Alexandre Alves

<p>This plugin adds <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a> — a free, privacy-friendly CAPTCHA alternative — to your WordPress site.</p>
<p>Its key difference from other Turnstile plugins is <strong>per-form control for Elementor Pro</strong>: instead of toggling Turnstile globally for every Elementor form, you add a <strong>“Cloudflare Turnstile” field</strong> to the specific forms you want to protect, exactly like Elementor’s built-in reCAPTCHA field. Forms without the field are left untouched. If you prefer the all-at-once approach, an optional setting protects <strong>every</strong> Elementor Pro form automatically.</p>
<h4>Features</h4>
<ul>
<li><strong>Per-form Turnstile field for Elementor Pro Forms</strong> — drag it into the forms you choose.</li>
<li><strong>Optional “all Elementor Pro forms” switch</strong> — protect every Elementor Pro form at once, without adding the field to each one (off by default).</li>
<li>Optional protection for the built-in WordPress forms:
<ul>
<li>Login</li>
<li>Registration</li>
<li>Lost password</li>
<li>Comments</li>
</ul>
</li>
<li>One-click import of keys and settings from the “Simple Cloudflare Turnstile” plugin (no need to recreate your Cloudflare keys).</li>
<li>Global widget appearance settings (theme, size, visibility, language).</li>
<li>Strict server-side token verification (single-use tokens, 5-minute validity).</li>
<li>Secure-by-default behaviour: missing/invalid tokens are always blocked; the<br />
behaviour when Cloudflare itself is unreachable is configurable.</li>
<li>Write-only secret key (never displayed or sent to the browser).</li>
<li>Lightweight: in the default per-form mode, the Cloudflare script loads only on pages that actually show a widget. (The optional “all forms” mode loads it across the front end so late-loaded forms are covered.)</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>The Elementor field requires <strong>Elementor Pro</strong> (the Forms widget is a Pro feature). Without Elementor Pro, the WordPress form integrations still work.</li>
<li>A free Cloudflare Turnstile site key and secret key.</li>
</ul>
<h4>Third-party service</h4>
<p>This plugin renders the official Cloudflare Turnstile widget and verifies tokens with Cloudflare.</p>
<ul>
<li>When a protected form is displayed, the visitor’s browser loads <code>https://challenges.cloudflare.com/turnstile/v0/api.js</code> from Cloudflare.</li>
<li>
<p>When a protected form is submitted, your server sends a request to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> containing: the Turnstile token from the widget (<code>cf-turnstile-response</code>), your secret key, and — unless disabled with the <code>cwebts_remoteip</code> filter — the visitor’s IP address (<code>REMOTE_ADDR</code>). The secret key is never sent to the browser.</p>
</li>
<li>
<p>Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/</p>
</li>
<li>Terms of Service: https://www.cloudflare.com/website-terms/</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>About the name</h4>
<p>The distinctive part of the name is <strong>CWeb Form Protection</strong>, after <strong>Collectif WEB</strong>, the agency that maintains this plugin. The trailing “with Turnstile for Elementor Forms” only describes what the plugin integrates with: “Turnstile” is the Cloudflare service it uses, and “for Elementor Forms” signals compatibility with Elementor’s Forms widget. This plugin is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. or Elementor Ltd.</p>
<h4>Trademarks</h4>
<p>Not affiliated with Cloudflare, Inc. or Elementor Ltd. “Cloudflare” and “Turnstile” are trademarks of Cloudflare, Inc. “Elementor” is a trademark of Elementor Ltd. These names are used only to describe compatibility.</p>


CWeb Form Protection with Turnstile for Elementor Forms

Add Cloudflare Turnstile to your forms — with a per-form field for Elementor Pro so you choose exactly which forms are protected.

timh

bostonwebgroup

<p>BWG CF Turnstile integrates Cloudflare’s Turnstile service with Gravity Forms to provide an effective and user-friendly way to block spam and bot submissions. Turnstile is Cloudflare’s privacy-focused alternative to CAPTCHA that offers better user experience while still providing strong protection.</p>
<h3>Features</h3>
<ul>
<li><strong>Automatic Integration</strong>: Adds Turnstile protection to all your Gravity Forms or just the ones you select</li>
<li><strong>Manual Mode</strong>: For custom placement of the Turnstile widget within your forms</li>
<li><strong>Server-Side Validation</strong>: Securely validates submissions with Cloudflare’s API</li>
<li><strong>Theme Compatibility</strong>: Works with all Gravity Forms themes, including Orbital</li>
<li><strong>Easy Setup</strong>: Simple configuration with minimal settings</li>
</ul>
<h3>Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>Gravity Forms 2.4 or higher</li>
<li>A Cloudflare account to obtain Turnstile site and secret keys</li>
</ul>
<h3>Privacy Considerations</h3>
<p>Cloudflare Turnstile is designed with privacy in mind. Unlike traditional CAPTCHA services, Turnstile is designed to respect user privacy while still providing effective protection. For more information about Turnstile’s privacy practices, please refer to <a href="https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/" rel="nofollow ugc">Cloudflare’s documentation</a>.</p>
<h3>External Services</h3>
<p>This plugin integrates with Cloudflare Turnstile, an external service provided by Cloudflare. The plugin communicates with Cloudflare’s services for form protection functionality.</p>
<h3>What is Cloudflare Turnstile?</h3>
<p>Cloudflare Turnstile is a privacy-preserving alternative to CAPTCHAs that helps protect forms from bots and automated attacks. It challenges visitors in a way that doesn’t disrupt the user experience.</p>
<h3>When does this plugin connect to Cloudflare?</h3>
<ol>
<li>
<p><strong>JavaScript Widget Loading</strong>: When a page containing a protected Gravity Form is loaded, the plugin loads the Turnstile JavaScript widget from <code>https://challenges.cloudflare.com/turnstile/v0/api.js</code>. This happens on every page load where a protected form is displayed.</p>
</li>
<li>
<p><strong>Token Verification</strong>: When a form is submitted, the plugin sends a verification request to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> to validate the Turnstile token.</p>
</li>
</ol>
<h3>What data is sent to Cloudflare?</h3>
<ol>
<li>
<p><strong>During Widget Loading</strong>:</p>
<ul>
<li>Your site key (public identifier)</li>
<li>Standard browser information (user agent, IP address)</li>
</ul>
</li>
<li>
<p><strong>During Token Verification</strong>:</p>
<ul>
<li>The Turnstile response token</li>
<li>Your secret key (for authentication)</li>
<li>The user’s IP address (optional, for additional validation)</li>
</ul>
</li>
</ol>
<h3>Legal and Privacy Information</h3>
<p>By using this plugin, you agree to Cloudflare’s terms and privacy policies:<br />
– <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Service</a><br />
– <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a><br />
– <a href="https://developers.cloudflare.com/turnstile/" rel="nofollow ugc">Cloudflare Turnstile Documentation</a></p>
<p>It is your responsibility to ensure that your use of this plugin complies with all applicable laws and regulations, including data protection laws in your jurisdiction. We recommend reviewing Cloudflare’s privacy policy and terms of service, and updating your own privacy policy to inform users about the use of Cloudflare Turnstile on your website.</p>


BWG CF Turnstile

Add Cloudflare Turnstile protection to your Gravity Forms to prevent spam and bot submissions.

CWeb Form Protection with Turnstile for Elementor Forms vs BWG CF Turnstile