Aneesh MK

<p><strong>Cybernob Turnstile for Cloudflare</strong> integrates <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a> into your WordPress site — the privacy-friendly CAPTCHA that stops bots silently, without making real users solve puzzles.</p>
<p>This plugin is an independent, third-party integration and is not affiliated with or endorsed by Cloudflare, Inc.</p>
<h4>Protected locations</h4>
<ul>
<li><strong>Login form</strong> — blocks brute-force and credential-stuffing attacks</li>
<li><strong>Registration form</strong> — prevents automated account creation</li>
<li><strong>Comment form</strong> — stops spam comments without Akismet</li>
<li><strong>Contact Form 7</strong> — automatically protects every CF7 form on your site</li>
</ul>
<h4>Features</h4>
<ul>
<li><strong>Live status checker</strong> — the settings page shows instantly whether your API keys are valid and reachable</li>
<li><strong>Invisible mode</strong> — widget stays hidden; the form auto-submits once the challenge passes silently</li>
<li><strong>Three themes</strong> — Auto (follows system preference), Light, Dark</li>
<li><strong>Two appearance modes</strong> — Always visible, or show on interaction only</li>
<li><strong>Clean uninstall</strong> — all plugin options are removed on deletion, including multisite support</li>
<li><strong>Translation ready</strong> — all strings wrapped in i18n functions with the correct text domain</li>
<li><strong>No bundled libraries</strong> — only Cloudflare’s own CDN script is used; nothing extra added to your site</li>
</ul>
<h4>Why Turnstile?</h4>
<p>Unlike reCAPTCHA, Cloudflare Turnstile does not track users across sites or require Google accounts. It is designed to be GDPR-friendly and invisible to legitimate users by default.</p>
<h4>Getting started</h4>
<ol>
<li>Create a free <a href="https://dash.cloudflare.com/?to=/:account/turnstile" rel="nofollow ugc">Cloudflare Turnstile</a> site widget</li>
<li>Copy your <strong>Site Key</strong> and <strong>Secret Key</strong></li>
<li>Paste them into <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Cybernob Turnstile</strong> and save</li>
<li>The live status indicator confirms everything is working</li>
</ol>
<h3>External Services</h3>
<p>This plugin connects to Cloudflare’s Turnstile service to display CAPTCHA challenges and verify user responses.</p>
<ul>
<li><strong>Service:</strong> Cloudflare Turnstile</li>
<li><strong>When used:</strong> When a protected form is loaded (widget script) or submitted (token verification). Only active after the administrator has entered API keys in the plugin settings.</li>
<li><strong>Data sent:</strong> On verification — the Turnstile response token and the visitor’s IP address are sent to Cloudflare’s API endpoint.</li>
<li><strong>Endpoint:</strong> https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
</ul>
<p><a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Service</a> | <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a></p>


Cybernob Turnstile for Cloudflare

Lightweight Cloudflare Turnstile CAPTCHA protection for WordPress login, registration, comments, and Contact Form 7.

Alexandre Alves

<p>This plugin adds <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a> — a free, privacy-friendly CAPTCHA alternative — to your WordPress site.</p>
<p>Its key difference from other Turnstile plugins is <strong>per-form control for Elementor Pro</strong>: instead of toggling Turnstile globally for every Elementor form, you add a <strong>“Cloudflare Turnstile” field</strong> to the specific forms you want to protect, exactly like Elementor’s built-in reCAPTCHA field. Forms without the field are left untouched. If you prefer the all-at-once approach, an optional setting protects <strong>every</strong> Elementor Pro form automatically.</p>
<h4>Features</h4>
<ul>
<li><strong>Per-form Turnstile field for Elementor Pro Forms</strong> — drag it into the forms you choose.</li>
<li><strong>Optional “all Elementor Pro forms” switch</strong> — protect every Elementor Pro form at once, without adding the field to each one (off by default).</li>
<li>Optional protection for the built-in WordPress forms:
<ul>
<li>Login</li>
<li>Registration</li>
<li>Lost password</li>
<li>Comments</li>
</ul>
</li>
<li>One-click import of keys and settings from the “Simple Cloudflare Turnstile” plugin (no need to recreate your Cloudflare keys).</li>
<li>Global widget appearance settings (theme, size, visibility, language).</li>
<li>Strict server-side token verification (single-use tokens, 5-minute validity).</li>
<li>Secure-by-default behaviour: missing/invalid tokens are always blocked; the<br />
behaviour when Cloudflare itself is unreachable is configurable.</li>
<li>Write-only secret key (never displayed or sent to the browser).</li>
<li>Lightweight: in the default per-form mode, the Cloudflare script loads only on pages that actually show a widget. (The optional “all forms” mode loads it across the front end so late-loaded forms are covered.)</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>The Elementor field requires <strong>Elementor Pro</strong> (the Forms widget is a Pro feature). Without Elementor Pro, the WordPress form integrations still work.</li>
<li>A free Cloudflare Turnstile site key and secret key.</li>
</ul>
<h4>Third-party service</h4>
<p>This plugin renders the official Cloudflare Turnstile widget and verifies tokens with Cloudflare.</p>
<ul>
<li>When a protected form is displayed, the visitor’s browser loads <code>https://challenges.cloudflare.com/turnstile/v0/api.js</code> from Cloudflare.</li>
<li>
<p>When a protected form is submitted, your server sends a request to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> containing: the Turnstile token from the widget (<code>cf-turnstile-response</code>), your secret key, and — unless disabled with the <code>cwebts_remoteip</code> filter — the visitor’s IP address (<code>REMOTE_ADDR</code>). The secret key is never sent to the browser.</p>
</li>
<li>
<p>Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/</p>
</li>
<li>Terms of Service: https://www.cloudflare.com/website-terms/</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>About the name</h4>
<p>The distinctive part of the name is <strong>CWeb Form Protection</strong>, after <strong>Collectif WEB</strong>, the agency that maintains this plugin. The trailing “with Turnstile for Elementor Forms” only describes what the plugin integrates with: “Turnstile” is the Cloudflare service it uses, and “for Elementor Forms” signals compatibility with Elementor’s Forms widget. This plugin is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. or Elementor Ltd.</p>
<h4>Trademarks</h4>
<p>Not affiliated with Cloudflare, Inc. or Elementor Ltd. “Cloudflare” and “Turnstile” are trademarks of Cloudflare, Inc. “Elementor” is a trademark of Elementor Ltd. These names are used only to describe compatibility.</p>


CWeb Form Protection with Turnstile for Elementor Forms

Add Cloudflare Turnstile to your forms — with a per-form field for Elementor Pro so you choose exactly which forms are protected.

Cybernob Turnstile for Cloudflare vs CWeb Form Protection with Turnstile for Elementor Forms