Registration Form * Password Reset Form **Form Plugins** * WPForms * Fluent Forms * Contact Form 7 * Gravity Forms * Formidable Forms * Forminator Forms * Jetpack Forms * Kadence Forms * SureForms **Other Integrations** * Elementor Pro Forms * Easy Digital Downloads Forms * Paid Memberships Pro Forms * Mailchimp for WordPress Forms * MailPoet Forms * BuddyPress Registration Form * bbPress Create Topic & Reply Forms * MemberPress Forms * Ultimate Member Forms * WP-Members Forms * WP User Frontend Forms * WP User Manager Forms * wpDiscuz Comments Form * CheckoutWC & Flux Checkout * Sunshine Photo Cart This plugin is also compatible with WordPress Multisite, and most two-factor authentication( 2FA) plugins. ### Other Features The plugin includes several other features and options: * Theme: Select the default theme for Turnstile. * Language: Set the default language for Turnstile. * Appearance Mode: Choose if Turnstile is always displayed, or only when an interaction is required. * Disable Submit Button: Disable the submit button on forms until the Turnstile challenge is completed. * Custom Error Message: Set your own custom error message for failed submissions. * Whitelist: Prevent Turnstile from showing for logged in users, or certain IP addresses (wildcards are not supported). * Resource Hint (Preconnect): Option to enable resource hint preconnect for improved performance. * Failsafe Mode: Option to enable failsafe mode. When Cloudflare is down, this mode will either allow submissions, or fallback to reCAPTCHA. * Debug Logging: Enable debug logging of Turnstile form submission events to help with troubleshooting. ### Getting Started It’s super quick and easy to get started with Cloudflare Turnstile! 1. Simply generate a “site key” and “secret key” in your Cloudflare account, and add these in the plugin settings page. 2. Select which forms Turnstile should be added to and click save. 3. Finally, click the “TEST API RESPONSE” button to make sure the Turnstile API response is working OK. 4. A new Cloudflare Turnstile challenge will then be displayed on your selected forms to protect them from spam! For more detailed instructions, please see our [setup guide](https://elliotsowersby.com/blog/setup-guide-turnstile/?utm_source=simplecloudflareturnstile&utm_medium=readme-guide). ### What is Cloudflare Turnstile? Cloudflare Turnstile delivers frustration-free, CAPTCHA-free web experiences to website visitors. Turnstile is an anti-spam filter that stops abuse and confirms visitors are real without the data privacy concerns or awful UX that CAPTCHA thrusts on users. Learn more here: [https://www.cloudflare.com/en-gb/products/turnstile/](https://www.cloudflare.com/en-gb/products/turnstile/) ### Is it free to use? Yes, this plugin is completely free with no paid version, and does not include any additional data tracking. Cloudflare Turnstile is also a completely free service. ### Plugin Languages Currently available in [14 languages](https://translate.wordpress.org/projects/wp-plugins/simple-cloudflare-turnstile/). Thank you to all the [contributers](https://translate.wordpress.org/projects/wp-plugins/simple-cloudflare-turnstile/contributors/)! If you would like to help contribute translations, please [click here](https://translate.wordpress.org/projects/wp-plugins/simple-cloudflare-turnstile/). ### Other Information * For help & suggestions, please [create a support topic](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/#new-topic-0). * Follow the developer [@ElliotSowersby](https://twitter.com/ElliotSowersby) on Twitter. * [View on GitHub](https://github.com/elliotvs/simple-cloudflare-turnstile) ### Support The Plugin If you would like to support the continued development and support of this plugin, you can [make a donation](https://www.elliotsowersby.com/donate/). ### Trademark Notice Cloudflare, the Cloudflare logo, and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. This plugin is not affiliated with, endorsed, or sponsored by Cloudflare, Inc. ## Capturas de tela [⌊Example Turnstile on the WP Login Page⌉⌊Example Turnstile on the WP Login Page⌉[ Example Turnstile on the WP Login Page [⌊Example Turnstile on the WP Register Page⌉⌊Example Turnstile on the WP Register Page⌉[ Example Turnstile on the WP Register Page [⌊Example Turnstile on the WP Comments Form⌉⌊Example Turnstile on the WP Comments Form⌉[ Example Turnstile on the WP Comments Form [⌊Example Turnstile on the WooCommerce My Account Page⌉⌊Example Turnstile on the WooCommerce My Account Page⌉[ Example Turnstile on the WooCommerce My Account Page [⌊Example Turnstile on the WooCommerce Checkout Page⌉⌊Example Turnstile on the WooCommerce Checkout Page⌉[ Example Turnstile on the WooCommerce Checkout Page [⌊Example Turnstile on a Contact Form⌉⌊Example Turnstile on a Contact Form⌉[ Example Turnstile on a Contact Form [⌊Example Settings Page⌉⌊Example Settings Page⌉[ Example Settings Page ## Instalação 1. Upload ‘simple-cloudflare-turnstile’ to the ‘/wp-content/plugins/’ directory. 2. Activate the plugin through the ‘Plugins’ menu in WordPress. 3. Visit the plugin settings in WordPress admin menu at “Settings > Cloudflare Turnstile”. 4. You will need to generate a “Site Key” and “Site Secret” in your Cloudflare account, then enter these in the settings page. 5. Select which forms you want to enable Turnstile on, then click the “Save Changes” button. 6. Finally, you will be required to complete a quick test of the widget by clicking“ TEST API RESPONSE”, to confirm it’s working correctly. 7. A new Cloudflare Turnstile challenge will then be displayed on your selected forms to protect them from spam! For more detailed instructions, please see our [setup guide](https://elliotsowersby.com/blog/setup-guide-turnstile/?utm_source=simplecloudflareturnstile&utm_medium=readme-guide). ## Perguntas frequentes ### Do you have a setup guide? Yes, you can view a setup guide for the plugin [here](https://elliotsowersby.com/blog/setup-guide-turnstile/?utm_source=simplecloudflareturnstile&utm_medium=readme-guide). ### Will there be more integrations be added in the future? More integrations may be added in the future, based on user feedback. So if you have any suggestions please feel free to submit a [support topic](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/#new-topic-0). ### I need help, can I get support? Please bare in mind, the [Simple CAPTCHA with Cloudflare Turnstile](https://simpleturnstile.com/) plugin is 100% free, developed as a way to give back to the WordPress community. You can post a support thread on the WordPress.org forums to get help from the community, and we will also keep an eye on this quite frequently, providing support and answers where possible. However, we can not guarantee an answer every single support ticket. [Click here to create a support topic.](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/#new-topic-0) The support forums are the only place you should submit a support ticket for 100% free support from the developer and the WordPress community. ### Is the plugin free? Yes, this plugin is completely free with no paid version, and does not include any additional data tracking. Cloudflare Turnstile is also a completely free service. ### Is this better for Data Privacy & GDPR? Cloudflare mentions that they “never harvest data for ad retargeting” and Turnstile“ never looks for cookies (like a login cookie), or uses cookies to collect or store information of any kind”. Check out [this article](https://blog.cloudflare.com/turnstile-private-captcha-alternative/#ux-isn-t-the-only-big-problem-with-captcha-so-is-privacy) which explains more about how Turnstile has less data collection, more privacy, and same security. View the Cloudflare [GDPR compliance](https://www.cloudflare.com/en-gb/gdpr/introduction/) and [Data Processing Addendum](https://www.cloudflare.com/en-gb/cloudflare-customer-dpa/) for more information how on they handle data. ### I see a 401 console error, is this a problem? You can safely ignore the error. It is requesting a “Private Access Token (PAT) Open external link” that your device or browser does not support yet. [Click here](https://developers.cloudflare.com/turnstile/frequently-asked-questions/#i-am-seeing-a-401-error-in-your-console-during-a-turnstile-security-check-is-this-a-problem) for more information. ### Turnstile Error Codes in Browser Console For details on errors codes being displayed in your browser console, please refer to the Cloudflare documentation [here](https://developers.cloudflare.com/turnstile/troubleshooting/client-side-errors/error-codes/). ### The Turnstile Challenge is not appearing, what should I do? Firstly, make sure you have completed the [setup guide](https://elliotsowersby.com/blog/setup-guide-turnstile/?utm_source=simplecloudflareturnstile&utm_medium=readme-guide) correctly, and that you have completed the “TEST API RESPONSE” on the settings page. If you are still having issues, please post a [support topic](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/#new-topic-0) on the WordPress.org forums. ### How can I report security bugs? You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. [Report a security vulnerability.](https://patchstack.com/database/vdp/simple-cloudflare-turnstile) ## Avaliações ![](https://secure.gravatar.com/avatar/b534ea7537c5fbe86503bee47a0213b9e40e090fa4e2d2f9c7ac0a6d0361eef5? s=60&d=retro&r=g) ### 󠀁[Pop-up windows appear over the text and input fields](https://wordpress.org/support/topic/pop-up-windows-appear-over-the-text-and-input-fields/)󠁿 [saj13730](https://profiles.wordpress.org/saj13730/) 27 setembro, 2026 Pop-up windows appear over the text and input fields, making it impossible to work. It is not at all suitable for right-to-left (RTL) layouts. ![](https://secure.gravatar.com/avatar/44179551b043ead28fbb013bf34b36be671daac5fcd9e46902033bc91e6af235? s=60&d=retro&r=g) ### 󠀁[There are better alternatives](https://wordpress.org/support/topic/there-are-better-alternatives-2/)󠁿 [szponix](https://profiles.wordpress.org/szponix/) 25 setembro, 2026 1 resposta This plugin worked fine on my site until one of the recent major updates about two months ago. Suddenly, the Turnstile widget stopped showing up in the WordPress comments form, blocking all users from submitting comments. I had to disable comment protection, which allowed spam comments to sneak right through. I reported the issue and even did some debugging. The problem only occurs when LiteSpeed Cache is enabled, meaning a recent update introduced a change that conflicts with the LiteSpeed Cache mechanism. Even though I informed the author about this, no fix was provided, and my findings were completely ignored. I eventually decided to switch to another, less popular plugin that does the exact same thing. The only difference is that the other one actually works. Honestly, "Simple CAPTCHA with Cloudflare Turnstile" shows heavy signs of "vibe coding." Every major update breaks various things that used to work fine (just look at the support forum reports). Then, for the next week or two, minor updates are rushed out to patch what got broken—though some issues (like mine) are ignored completely. After that, the next major update drops, and the whole cycle repeats. You might want to consider checking out other, less popular plugins that offer the same functionality without all the headaches. ![](https://secure.gravatar.com/avatar/3640765cae0246df49dadb9d62ce3024e1909377c8915c64eac0e0c8ceccbb66? s=60&d=retro&r=g) ### 󠀁[NOT easy to set up](https://wordpress.org/support/topic/not-easy-to-set-up/)󠁿 [robotarmy](https://profiles.wordpress.org/robotarmy/) 16 setembro, 2026 1 resposta You install the app and there's a link that says, "You can get your site key and secret key from here:" When you click on that link you're taken to a page with absolutely no instructions and no mention of these secret keys. Just clicking on support opens up another dialogue that is completely confusing. There is nothing easy about setting this thing up. ![](https://secure.gravatar.com/avatar/45e1fd67696a2761d143f694b60e7aa03fbe516116585061cd60f33b98abcc07? s=60&d=retro&r=g) ### 󠀁[Support is unfortunately not there](https://wordpress.org/support/topic/support-is-unfortunately-not-there/)󠁿 [fabiopp](https://profiles.wordpress.org/fabiopp/) 7 setembro, 2026 Used to be good. I am having a compatibility issue since some months but no useful reply from the developer since then. I hope this gets fixed ![](https://secure.gravatar.com/avatar/7466ca0a9a28d342aa7e857ead28811eec1a29339a9a449783728bd5f861605c? s=60&d=retro&r=g) ### 󠀁[Perfect, simple, just works](https://wordpress.org/support/topic/perfect-simple-just-works-2/)󠁿 [jancerny2001](https://profiles.wordpress.org/jancerny2001/) 4 setembro, 2026 Great plugin, easy to setup, simply just works. No "pro" or subscription bs. Currently using with Elementor Pro Forms and Contact Form 7, just one click to enable integration 🙂 Thank you! ![](https://secure.gravatar.com/avatar/e94e37def1ffc15a55a603844eb0757076ab6759a74bdf1f7b0a02dc9ee38d14? s=60&d=retro&r=g) ### 󠀁[A Handy little plugin that gets the job done](https://wordpress.org/support/topic/a-handy-little-plugin-that-gets-the-job-done/)󠁿 [Maxime_13](https://profiles.wordpress.org/maxime_13/) 4 setembro, 2026 A nice little plugin that’s useful and practical. It’s not magic, but it gets the job done. Works well for me with WP v7.1. [ Leia todas as 258 avaliações ](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/) ## Colaboradores e desenvolvedores “Simple CAPTCHA with Cloudflare Turnstile” é um programa de código aberto. As seguintes pessoas contribuíram para este plugin. Colaboradores * [ Elliot Sowersby / RelyWP ](https://profiles.wordpress.org/elliotvs/) * [ RelyWP ](https://profiles.wordpress.org/relywp/) Simple CAPTCHA with Cloudflare Turnstile” foi traduzido para 15 localidades. Agradecemos aos [tradutores](https://translate.wordpress.org/projects/wp-plugins/simple-cloudflare-turnstile/contributors) por suas contribuições. [Traduzir o “Simple CAPTCHA with Cloudflare Turnstile” para seu idioma.](https://translate.wordpress.org/projects/wp-plugins/simple-cloudflare-turnstile) ### Interessado no desenvolvimento? [Navegue pelo código](https://plugins.trac.wordpress.org/browser/simple-cloudflare-turnstile/), consulte o [repositório SVN](https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/) ou assine o [registro de desenvolvimento](https://plugins.trac.wordpress.org/log/simple-cloudflare-turnstile/) por [RSS](https://plugins.trac.wordpress.org/log/simple-cloudflare-turnstile/?limit=100&mode=stop_on_copy&format=rss). ## Registro de alterações #### Version 1.44.0 – 29th September 2026 * New: Added support for FluentAuth 3.0’s two-factor authentication, including passkeys and authenticator apps. The second step of the login previously failed with “There has an error when log you in” when Turnstile was enabled on the WordPress login form. * Tweak: Improved compatibility with “Delay JavaScript” in performance plugins such as LiteSpeed Cache and Perfmatters, which could stop the Turnstile widget from displaying on the WooCommerce block checkout, and could stop the Turnstile widget from displaying on Elementor forms and popups or from resetting after a failed submission. * Tweak: Improved support for stores with a classic (shortcode) checkout page while the main checkout page uses the Checkout block, where the Turnstile widget could fail to display. * Tweak: Payment methods set to skip Turnstile are now also skipped on the WooCommerce“ Pay for order” page, as on the checkout. * Tweak: A Turnstile token used on the WooCommerce block checkout can no longer be re-used in another session while that order is still being processed. * Tweak: The Turnstile widget is now displayed on every copy of a form that appears more than once on the same page, not just the first. * Tweak: Improved compatibility with LiteSpeed Cache ESI, so the Turnstile widget is displayed on the comment form for logged-in users and returning commenters. * Tweak: Improved compatibility with Easy Digital Downloads Pro, whose settings could previously not be enabled. * Tweak: Improved compatibility with Elementor forms added using a template (such as with the template shortcode, the Template widget or a Theme Builder template) when the Elementor “Autodetect pages with forms” option is selected, as Turnstile was not loaded on the page. * Tweak: Tightened the FluentAuth integration, so its two-factor compatibility for FluentAuth 2.x can no longer be used to skip the Turnstile check on other login forms, such as the WooCommerce login form. * Tweak: The “Analytics” tab now shows which form a failed submission came from, where most failed submissions were previously listed as “Unknown form”. Elementor forms are now also listed by name, and Kadence forms are grouped into one entry instead of a new entry for every submission. * Tweak: The “Turnstile Debug Log” now shows which form each entry came from. * Fix: Fixed an issue where Android users could not type in the WooCommerce login, register or checkout forms on Divi sites, as the keyboard closed and the Turnstile widget disappeared when a field was tapped. * Fix: Fixed an issue where WooCommerce block checkout orders could be rejected with a Turnstile error after a failed attempt, such as when paying with PayPal. * Fix: Fixed an issue where WooCommerce block checkout orders were rejected with a Turnstile error for whitelisted visitors, and while the failsafe was active during a Cloudflare outage (including after completing the reCAPTCHA failsafe). * Fix: Fixed an issue where logged-in customers could not pay for an order on the WooCommerce “Pay for order” page when “Guest only” was enabled. #### Version 1.43.2 – 17th September 2026 * Fix: Fixed an issue where the Turnstile widget could be missing from the WooCommerce checkout with certain themes or custom checkouts. #### Version 1.43.1 – 11th September 2026 * Fix: Fixed an issue where the “Before Payment”, “After Payment” and “Before Pay Button” widget positions could place the Turnstile widget outside the WooCommerce block checkout, away from the form, on a checkout page whose saved content is missing the payment or place order blocks. * Fix: Fixed an issue where the Turnstile widget was added twice to a form inside an Elementor popup, which could leave the form unable to be submitted. Elementor rebuilds a popup from a copy of its markup each time it opens, so the widget is now added when the popup opens rather than before it. #### Version 1.43.0 – 9th September 2026 * New: Added support for Elementor’s new Atomic forms, using the same “Enable Elementor Forms” setting as classic Elementor Pro forms. * New: Added support for Wordfence 9.0.0’s Login Security passkeys, which were rejected with a missing challenge error when the WordPress login check was enabled. * Tweak: Added the cfturnstile_is_partial_checkout_render filter, so other page builders can flag any extra renders of the checkout template. * Fix: Fixed an issue where WooCommerce orders on the Divi Builder’s Checkout, or paid with a card gateway such as Stripe or WooPayments could be rejected with a Turnstile error. * Fix: Fixed a WooCommerce checkout token remaining usable for up to two minutes when the request that used it ended unexpectedly, such as after a fatal error. #### Version 1.42.3 – 7th September 2026 * Fix: Fixed the Turnstile widget not being reset after a failed submission on forms that submit without a page reload, such as AJAX login forms and single page (SPA) themes. * Fix: Fixed the Turnstile widget not appearing on the WooCommerce checkout when the section chosen in the “Widget Position” setting was not part of the checkout. It now falls back to a position above the “Place Order” button. * Fix: Fixed the “After Payment” widget position removing the entire payment section, including the payment methods, from the WooCommerce block checkout. * Fix: Fixed the Turnstile widget not appearing on the WooCommerce app authorization screen (/wc-auth/). You are now sent to the WordPress login form to complete the challenge, then returned to the authorization screen. * Fix: Fixed the “cloudflare turnstile” button in the Contact Form 7 form editor inserting nothing when clicked. * Fix: Fixed the Turnstile error message not being shown on the Gravity Forms User Registration login form ([gravityform action=”login”]). * Security: Fixed vulnerabilities where the Turnstile check on the WooCommerce checkout and lost password form, and WordPress login and lost password forms could be potentially be bypassed. * Security: Fixed a vulnerability in the Contact Form 7 integration, where an unauthenticated visitor could run any shortcode registered on the site by submitting it as a field value. Reported by Jakub Herman via WPScan. * Security: Fixed a vulnerability where the Turnstile check on Gravity Forms could be bypassed by adding a page number to the request. The check is now only skipped on forms that really do have more than one page. * Tweak: The Turnstile form-tag for Contact Form 7 is now [cf7_simple_turnstile]. Your existing [cf7-simple-turnstile] tags keep working and do not need to be changed. #### Version 1.42.1 – 27th July 2026 * Fix: Fixed an issue where the submit button could stay disabled after the Turnstile challenge was completed, when the “Disable Submit Button” option is enabled. On the login form this could lock you out of your site. * Fix: Fixed the submit button staying disabled after the widget was re-rendered, such as after an AJAX comment or on the Blocksy account modal. * Fix: Fixed the submit button staying disabled on Jetpack forms when the “Disable Submit Button” option is enabled. * Fix: Fixed WooCommerce checkout failing with a “please verify that you are human” error when using the GlobalPayments GPAPI gateway with 3D Secure enabled. * Fix: Fixed the Turnstile API script loading render-blocking, even with the “Defer Scripts” option enabled. * Tweak: Changing the API keys programmatically, such as with WP-CLI or a provisioning script, no longer switches Turnstile off on every form until the manual test is run. * Tweak: Tightened the Forminator integration further, so a solved Turnstile challenge can no longer be re-used for up to 30 seconds. #### Version 1.42.0 – 26th July 2026 * New: Added support for CIDR ranges (IPv4 and IPv6) in the IP whitelist, e.g. 203.0.113.0/24 or 2001:db8::/32, so visitors can be whitelisted by subnet. * Fix: Fixed IP whitelist matching for IPv6 addresses written in a different format, and for IPv4-mapped IPv6 addresses such as ::ffff:203.0.113.5. A /0 range is now ignored. * Fix: Fixed an issue since 1.41 where the login widget could be reset while a two-factor prompt was open (e.g. Wordfence 2FA), causing the login to fail. * Fix: Turnstile now always loads in explicit render mode, fixing the widget not appearing on slow connections, with a “delay JavaScript” optimization, or in AJAX-loaded forms such as comment forms and popups. * Fix: Fixed several WooCommerce issues, including the checkout script erroring when a “delay JavaScript” optimization runs it before jQuery, widgets not rendering on the block checkout, and the “Click here to login” toggle. * Fix: Fixed the Turnstile widget not appearing in the Blocksy theme’s header account modal, and the integration now also loads when a Blocksy child theme is active. * Fix: Fixed a conflict with FluentAuth’s email two-factor and magic login, where the second step could fail with a Turnstile error. * Fix: Fixed a conflict with Simple Membership where a member logging in was not also logged into their WordPress user account, breaking is_user_logged_in() checks,. htaccess protection and user synchronization. * Security: Fixed a vulnerability in the Forminator integration where a solved Turnstile challenge could potentially be reused to bypass verification, as the validation was cached against a form value instead of the single-use token. ( Reported by Meher Sudhakar Abbireddi via WPScan.) #### Version 1.41.1 – 22nd June 2026 * Tweak: Added a view button to show the secret key in the settings page, which is hidden by default. * Tweak: Made a few small changes to the settings page. * Tweak: On the Ultimate Member login form, added a check to prevent further login validation if Turnstile failed. * Fix: Fixed an issue with the Ultimate Member login form since the last update. #### Version 1.41.0 – 18th June 2026 * New: Added a new “Analytics” option which when enabled will start tracking some basic analytics data for Turnstile form submissions. This includes the number of successful and failed submissions, and the reasons for any failures. * Improvement: Added some new tabs to the settings page, with a “Settings” tab for all the main settings, a new “Analytics” tab for the new analytics feature and the debug logging, and an “Import” tab for the import/export feature. * Tweak: Updated the verified transient check to work better with certain 2FA plugins. * Tweak: Updated the Contact Form 7 integration to now show the correct error message when the Turnstile check fails. * Tweak: The “Widget Label Text” is now hidden when “Interaction Only” is selected, and only displayed when the widget actually requires an interaction. * Tweak: Added spacing below the widget when it shows in “Interaction Only” mode, which is hidden when the widget is not displayed. * Tweak: The Turnstile widget now re-renders shortly after clicking the login button on the wp-login.php page, to ensure a fresh token is ready in case of a failed login. * Fix: Fixed an issue with Turnstile not rendering on the block checkout “pay for order” page in some cases. * Fix: Fixed the “Show Widget Label Text” option not displaying on Elementor forms. * Fix: Fixed the “Logged In Users” whitelist option not bypassing Turnstile on Contact Form 7 submissions. * Fix: Fixed the “Appearance Mode” setting not being applied to Elementor forms and the WooCommerce block checkout, causing the widget to always display even when “Interaction Only” was selected. * Other: Renamed the plugin from “Simple CAPTCHA Alternative with Cloudflare Turnstile” to “Simple CAPTCHA with Cloudflare Turnstile”. #### Version 1.40.0 – 29th May 2026 * New: Added an option to enable Turnstile on the WooCommerce Account Details form. * Tweak: Added a warning message to the “Logged In Users” whitelist option. * Tweak: Added an additional check to prevent the Turnstile widget from rendering twice on WooCommerce checkout in rare cases. * Tweak: Prevent any kind of form submission (shortkeys etc) for the default login form when Turnstile is not completed, if the “Disable Submit Button” option is enabled. * Tweak: Prevent any kind of form submission (shortkeys etc) for Elementor forms when Turnstile is not completed [#84](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/84). * Tweak: Force-render inline script now loads via wp_add_inline_script in the footer, fixing rendering issues in some cases when “Defer Scripts” is disabled. * Fix: Fixed widget size setting (Flexible/Compact) not being applied to Elementor forms. * Fix: Fixed a mobile performance issue in some cases. Replaced the fixed 200ms setTimeout fallback which could cause scroll-locking and double-rendering. * Fix: Performance plugin compatibility hooks now register correctly regardless of which performance plugin is active. * Fix: Improved WooCommerce checkout login form Turnstile rendering, which was not working for some themes. * Fix: Fixed a JS error on WooCommerce classic checkout when the Blocks checkout store isn’t registered. * Fix: Fixed duplicate Turnstile widget on Paid Memberships Pro login page. * Fix: Fixed a JS error with wpDiscuz integration when Perfmatters plugin was active. #### Version 1.39.1 – 1st May 2026 * Fix: Fixed a potential issue with the Turnstile check on login forms failing in certain cases when it runs multiple checks in the same request. #### Version 1.39.0 – 20th April 2026 * New: Added integration for the “SureForms” plugin. * New: Added integration for the “Sunshine Photo Cart” plugin ([#70](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/70)). * Tweak: Adjusted the “Widget Label Text” alignment in some cases so it always shows above the widget. #### Version 1.38.4 – 17th April 2026 * Fix: Fixed Turnstile verification failures on WooCommerce checkout caused by payment gateway plugins (e.g. PayPal Commerce, Amazon Pay, Mollie) consuming the single-use token during pre-checkout AJAX validation requests. * Fix: Fixed a fatal error occurring on pages where WooCommerce has been selectively disabled (e.g. via Plugin Organizer). #### Version 1.38.3 – 17th April 2026 * Tweak: Made some tweaks to the WooCommerce checkout duplicate submission check, with a longer expiration for the transient, and improved the auto re-render for Turnstile on payment error in certain cases. * Tweak: Small tweak to the Contact Form 7 integration code with a basic static duplication check. #### Version 1.38.2 – 16th April 2026 * Tweak: Added the transient based duplicate submission check to WooCommerce checkout, to prevent potential duplicate submission check failing issues since the last update. * Tweak: Added improved support for Gravity Forms multi-page forms, to prevent the duplicate submission check from failing on page 2 and beyond. #### Version 1.38.1 – 13th April 2026 * Tweak: Replaced all PHP session usage with WordPress transients for the duplicate submission checks, to prevent full-page caching from being broken by the PHPSESSID cookie and Cache-Control headers. * Tweak: An invalid-input-secret error from Cloudflare no longer disables Turnstile on all forms. Instead, the admin is notified and a soft re-test prompt is displayed on the settings page. * Security: Fixed a broken authentication vulnerability on WooCommerce checkout potentially allowing one successful Turnstile submission to be reused for multiple checks. (Reported by David Marín via Patchstack.) #### Version 1.38.0 – 6th April 2026 * New: Added a “Refresh Timeout” option to the advanced settings. * Performance: The Cloudflare health check (used by failover mode) is now cached for 2 minutes, preventing repeated HTTP requests on every form render. * Tweak: Added missing WooCommerce ‘cart_checkout_blocks’ and ‘product_block_editor’ feature compatibility declarations. * Fix: Fixed a text domain typo in the WooCommerce Store API integration. * Fix: Improved the WP Discuz integration to properly validate and block submissions when the Turnstile check fails, and now honors the whitelist. * Fix: Fixed an issue with Turnstile not loading on Elementor popup forms in some cases. * Fix: The disable submit option should now work correctly on Elementor forms. * Fix: The disable submit option should now work correctly on Contact Form 7 forms. * Fix: Fix for WooCommerce block checkout sometimes rendering the Turnstile widget twice. * Fix: Fixed a “Invalid type for container” JavaScript error with the wpDiscuz integration. * Fix: Fixed the right alignment styling for bbpress. * Fix: Fixed an issue where Turnstile widgets would repeatedly render when a browser tab is left open for extended periods. * Fix: Fixed an issue where CF7 forms would show “One or more fields have an error” when SCT is active but the form doesn’t use the SCT turnstile shortcode. * Fix: Fixed an issue with scripts not being enqueued properly in some cases. * Dev: Fixed the missing prefix for the add_data_attribute function. * Dev: Changed all include() calls to include_once() to prevent fatal errors if the plugin file is loaded more than once. * Dev: Fixed cfturnstile_check() returning false instead of array( ‘success’ => false ) when API keys are not set. * Security: Made a few small precautionary security enhancements (missing ABSPATH check, and sanitized REQUEST_URI). #### Version 1.37.0 – 12th January 2026 * Improvement: Improved the Elementor integration to work better in more cases, and with Elementor popups. * Improvement: Added an alignment option for the Elementor integration. * Tweak: Removed the “Integration Method” option for Elementor forms. It will now load globally but has an option to choose where scripts are loaded. * Tweak: Small tweaks to the settings page. * Tweak: Added a copy button for the debug log. * Fix: Fixed a new issue some websites were experiencing with WooCommerce block checkout not working with Turnstile. * Fix: Fixed an error “attempt to read property success on null” showing in some cases. * Fix: Fixed the widget label not showing in some cases, on the comments form. * Fix: Fixed WooCommerce checkout in some cases not re-rendering Turnstile after payment errors. It should now re-render correctly in all cases to prevent Turnstile errors. * Fix: Fixed an issue with Forminator forms when using file upload fields. #### Version 1.36.1 – 31st December 2025 * Fix: Fixed an issue with the disable submit feature not working in some cases. #### Version 1.36.0 – 30th December 2025 * New: Added new “Failsafe Mode” option in the advanced settings. * New: Added the ability to enable and set a custom “widget label text” that is shown above the Turnstile widget. * New: Added an option to enable “Resource Hint (Preconnect)” in the advanced settings. * Tweak: Improved the code for getting the user IP address for the Turnstile verification request. Helps with certain server setups and proxy services. * Tweak: Changed Turnstile default render to “auto” instead of “explicit”. * Tweak: Removed the user ID check on WordPress login Turnstile check, so it still runs if the username is invalid. * Tweak: Added “header” info to the debug log entries. * Fix: Fixed an issue with Kadence Forms integration in some cases. #### Version 1.35.0 – 27th October 2025 * New: Improvement to Elementor integration to work better with Elementor element caching. * New: Added new “Integration Method” for the Elementor integration. The “Load Scripts Globally” option may work better for certain types of caching. * Tweak: Updated the Elementor JS code from using jQuery to vanilla JS. * Tweak: Added an option in the “Advanced Settings” to toggle “Performance Plugin Compatibility”. * Tweak: Ultimate Member forms now have a unique fixed ID instead of a random one each time. * Tweak: For WooCommerce checkout, added an alternative check for duplicate execution within a single request. * Tweak: Made some changes to the settings page, updated the setup guide link, and updated donation/sponsor details. * Fix: Fixed an issue with Turnstile being ignored by certain payment methods like PayPal express, in some cases. * Fix: Fixed an issue when the “WordPress Login” option is enabled, but “WooCommerce Login” is disabled, the WooCommerce login still gave a verification failed error. #### Version 1.34.3 – 16th October 2025 * Fix: Fixed an issue with some express payment methods. These will now automatically skip the Turnstile check preventing the error message from showing. #### Version 1.34.2 – 15th October 2025 * Fix: Fixed an issue with WooCommerce checkout in some cases. #### Version 1.34.1 – 10th October 2025 * Fix: Fixed an issue with custom login forms causing an error since version 1.34.0. * Fix: Fixed an issue with the “Extra Failure Message” when using quotes in the text. #### Version 1.34.0 – 9th October 2025 * New: Added ability to define the Site Key and Secret Key in the wp-config.php file, using the constants “CF_TURNSTILE_SITE_KEY” and “CF_TURNSTILE_SECRET_KEY”. This is useful for developers, or if you want to prevent the keys from being changed in the admin settings page. * New: Added an export/import tool to the settings page, to allow you to easily export your settings and import them on another website. * Tweak: Updated the WooCommerce checkout “cfturnstile_checkout_checked” session to clear in more cases to prevent potential issues. * Fix: Added better support for smart payment buttons on WooCommerce checkout, to prevent Turnstile from blocking the checkout in some cases. * Fix: Fixed an issue with the “Pay for Order” page when using block checkout. * Fix: Fixed an issue with the wp_login_form() function integration. #### Version 1.33.1 – 5th September 2025 * Other: Renamed the plugin from “Simple Cloudflare Turnstile” to “Simple CAPTCHA Alternative with Cloudflare Turnstile” due to trademark guidelines. #### Version 1.33.0 – 4th September 2025 * Tweak: Added some better compatibility with certain performance plugins that may be minifying/delaying JavaScript and causing issues with Turnstile loading. * Fix: Potential fix for some websites experiencing issues with Elementor forms. #### Version 1.32.3 – 21st August 2025 * Fix: Fixed an issue with the CheckoutWC integration. #### Version 1.32.2 – 7th August 2025 * Fix: Fixed an issue with the Turnstile widget on Elementor forms always being forced to dark mode. * Fix: Fixed an issue with Turnstile rendering twice on CheckoutWC checkout page in some cases. #### Version 1.32.1 – 7th August 2025 * Improvement: Improved the CheckoutWC integration ([#53](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/53)). * Tweak: Added missing MailPoet JS callback for the disable submit button. * Fix: Fixed a error in the woocommerce.js file. #### Version 1.32.0 – 7th July 2025 * New: Added support for the “WP User Manager” plugin. * Improvement: Fixed the Elementor integration (contact forms, login form, and popups) and made some improvements to the code. * Tweak: Added a check to see if the Turnstile script has already been enqueued. * Fix: Fixed an issue with some ajax form plugins, where the Turnstile widget was re-rending duplicates each time there was a failed submission. * Fix: Fixed a potential PHP error with the WP login. #### Version 1.31.0 – 27th May 2025 * New: Added support for the wp_login_form() function, so Turnstile can be added to the login form generated by this function. * Tweak: Made a few design tweaks to the admin settings page. * Fix: Change from gform_pre_submission to gform_validation hook for Gravity Forms integration. ([#40](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/40)). * Fix: Fixed “wp is not defined” error on WooCommerce checkout in some cases. #### Version 1.30.0 – 12th February 2025 * New: Added Kadence Forms integration. * New: Added MailPoet integration. * Fix: Fixed “Cannot read properties of null (reading ‘dataset’)” error with WooCommerce block checkout. * Fix: Fixed an issue with Turnstile loading twice in some cases. * Fix: Fixed an issue with the “Disable Submit Button” option not working. * Fix: Gravity Forms integration rerender on validation. ([#38](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/38)). * Tested with WordPress 6.7.2 * Tested with WooCommerce 9.6.1 #### Version 1.29.0 – 14th January 2025 * New: Added Jetpack Forms integration. ([#30](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/30)). #### Version 1.28.1 – 13th January 2025 * Fix: Fixed a undefined array key “error_code” error showing in some cases. * Fix: Fix CheckoutWC implementation. ([#33](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/33)). * Fix: Fix warning when cf-turnstile-response not present in Fluent Forms. ([#32](https://github.com/ElliotSowersby/simple-cloudflare-turnstile/pull/32)). #### Version 1.28.0 – 17th December 2024 * New: Added Checkout block and Store API support. (Thanks [@senadir](https://github.com/senadir)) * Fix: Fixed an issue with Turnstile re-rendering when it does not need to in some cases, on WooCommerce checkout. * Other: Tested with WooCommerce 9.4.3 #### Version 1.27.1 – 10th November 2024 * New: Added a “Widget Size” option to the advanced settings section. * Tweak: Moved the “Appearance Mode” option to the advanced settings section. * Tweak: Added support for Elementor PRO Elements. * Tweak: Added the new supported languages. * Fix: Fixed a “WPCF7_TagGenerator::add()” error with the Contact Form 7 integration. * Fix: Prevent Turnstile from showing on the order received page in some cases, such as with the CheckoutWC plugin. * Other: Tested with WordPress 6.7.0 * Other: Tested with WooCommerce 9.3.3 #### Version 1.27.0 – 7th August 2024 * New: Added a new option in the admin settings page to “enable debug logging of Turnstile form submission events”. This will add a log event every time a form is submitted with Turnstile enabled, and display the log at the bottom of the settings page. * Fix: Fixed issue with Turnstile not rendering on Elementor popup forms. * Fix: Fixed issue with Turnstile not resetting properly on Contact Form 7 causing it to display twice on submission error. * Fix: Fixed issue with Turnstile showing twice in some cases. #### Version 1.26.6 – 27th July 2024 * Fix: Fixed issue with Turnstile showing twice on Forminator forms in some cases. #### Version 1.26.5 – 26th July 2024 * Fix: Fixed issue with Turnstile showing twice on Elementor forms. #### Version 1.26.4 – 26th July 2024 * Fix: Tweak to help prevent some new rare cases where the Turnstile widget was being shown twice in some cases. * Fix: Fixed an issue with the WooCommerce password reset form when using a hide admin login URL plugin like “WPS Hide Login”. * Other: Tested with WordPress 6.6.1 #### Version 1.26.3 – 18th July 2024 * Tweak: Added a message to state that it is not currently compatible with WooCommerce“ block-based” checkout. * Fix: Fixed an issue with not being able to save the WP Forms integration settings if using the Pro version of WP Forms. * Other: Tested with WordPress 6.6.0 * Other: Tested with WooCommerce 9.1.2 #### Version 1.26.2 – 8th May 2024 * Fix: Fixed an issue with the new “ONLY enable for these Membership IDs” option with the MemberPress integration. #### Version 1.26.0 – 8th May 2024 * New: Added option to whitelist certain “User Agents” in the “Whitelist Settings” section to the settings page. * Tweak: Made a few small changes to the admin settings page. * Dev: Added a filter (“cfturnstile_widget_disable”) to allow skipping Turnstile check and hiding the Turnstile widget programmatically. * Code Fork: auutstudio/simple-cloudflare-turnstile-sometimes — New: Added an option to only show Turnstile on specific MemberPress registration forms, based on a declared list of Membership Product IDs. — Tweak: Clarify that the Whitelist IP option does not support wildcards. — Tweak: Clarify that WPForms has a redundant place in its own settings to configure Turnstile. #### Version 1.25.0 – 7th November 2023 * New: Added compatibility with the “Clean Login” plugin. * New: Added an option to only show Turnstile on the default WordPress login and registration form, and not on any other similar forms added by plugins. This is enabled by default for new installs. * New: Added a new “Extra Failure Message” option, in advanced settings, which will show a custom notice to the user, under the widget, if the Turnstile challenge fails. * New: Added a new “Defer Scripts” option, in advanced settings, to decide whether the javascript files will be deferred or not. This is enabled by default. * Tweak: Modified the code for WooCommerce login check. * Tweak: Added some information about other form plugins that are not currently supported by our plugin, if they are installed. * Tweak: Removed 100ms delay on Turnstile widget render. * Tweak: Added an “Advanced Settings” tab to the settings page, and moved some settings into there. * Tweak: A few small changes to the admin settings page. * Tweak: The “Language” setting is now ordered alphabetically. * Tweak: Improvements to the Blocksy integration. * Fix: Fixed a compatibility issue with the EDD Auto Register plugin. * Dev: Moved around some of the plugin code into different files. * Dev: Added some filters for the WP Login and WP Register check functions. * Other: Tested with WordPress 6.4.0 #### Version 1.24.0 – 9th October 2023 * New: Added integration with the “Paid Memberships Pro” plugin. #### Version 1.23.3 – 4th October 2023 * Tweak: Added some additional sanitization and escaping to the plugin code, as an extra security precaution, and to meet WordPress coding standards better. * Tweak: Added a class to the line break displayed below the Turnstile widget, so it can be hidden or edited with CSS if needed. * Fix: Fixed issue with Turnstile not loading on WooCommerce checkout login form in some cases. #### Version 1.23.2 – 22nd September 2023 * Fix: Fixed a security vulnerability with the Gravity Forms integration. * Tweak: Minified the inline scripts on Contact Form 7 and Gravity Forms integrations. * Tweak: Small tweak to styles on wp-login.php page in some cases. * Other: Tested with WordPress 6.3.1 * Other: Tested with WooCommerce 8.1.1 #### Version 1.23.1 – 24th August 2023 * Fix: Fixed an issue with “Payment Methods to Skip” toggle on settings page. #### Version 1.23.0 – 24th August 2023 * New: Added “Whitelist Settings” section to the settings page, with options to whitelist logged in users, or certain IP addresses. * New: Added support/integration for the CheckoutWC plugin. * Tweak: Turnstile will now be disabled on all forms until the “Test Response” is successfully completed on the settings page. An admin error message will now show if the keys are set but the test is not complete. * Tweak: If Turnstile returns error code “invalid-input-secret” at any point, it will automatically disable itself and requires a “Test Response” to be completed again in the settings page. * Tweak: Modified … ## Meta * Versão **1.44.0** * Última atualização **2 semanas atrás** * Instalações ativas **200.000+** * Versão do WordPress ** 4.7 ou superior ** * Testado até **7.1.3** * Idiomas * [Chinese (Taiwan)](https://tw.wordpress.org/plugins/simple-cloudflare-turnstile/), [Croatian](https://hr.wordpress.org/plugins/simple-cloudflare-turnstile/), [Czech](https://cs.wordpress.org/plugins/simple-cloudflare-turnstile/), [Dutch](https://nl.wordpress.org/plugins/simple-cloudflare-turnstile/), [English (US)](https://wordpress.org/plugins/simple-cloudflare-turnstile/), [Galician](https://gl.wordpress.org/plugins/simple-cloudflare-turnstile/), [Greek](https://el.wordpress.org/plugins/simple-cloudflare-turnstile/), [Japanese](https://ja.wordpress.org/plugins/simple-cloudflare-turnstile/), [Korean](https://ko.wordpress.org/plugins/simple-cloudflare-turnstile/), [Russian](https://ru.wordpress.org/plugins/simple-cloudflare-turnstile/), [Serbian](https://sr.wordpress.org/plugins/simple-cloudflare-turnstile/), [Spanish (Chile)](https://cl.wordpress.org/plugins/simple-cloudflare-turnstile/), [Spanish (Mexico)](https://es-mx.wordpress.org/plugins/simple-cloudflare-turnstile/), [Spanish (Spain)](https://es.wordpress.org/plugins/simple-cloudflare-turnstile/), [Turkish](https://tr.wordpress.org/plugins/simple-cloudflare-turnstile/) e [Vietnamese](https://vi.wordpress.org/plugins/simple-cloudflare-turnstile/). * [Traduzir para seu idioma](https://translate.wordpress.org/projects/wp-plugins/simple-cloudflare-turnstile) * Tags * [captcha](https://br.wordpress.org/plugins/tags/captcha/)[cloudflare](https://br.wordpress.org/plugins/tags/cloudflare/) [protect](https://br.wordpress.org/plugins/tags/protect/)[spam](https://br.wordpress.org/plugins/tags/spam/) [turnstile](https://br.wordpress.org/plugins/tags/turnstile/) * [Visualização avançada](https://br.wordpress.org/plugins/simple-cloudflare-turnstile/advanced/) ## Classificações 4.6 de 5 estrelas. * [ 225 avaliações com 5 estrelas ](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/?filter=5) * [ 9 avaliações com 4 estrelas ](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/?filter=4) * [ 7 avaliações com 3 estrelas ](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/?filter=3) * [ 4 avaliações com 2 estrelas ](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/?filter=2) * [ 14 avaliações com 1 estrelas ](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/?filter=1) [Sua avaliação](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/#new-post) [Ver todas avaliações](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/reviews/) ## Colaboradores * [ Elliot Sowersby / RelyWP ](https://profiles.wordpress.org/elliotvs/) * [ RelyWP ](https://profiles.wordpress.org/relywp/) ## Suporte Problemas resolvidos nos últimos dois meses: 29 de 43 [Ver fórum de suporte](https://wordpress.org/support/plugin/simple-cloudflare-turnstile/) ## Doar Gostaria de contribuir para o desenvolvimento deste plugin? [ Doe para este plugin ](https://www.elliotsowersby.com/donate/)