Kitgenix

Just There

Cloudflare Turnstile, done properly for WordPress.
Kitgenix CAPTCHA for Cloudflare Turnstile is a lightweight, privacy-first reCAPTCHA alternative that adds Cloudflare Turnstile to your WordPress, WooCommerce and form plugins with server-side validation, replay protection and proxy-aware IP detection.
Protect:
<ul>
<li>WordPress core forms – login, registration, lost/reset password, comments</li>
<li>WooCommerce – checkout, account login/registration, lost password (Classic and Blocks / Store API)</li>
<li>Form plugins – WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms</li>
<li>Elementor Pro Forms and Popups</li>
<li>Forums – bbPress topic and reply forms</li>
</ul>
All with conditional, async loading, no extra cookies or tracking and zero unnecessary front-end bloat.
<h4>Why Kitgenix?</h4>
<ul>
<li>
Ultra-lightweight and fast
<ul>
<li>Uses the modern WordPress Script API (6.3+) with <code>strategy=async</code></li>
<li>Scripts load only on protected pages and forms</li>
</ul>
</li>
<li>
Privacy-first
<ul>
<li>The plugin itself does not add cookies or tracking</li>
<li>Cloudflare Turnstile is designed to minimise data collection</li>
</ul>
</li>
<li>
Rock-solid server-side validation
<ul>
<li>Uses Cloudflare’s official <code>siteverify</code> endpoint</li>
<li>Validates tokens server-side for all supported forms</li>
</ul>
</li>
<li>
Replay protection
<ul>
<li>Rejects reused tokens by default (TTL is filterable)</li>
</ul>
</li>
<li>
Proxy-aware client IP
<ul>
<li>Correctly resolves IPs behind Cloudflare, reverse proxies and load balancers</li>
<li>Honours proxy headers only from configured trusted proxies</li>
</ul>
</li>
<li>
Deep integrations
<ul>
<li>WordPress core, WooCommerce (Classic and Blocks), Elementor Pro</li>
<li>WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms</li>
<li>bbPress forums</li>
</ul>
</li>
<li>
Smart UX
<ul>
<li>Optional “disable submit until verified”</li>
<li>Token freshness timers and auto-resets</li>
<li>Clean inline error hints designed to match Cloudflare’s own UI</li>
</ul>
</li>
<li>
Production-ready admin
<ul>
<li>Onboarding wizard and Site Health integration</li>
<li>JSON export/import (with optional secret key)</li>
<li>Collapsible sections, search/filter box and an “Unsaved changes” bar</li>
</ul>
</li>
<li>
Multisite-aware
<ul>
<li>Per-site settings</li>
<li>Clean uninstall removes settings site-wide (and network-wide if run via Network Admin)</li>
</ul>
</li>
</ul>
<h4>Supported Forms and Integrations</h4>
WordPress Core
<ul>
<li>Login (<code>wp-login.php</code>)</li>
<li>Registration</li>
<li>Lost and Reset Password</li>
<li>Comments</li>
</ul>
Turnstile is injected into each core form and validated only on POST submissions. Invalid, expired or reused tokens block the action with a clear message.
WooCommerce (Classic)
<ul>
<li>Checkout</li>
<li>Login</li>
<li>Registration</li>
<li>Lost Password</li>
</ul>
Turnstile appears near the Place order button and WooCommerce account forms. Validation runs during checkout and account actions. Designed to work safely with checkout fragments and avoids duplicate rendering.
WooCommerce (Blocks / Store API)
<ul>
<li>Checkout (Blocks / Store API)</li>
</ul>
The widget renders in the Blocks checkout UI and validates Store API requests server-side. Tokens can be forwarded via <code>X-Turnstile-Token</code> or similar headers and are handled automatically by the plugin.
Elementor Pro (Forms and Popups)
<ul>
<li>Elementor Pro Forms (including popups and dynamically loaded forms)</li>
</ul>
The widget injects before or after the submit area, listens for Elementor popup and AJAX events and ensures a fresh token for each attempt. Handles multiple forms, popups and delayed popups reliably.
Contact Form 7
<ul>
<li>All CF7 forms</li>
</ul>
Auto-injects the widget and re-renders after AJAX errors. A shortcode <code>[kitgenix_turnstile]</code> is available for manual placement. In Shortcode-only mode, CF7 forms are passed through <code>do_shortcode()</code> so manual placement works reliably.
Fluent Forms
<ul>
<li>All Fluent Forms</li>
</ul>
Auto-injects, validates server-side and handles AJAX and multi-step flows with automatic re-renders.
Formidable Forms
<ul>
<li>All Formidable Forms</li>
</ul>
Injects near the submit area, validates on submit and re-renders after client or server validation errors.
Forminator Forms
<ul>
<li>All Forminator forms</li>
</ul>
Works with regular and AJAX forms, including multi-step flows. Tokens are reset on failed submissions.
Gravity Forms
<ul>
<li>All Gravity Forms</li>
</ul>
Widget placement before or after submit, with server-side validation on Gravity’s native hooks. Handles AJAX and multi-page forms with safe re-render and no overlapping buttons.
Jetpack Forms
<ul>
<li>Jetpack Contact Forms</li>
</ul>
Adds Turnstile to Jetpack forms with proper validation and AJAX behaviour.
Kadence Forms (Kadence Blocks)
<ul>
<li>Kadence form blocks</li>
</ul>
Auto-injects on Kadence form blocks, validates server-side and re-renders on validation errors.
WPForms
<ul>
<li>WPForms Lite and Pro</li>
</ul>
Injects before or after the submit area. Optional “disable submit until verified” UX, auto-resets on AJAX errors and prevents overlap or layout issues.
Forums – bbPress
<ul>
<li>Create Topic and Reply forms</li>
</ul>
Adds Turnstile to bbPress posting forms to reduce automated spam topics and replies, validating before content is saved.
You can enable or disable each integration and location under Settings → Cloudflare Turnstile.
<h4>How It Works</h4>
<ol>
<li>
Loads the Cloudflare Turnstile API 
 https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit 
using the WordPress Script API (async for WordPress 6.3+).
</li>
<li>
Injects a widget into enabled forms 
Handles AJAX, multi-step forms, popups and other dynamic DOM changes.
</li>
<li>
Verifies tokens server-side 
Uses Cloudflare’s <code>/v0/siteverify</code> endpoint with your secret key and request IP (when appropriate).
</li>
<li>
Enforces replay protection 
Caches recent tokens (hashed) and rejects re-use (TTL is filterable).
</li>
<li>
Blocks on failure 
Submissions with invalid, expired or reused tokens are blocked with a clear, user-friendly message.
</li>
</ol>
<h4>Quick Start</h4>
<ol>
<li>Install and activate from Plugins → Add New by searching for “Kitgenix Turnstile”.</li>
<li>Go to Settings → Cloudflare Turnstile.</li>
<li>Enter your Site Key and Secret Key from the Cloudflare Turnstile dashboard.</li>
<li>Enable the integrations and specific forms you want to protect.</li>
<li>Save changes, then test login, registration, comments, checkout and form pages.</li>
</ol>
<h4>Performance and Security</h4>
Performance playbook
<ul>
<li>Async by default using the WordPress Script API with <code>strategy=async</code> on WordPress 6.3+.</li>
<li>Conditional loading so Turnstile assets load only where protection is enabled.</li>
<li>Works with caching and optimisation plugins:
<ul>
<li>Allowlist <code>https://challenges.cloudflare.com</code> in defer/optimise settings.</li>
<li>Avoid inlining, combining or heavily delaying the Turnstile script.</li>
<li>Exclude login, account and checkout pages from full-page caching where possible.</li>
</ul>
</li>
<li>Resource hints (preconnect/dns-prefetch) for <code>https://challenges.cloudflare.com</code> to speed up first paint.</li>
</ul>
Security tips
<ul>
<li>Replay protection is enabled by default; adjust duration using <code>kitgenix_turnstile_replay_ttl</code>.</li>
<li>Configure trusted proxies when using Cloudflare/CDN/reverse-proxy so the correct client IP is used.</li>
<li>Use Developer Mode (warn-only) on staging to log failures without blocking users.</li>
<li>Whitelisting (logged-in users, IPs and user agents) is supported but should be used sparingly.</li>
</ul>
<h4>Troubleshooting</h4>
Widget not showing
<ul>
<li>Confirm Site and Secret Keys are correct.</li>
<li>Check that the integration and specific form location are enabled.</li>
<li>Verify you are not whitelisted (user, IP or user agent).</li>
<li>Clear caches (page, object, CDN).</li>
<li>Allowlist <code>challenges.cloudflare.com</code> in optimisation plugins.</li>
<li>Check the browser console for blocked or failed scripts.</li>
</ul>
Always seeing “Please verify you are human”
<ul>
<li>Token may be expired or invalid.</li>
<li>Reduce page cache TTL on form pages.</li>
<li>Do not full-page cache auth or checkout pages.</li>
<li>Ensure your server can reach Cloudflare (no firewall blocks).</li>
</ul>
Elementor popups or AJAX forms
<ul>
<li>Avoid over-deferring Elementor or form plugin JavaScript.</li>
<li>The plugin listens to Elementor events and re-renders containers dynamically.</li>
</ul>
WooCommerce checkout issues
<ul>
<li>Avoid caching dynamic fragments.</li>
<li>Confirm the widget renders before the Place order button.</li>
<li>If using custom checkout flows, ensure the token is forwarded correctly.</li>
</ul>
<h3>Minimum Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.0 or higher</li>
<li>Cloudflare Turnstile Site and Secret Keys (free)</li>
</ul>
<h3>Developers</h3>
Key filters
<ul>
<li>
<code>kitgenix_captcha_for_cloudflare_turnstile_script_url( $url, $settings )</code> 
Override the Turnstile script URL or append query arguments.
</li>
<li>
<code>kitgenix_turnstile_freshness_ms</code> 
Control token auto-reset interval (milliseconds).
</li>
<li>
<code>kitgenix_turnstile_replay_ttl</code> 
Adjust replay protection cache duration (seconds).
</li>
<li>
<code>kitgenix_turnstile_is_whitelisted( $is_whitelisted, $context )</code> 
Modify whitelist decisions programmatically.
</li>
</ul>
Shortcode
<ul>
<li><code>[kitgenix_turnstile]</code> – Render the Turnstile widget manually. Integrations detect the shortcode or rendered widget container and skip auto-injection to prevent duplicates.</li>
</ul>
Server-side endpoint
<ul>
<li>Validates via <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code>.</li>
</ul>
Text domain
<ul>
<li><code>kitgenix-captcha-for-cloudflare-turnstile</code> (POT file included).</li>
</ul>
<h3>Integration Files</h3>
Each integration maps to a dedicated adapter class for maintainability.
<ul>
<li>
WordPress Core:
<ul>
<li><code>includes/integrations/wordpress/class-wp-core.php</code></li>
</ul>
</li>
<li>
WooCommerce (Classic):
<ul>
<li><code>includes/integrations/ecommerce/class-woocommerce.php</code></li>
</ul>
</li>
<li>
WooCommerce (Blocks / Store API):
<ul>
<li><code>includes/integrations/ecommerce/class-woocommerce-blocks.php</code></li>
</ul>
</li>
<li>
Elementor Pro:
<ul>
<li><code>includes/integrations/page-builder/class-elementor.php</code></li>
</ul>
</li>
<li>
Form plugins:
<ul>
<li>Contact Form 7 — <code>includes/integrations/forms/contact-form-7.php</code></li>
<li>Fluent Forms — <code>includes/integrations/forms/fluent-forms.php</code></li>
<li>Formidable Forms — <code>includes/integrations/forms/formidable-forms.php</code></li>
<li>Forminator Forms — <code>includes/integrations/forms/forminator-forms.php</code></li>
<li>Gravity Forms — <code>includes/integrations/forms/gravity-forms.php</code></li>
<li>Jetpack Forms — <code>includes/integrations/forms/jetpack-forms.php</code></li>
<li>Kadence Forms — <code>includes/integrations/forms/kadence-forms.php</code></li>
<li>WPForms — <code>includes/integrations/forms/wpforms.php</code></li>
</ul>
</li>
<li>
Forums:
<ul>
<li>bbPress — <code>includes/integrations/forums/bbpress.php</code></li>
</ul>
</li>
<li>
Integration folders:
<ul>
<li><code>includes/integrations/</code></li>
<li><code>includes/integrations/ecommerce/</code></li>
<li><code>includes/integrations/forms/</code></li>
<li><code>includes/integrations/forums/</code></li>
<li><code>includes/integrations/page-builder/</code></li>
<li><code>includes/integrations/wordpress/</code></li>
</ul>
<h3>Roadmap</h3>
</li>
<li>Per-form controls and additional UI refinements</li>
<li>More granular placement options for page builders and theme forms</li>
<li>Expanded compatibility notes and presets for popular optimisation and caching plugins</li>
<li>Additional developer hooks and integration examples</li>
</ul>
<h3>External Services</h3>
This plugin connects to Cloudflare Turnstile to perform spam and abuse prevention checks. It sends:
<ul>
<li>Turnstile site key</li>
<li>Turnstile response token</li>
<li>User IP address and user agent (used by Cloudflare for verification)</li>
</ul>
No personal data is stored or processed by Kitgenix.
Cloudflare Turnstile Terms: https://developers.cloudflare.com/turnstile/ 
Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/
<h3>Trademark Notice</h3>
“Cloudflare” and the Cloudflare logo are trademarks of Cloudflare, Inc. This plugin is not affiliated with or endorsed by Cloudflare, Inc.
<h3>Copyright</h3>
Kitgenix CAPTCHA for Cloudflare Turnstile is built with ❤️ by Kitgenix.
<h3>Credits</h3>
Cloudflare Turnstile – https://www.cloudflare.com/products/turnstile/ 
Built with ❤️ by https://kitgenix.com
<h3>Support Development</h3>
If this plugin helps you stop spam and keep your forms fast and user-friendly, you can support ongoing development here:
https://buymeacoffee.com/kitgenix

Kitgenix CAPTCHA for Cloudflare Turnstile


I’m really impressed with Kitgenix CAPTCHA for Cloudflare Turnstile. Setting it up was super straightforward, I had it running in just a few minutes. It does exactly what it promises: keeps the bots out without making life harder for real visitors.



I love that it just works quietly in the background. No weird puzzles, no endless clicking boxes, just a smooth experience for genuine users. It also fits nicely into the site without slowing anything down.


Easy to Set Up, Works Like a Charm

Cloudflare Turnstile CAPTCHA for WordPress, WooCommerce, Elementor and popular forms. Fast, privacy-first anti-spam with server-side validation.

WPPOOL

azizultex

wpdarkmode

shahreyar46

Mahafuz

farhanmullick

Md Sajjadul Islam

Cloudflare Turnstile for WordPress, WooCommerce, Contact Form 7, BuddyPress, WPForms, and more. Secure your website with a privacy-friendly reCAPTCHA alternative.
“Studies show that 15% of users will abandon a web-based service when they face a traditional CAPTCHA test.”
HOW TO ADD CLOUDFLARE TURNSTILE IN WORDPRESS
<iframe loading="lazy" title="How to Add Cloudflare Turnstile CAPTCHA in WordPress for Free | Google reCAPTCHA alternative" width="750" height="422" src="https://www.youtube.com/embed/2jU2LhkiQQU?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
PROTECTS AGAINST SPAM FOR:
<ul>
<li>WordPress Login form</li>
<li>WordPress Signup form</li>
<li>WordPress Reset Password form</li>
<li>WordPress Comment form</li>
<li>WooCommerce forms</li>
<li>Contact Form 7 forms</li>
<li>WPForms contact forms</li>
<li>BuddyPress forms</li>
<li>Elementor forms</li>
</ul>
Say to no user experience nightmare, known as CAPTCHA. It hinders your website experience significantly as it slows down user actions at every step of the website journey. Welcome to Turnstile, the latest alternative to invisible CAPTCHA and honeypot. This anti-spam plugin allows you to easily integrate Turnstile on your website within a few seconds without any coding.
<a href="https://wordpress.org/support/plugin/wppool-turnstile-captcha-spam-filter/" rel="ugc">👩🏼‍💻 Get support</a>
WHAT IS CLOUDFLARE TURNSTILE, AND HOW TO ACTIVATE IT ON YOUR WEBSITE?
Turnstile is the latest privacy-focused invisible CAPTCHA technology developed by Cloudflare to create a modern CAPTCHA alternative and reCAPTCHA alternative.
Turnstile helps you identify real website visitors without needing additional actions. Instead, Turnstile automatically runs a series of small non-interactive JavaScript challenges based on telemetry and client behavior displayed during a session. That means the possibility of your users facing CAPTCHA will reduce significantly. <a href="https://www.cloudflare.com/en-gb/products/turnstile/" rel="nofollow ugc">Learn more about Turnstile</a>
Getting started with Turnstile on WordPress is super easy. All you have to do is install and activate our plugin. Then, generate your site and secret keys from Cloudflare (a free and easy process) and input them through the provided field. That’s it. The plugin does everything else and ready to protect your forms from spam. You will no longer have to get frustrated with the poor efficacy of reCAPTCHA ever again!
<a href="https://wordpress.org/support/plugin/wppool-turnstile-captcha-spam-filter/" rel="ugc">👩🏼‍💻 Get support</a>
<h3>EASY SPAM FILTER FEATURES</h3>
<ol>
<li>Automatic deployment: Once you setup Easy Spam Filter with your site key and secret key, the plugin does the rest. It will automatically deploy the required HTML snippet in your website for you.</li>
<li>WordPress spam protection: Spam Filter with Turnstile safeguards your website against spam comments or brute force attacks. It has support for every kind of WordPress form, including
<ul>
<li>Signup/registration form spam protection</li>
<li>Login form spam protection</li>
<li>Reset password form spam protection</li>
<li>Comment spam protection</li>
</ul>
</li>
<li>Disable/enable WordPress login spam protection: You can disable Turnstile at any time from the WordPress login form from the plugin setting.</li>
<li>SEO boost: Spambots often include low-quality or malicious outbound links, risking your website’s ranking. Turnstile prevents these bots from spamming and ensures you continue receiving a good ranking.</li>
<li>Mobile-friendly Anti Spam: Our Turnstile integration is fully optimized for mobile devices and will not break under any circumstances.</li>
<li>WooCommerce spam protection: Protect your WooCommerce store against malicious spam attacks. This reCAPTCHA alternative for WooCommerce provides protection against every kind WooCommerce form.
<ul>
<li>Signup/registration form spam protection</li>
<li>Login form – my account spam protection</li>
<li>Lost/Reset password form spam protection</li>
<li>Checkout billing form spam protection</li>
</ul>
</li>
<li>Contact Form 7 spam protection: Experience flawless Turnstile integration for Contact Form 7 forms. Protect your CF7 forms from spam comments. After configuration, add Turnstile to any Contact Form 7 form.</li>
<li>BuddyPress login spam protection: Keep your BuddyPress groups safe with secured spam protection by Cloudflare Turnstile antispam filter.</li>
<li>WPForms spam protection: Add Cloudflare Turnstile in Contact Form by WPForms and keep your everyday contact forms safe from spam submissions. Activate and enjoy
<ul>
<li>Contact forms spam protection</li>
<li>Payment forms spam protection</li>
<li>Survey forms spam protection</li>
<li>Newsletter forms spam protection</li>
<li>Registration forms spam protection</li>
</ul>
</li>
<li>Elementor forms spam protection: Add Turnstile to Elementor forms. If you are using Elementor Pro, you can now protect your
<ul>
<li>Elementor contact us forms</li>
<li>Elementor multi-step forms</li>
<li>Elementor login form</li>
</ul>
</li>
<li>Turnstile widget theme: Change the outlook of the Turnstile widget according to your wish (Dark or Light).</li>
<li>Submit button restriction: Control whether users need to pass the Cloudflare Turnstile security check to submit the button.</li>
<li>Custom message: Customize the Turnstile widget message and replace the default one (“Please verify you are human”).</li>
</ol>
<h3>Privacy Policy</h3>
Easy Spam Filter uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster & make product improvements.
Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice. We collect the data to ensure a great user experience for all our users.
Integrating Appsero SDK DOES NOT IMMEDIATELY start gathering data, without confirmation from users in any case.
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses this data</a>.

Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor

That’s awesome! Integrated CloudFlare Turnstile in my WordPress site in just a few minutes :wink: very lightweight and easy. Thanks for the plugin.

Very lightweight Turnstile WordPress plugin

Very helpful !

Add Cloudflare Turnstile to WordPress, Contact Form 7, WooCommerce, WPForms, BuddyPress & Elementor. A CAPTCHA, reCAPTCHA alternative for WordPress.

Kitgenix CAPTCHA for Cloudflare Turnstile vs Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor