Alexandre Alves

<p>This plugin adds <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a> — a free, privacy-friendly CAPTCHA alternative — to your WordPress site.</p>
<p>Its key difference from other Turnstile plugins is <strong>per-form control for Elementor Pro</strong>: instead of toggling Turnstile globally for every Elementor form, you add a <strong>“Cloudflare Turnstile” field</strong> to the specific forms you want to protect, exactly like Elementor’s built-in reCAPTCHA field. Forms without the field are left untouched. If you prefer the all-at-once approach, an optional setting protects <strong>every</strong> Elementor Pro form automatically.</p>
<h4>Features</h4>
<ul>
<li><strong>Per-form Turnstile field for Elementor Pro Forms</strong> — drag it into the forms you choose.</li>
<li><strong>Optional “all Elementor Pro forms” switch</strong> — protect every Elementor Pro form at once, without adding the field to each one (off by default).</li>
<li>Optional protection for the built-in WordPress forms:
<ul>
<li>Login</li>
<li>Registration</li>
<li>Lost password</li>
<li>Comments</li>
</ul>
</li>
<li>One-click import of keys and settings from the “Simple Cloudflare Turnstile” plugin (no need to recreate your Cloudflare keys).</li>
<li>Global widget appearance settings (theme, size, visibility, language).</li>
<li>Strict server-side token verification (single-use tokens, 5-minute validity).</li>
<li>Secure-by-default behaviour: missing/invalid tokens are always blocked; the<br />
behaviour when Cloudflare itself is unreachable is configurable.</li>
<li>Write-only secret key (never displayed or sent to the browser).</li>
<li>Lightweight: in the default per-form mode, the Cloudflare script loads only on pages that actually show a widget. (The optional “all forms” mode loads it across the front end so late-loaded forms are covered.)</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>The Elementor field requires <strong>Elementor Pro</strong> (the Forms widget is a Pro feature). Without Elementor Pro, the WordPress form integrations still work.</li>
<li>A free Cloudflare Turnstile site key and secret key.</li>
</ul>
<h4>Third-party service</h4>
<p>This plugin renders the official Cloudflare Turnstile widget and verifies tokens with Cloudflare.</p>
<ul>
<li>When a protected form is displayed, the visitor’s browser loads <code>https://challenges.cloudflare.com/turnstile/v0/api.js</code> from Cloudflare.</li>
<li>
<p>When a protected form is submitted, your server sends a request to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> containing: the Turnstile token from the widget (<code>cf-turnstile-response</code>), your secret key, and — unless disabled with the <code>cwebts_remoteip</code> filter — the visitor’s IP address (<code>REMOTE_ADDR</code>). The secret key is never sent to the browser.</p>
</li>
<li>
<p>Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/</p>
</li>
<li>Terms of Service: https://www.cloudflare.com/website-terms/</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>About the name</h4>
<p>The distinctive part of the name is <strong>CWeb Form Protection</strong>, after <strong>Collectif WEB</strong>, the agency that maintains this plugin. The trailing “with Turnstile for Elementor Forms” only describes what the plugin integrates with: “Turnstile” is the Cloudflare service it uses, and “for Elementor Forms” signals compatibility with Elementor’s Forms widget. This plugin is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. or Elementor Ltd.</p>
<h4>Trademarks</h4>
<p>Not affiliated with Cloudflare, Inc. or Elementor Ltd. “Cloudflare” and “Turnstile” are trademarks of Cloudflare, Inc. “Elementor” is a trademark of Elementor Ltd. These names are used only to describe compatibility.</p>


CWeb Form Protection with Turnstile for Elementor Forms

Add Cloudflare Turnstile to your forms — with a per-form field for Elementor Pro so you choose exactly which forms are protected.

Md Taufiqur Rahman

realitsolution

<p><strong>RIS Cloudflare CAPTCHA</strong> adds the modern, privacy-first <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a> CAPTCHA to your WordPress site. Stop bots, spam comments, and brute-force login attacks without annoying your visitors with image puzzles or Google reCAPTCHA.</p>
<p>Unlike legacy CAPTCHAs, Cloudflare Turnstile runs completely in the background, never asks visitors to click traffic lights or type distorted text, and protects visitor privacy.</p>
<h4>Why Choose RIS Cloudflare CAPTCHA?</h4>
<ul>
<li><strong>Privacy-friendly</strong> – No user tracking, no cookies, no personal data collection.</li>
<li><strong>User-friendly</strong> – Most visitors never see a challenge; it’s invisible by default.</li>
<li><strong>Lightweight</strong> – Tiny footprint, no external dependencies, no bloated JS bundles.</li>
<li><strong>Free</strong> – Powered by Cloudflare Turnstile, which is 100% free for unlimited use.</li>
<li><strong>Universal</strong> – Protects WordPress login, registration, comment, lost-password, and WPForms.</li>
<li><strong>Developer-friendly</strong> – Shortcode, PHP function, and a verification filter for custom forms.</li>
<li><strong>Multilingual</strong> – Supports 11 widget languages including English, Spanish, French, German, Bengali, Hindi, Arabic, Chinese, Japanese, and more.</li>
<li><strong>Customizable</strong> – Light, dark, or auto theme; visible, invisible, or interaction-only mode.</li>
</ul>
<h4>Features</h4>
<ul>
<li>Drop-in Turnstile widget on:
<ul>
<li>WordPress login form</li>
<li>WordPress registration form</li>
<li>WordPress lost password form</li>
<li>WordPress comment form</li>
<li>WPForms (all forms)</li>
</ul>
</li>
<li>Server-side token verification for every form (not just client-side).</li>
<li>Secure nonce checks on every form submission.</li>
<li><strong>Test Connection</strong> button to instantly verify your API keys.</li>
<li>Per-form enable/disable checkboxes.</li>
<li>Light, dark, or auto theme matching.</li>
<li>Visible, invisible (“execute”), or interaction-only appearance.</li>
<li>Custom widget language selection.</li>
<li>Tabbed admin settings page (Settings / Help / About).</li>
<li>Shortcode: <code>[ris_turnstile action="contact"]</code> for custom forms.</li>
<li>Developer filter: <code>ris_cf_captcha_verify_response</code> for custom verification.</li>
<li>Full uninstall cleanup (deletes all options on plugin removal).</li>
<li>Multisite compatible.</li>
<li>Translation ready (.pot, /languages folder).</li>
<li>Proper WordPress coding standards, sanitization, escaping, and capability checks.</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and activate the plugin.</li>
<li>Get free Turnstile keys from your <a href="https://dash.cloudflare.com/?to=/:account/turnstile" rel="nofollow ugc">Cloudflare Dashboard</a>.</li>
<li>Paste your Site Key and Secret Key into the plugin settings.</li>
<li>Tick the forms you want to protect.</li>
<li>Save. Done.</li>
</ol>
<h4>Shortcode</h4>
<p>Use the widget on any page or custom form:</p>
<pre><code>[ris_turnstile action="contact"]
</code></pre>
<p>Or in PHP:</p>
<pre><code><?php echo do_shortcode( '[ris_turnstile]' ); ?>
</code></pre>
<h4>Custom Form Verification (Developers)</h4>
<p>Hook into the verification filter:</p>
<pre><code>add_filter( 'ris_cf_captcha_verify_response', function( $is_valid, $token, $ip ) {
 // Your custom checks here.
 return $is_valid;
}, 10, 3 );
</code></pre>
<h4>Privacy</h4>
<p>This plugin:<br />
* Does <strong>not</strong> set any cookies.<br />
* Does <strong>not</strong> track users.<br />
* Does <strong>not</strong> store any personal data.<br />
* Sends the visitor’s IP address to Cloudflare only for the verification request, as required by the Turnstile API.<br />
* Does <strong>not</strong> send any data to any third party other than Cloudflare.</p>
<p>GDPR, CCPA, and privacy-law friendly.</p>
<h4>Related Plugins</h4>
<ul>
<li>Real IT Solution – <a href="https://www.realitsolution.com/" rel="nofollow ugc">https://www.realitsolution.com/</a></li>
</ul>
<h3>Credits</h3>
<ul>
<li>Developed by <a href="https://www.realitsolution.com/" rel="nofollow ugc">Real IT Solution</a> – Md Taufiqur Rahman.</li>
<li>Powered by <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a>.</li>
<li>Icons by <a href="https://developer.wordpress.org/resource/dashicons/" rel="nofollow ugc">WordPress Dashicons</a>.</li>
</ul>
<h3>Support</h3>
<ul>
<li>Documentation: <a href="https://wordpress.org/plugins/ris-cloudflare-captcha/" rel="ugc">https://wordpress.org/plugins/ris-cloudflare-captcha/</a></li>
<li>Support forum: <a href="https://wordpress.org/support/plugin/ris-cloudflare-captcha/" rel="ugc">https://wordpress.org/support/plugin/ris-cloudflare-captcha/</a></li>
<li>Author website: <a href="https://www.realitsolution.com/" rel="nofollow ugc">https://www.realitsolution.com/</a></li>
</ul>


RIS Cloudflare CAPTCHA – Cloudflare Turnstile

Privacy-friendly Cloudflare Turnstile CAPTCHA for WordPress login, registration, comments & WPForms. Stops bots and spam.

CWeb Form Protection with Turnstile for Elementor Forms vs RIS Cloudflare CAPTCHA – Cloudflare Turnstile