How To Add Cloudflare Turnstile To WordPress

Sopriza

Cloudflare Turnstile is a CAPTCHA alternative that helps protect WordPress websites from bots, spam submissions, and automated abuse without requiring users to solve image puzzles. It can be integrated into WordPress forms, login pages, registration pages, and comment sections using plugins or custom code.

Create A Cloudflare Turnstile Site Key

Before adding Turnstile to WordPress, you need a Cloudflare account and Turnstile API keys.

Follow these steps:

Log in to your Cloudflare dashboard.
Open Turnstile from the security section.
Click Add Site.
Enter your website domain.
Choose a widget mode:
- Managed
- Non-interactive
- Invisible
Copy the generated:
- Site Key
- Secret Key

The site key is used on your website, while the secret key verifies requests on the server.

Install A Turnstile WordPress Plugin

The easiest method is using a plugin that supports Cloudflare Turnstile.

Popular options include plugins that integrate Turnstile with:

WordPress login forms
Registration forms
Comment forms
Password reset pages
WooCommerce forms
Contact forms

After installing a compatible plugin:

Go to Plugins → Add New.
Search for a Cloudflare Turnstile plugin.
Install and activate it.
Enter your Site Key and Secret Key.
Enable protection for the required forms.

Add Turnstile Manually In WordPress

For developers who want full control, Turnstile can be added directly using WordPress hooks.

First, add the Turnstile JavaScript file.

Add this to your theme’s functions.php file or a custom plugin:

function add_turnstile_script() {
    wp_enqueue_script(
        'cloudflare-turnstile',
        'https://challenges.cloudflare.com/turnstile/v0/api.js',
        array(),
        null,
        true
    );
}
add_action('wp_enqueue_scripts', 'add_turnstile_script');

Add The Turnstile Widget To A Form

Place the Turnstile widget where you want it displayed.

Replace YOUR_SITE_KEY with your Cloudflare site key.

<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

The widget will automatically load and generate a verification token.

Verify Turnstile Responses In WordPress

The token must be checked on the server before accepting a form submission.

Example verification code:

function verify_turnstile_response($token) {

    $secret_key = 'YOUR_SECRET_KEY';

    $response = wp_remote_post(
        'https://challenges.cloudflare.com/turnstile/v0/siteverify',
        array(
            'body' => array(
                'secret' => $secret_key,
                'response' => $token
            )
        )
    );

    $result = json_decode(
        wp_remote_retrieve_body($response),
        true
    );

    return !empty($result['success']);
}

Protect WordPress Login Form

To add Turnstile verification to the WordPress login page, use the login form hooks.

Add the widget:

function add_turnstile_login_field() {
    echo '<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>';
}

add_action(
    'login_form',
    'add_turnstile_login_field'
);

Then verify the response before allowing login:

function check_turnstile_login($user, $password) {

    if (!empty($_POST['cf-turnstile-response'])) {

        $verified = verify_turnstile_response(
            $_POST['cf-turnstile-response']
        );

        if (!$verified) {
            return new WP_Error(
                'turnstile_failed',
                'Security verification failed.'
            );
        }
    }

    return $user;
}

add_filter(
    'authenticate',
    'check_turnstile_login',
    30,
    3
);

Protect WordPress Comments

Turnstile can also reduce spam comments by requiring verification before submission.

Add the widget:

function add_turnstile_comments() {

    echo '<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>';

}

add_action(
    'comment_form_after_fields',
    'add_turnstile_comments'
);

Important Security Considerations

Turnstile should always be verified on the server side. Adding only the visible widget does not provide protection because attackers can bypass client-side checks.

Best practices include:

Keep your secret key private
Use HTTPS on your website
Test forms after installation
Avoid placing secret keys inside frontend code
Combine Turnstile with WordPress security updates and spam protection

Troubleshooting Turnstile Issues

Common problems include:

Widget not appearing: Check that the JavaScript file loads correctly.
Verification failures: Confirm the domain and keys match.
Caching problems: Clear WordPress and CDN caches after changes.
Plugin conflicts: Temporarily disable other CAPTCHA or security plugins.

Join The Discussion

Have you added Cloudflare Turnstile to WordPress, or are you still using traditional CAPTCHA systems? Share your experience with spam protection, security plugins, and the methods that work best for your website.