Cascadia Web Services

Tired of annoying CAPTCHAs that frustrate your visitors? Say goodbye to distorted text puzzles and hello to Cloudflare Turnstile – the next-generation CAPTCHA solution that protects your WordPress site without compromising user experience.
By MountDev: Cloudflare Turnstile brings enterprise-grade bot protection to your WordPress site with zero hassle. Powered by Cloudflare’s cutting-edge Turnstile technology, this plugin seamlessly integrates with your existing forms to stop spam, prevent automated attacks, and protect your site – all while keeping your legitimate users happy.
<h4>Why Choose Cloudflare Turnstile?</h4>
Better User Experience 
Unlike traditional CAPTCHAs that force users to decipher distorted text or identify traffic lights, Cloudflare Turnstile works invisibly in the background. Most legitimate users won’t even notice it’s there – they’ll just submit their forms and move on. No more frustrated visitors abandoning your registration or checkout process.
Privacy-First Approach 
Cloudflare Turnstile is built with privacy in mind. It doesn’t track users across sites or collect unnecessary personal data. Your visitors’ privacy is respected, and you stay compliant with modern privacy regulations.
Lightweight & Fast 
This plugin is optimized for performance. It won’t slow down your site or add bloat to your WordPress installation. The Turnstile widget loads efficiently, and you have full control over script loading behavior to optimize for your specific needs.
Enterprise Security, Free to Use 
Leverage the same powerful bot detection technology that protects millions of websites worldwide. Cloudflare’s advanced algorithms analyze visitor behavior to distinguish between humans and bots – and it’s completely free for most use cases.
<h4>Perfect for Every WordPress Site</h4>
Whether you’re running a simple blog, a membership site, an online store, or a complex multi-site network, this plugin has you covered. It integrates seamlessly with WordPress core forms and extends support to popular plugins like WooCommerce, Contact Form 7, Elementor Pro, and Fluent Forms.
E-commerce Protection 
Protect your WooCommerce store from fake registrations, fraudulent checkouts, and spam orders. Enable Turnstile on login, registration, password reset, checkout, and pay-for-order forms. You can even configure it to only appear for guest checkouts, keeping the experience smooth for your registered customers.
Form Builder Integration 
Using Contact Form 7, Elementor Pro Forms, or Fluent Forms? No problem. Enable Turnstile across all your forms with a single click, or selectively protect specific forms. You have complete control over where and how protection is applied.
Multisite Ready 
Managing a WordPress Multisite network? This plugin is fully compatible and can be configured independently for each site in your network.
<h4>Supported Forms</h4>
WordPress Core
<ul>
<li>Login Form</li>
<li>Registration Form</li>
<li>Password Reset Form</li>
<li>Comment Form</li>
</ul>
WooCommerce
<ul>
<li>Login Form</li>
<li>Registration Form</li>
<li>Password Reset Form</li>
<li>Checkout Form</li>
<li>Pay for Order Form</li>
</ul>
Third-Party Form Plugins
<ul>
<li>Contact Form 7 (all forms or specific forms via shortcode)</li>
<li>Elementor Pro Forms (all forms)</li>
<li>Fluent Forms (all forms with option to exclude specific form IDs)</li>
</ul>
Additional Features
<ul>
<li>Fully compatible with WordPress Multisite environments</li>
<li>Customizable widget positioning for different form types</li>
<li>Guest checkout only option for WooCommerce</li>
</ul>
<h4>Powerful Features, Simple Configuration</h4>
<ul>
<li>
Visual Customization – Choose between light, dark, and auto themes to perfectly match your site’s design aesthetic. The widget blends seamlessly into your forms.
</li>
<li>
Global Language Support – Set the preferred display language for the Turnstile widget to match your audience. Provide a localized experience for your international visitors.
</li>
<li>
Flexible Appearance Modes – Configure the widget to always be visible, or use managed/non-interactive modes where it only appears when suspicious activity is detected. Balance security with user experience.
</li>
<li>
Form Submission Control – Enable submit button locking to prevent users from submitting forms until Turnstile validation is complete. Ensure every submission is verified.
</li>
<li>
Branded Error Messages – Customize the error message displayed when validation fails. Maintain your brand voice even in error states and provide helpful guidance to users.
</li>
<li>
Precise Widget Positioning – Control exactly where the Turnstile widget appears on different form types. Place it before or after buttons, within specific form sections, or wherever makes the most sense for your layout.
</li>
<li>
Built-in Credential Testing – Verify your Cloudflare API keys are working correctly with one click. No more guessing if your configuration is correct – get instant confirmation.
</li>
<li>
Performance Optimization – Enable script deferral to optimize page load times. The plugin is designed to be lightweight and won’t bog down your site.
</li>
<li>
Granular Form Control – Enable protection globally across all forms of a certain type, or selectively protect individual forms. You decide the level of security for each form.
</li>
<li>
Guest Checkout Options – For WooCommerce stores, optionally show Turnstile only for guest checkouts while keeping the experience frictionless for logged-in customers.
</li>
<li>
Developer Friendly – Clean, well-documented code that follows WordPress coding standards. Hooks and filters available for advanced customization.
</li>
</ul>
<h3>Getting Started</h3>
You can have Cloudflare Turnstile protecting your WordPress forms in less than 5 minutes. Here’s how:
Step 1: Get Your Cloudflare Turnstile Keys 
Head over to your <a href="https://dash.cloudflare.com/" rel="nofollow ugc">Cloudflare dashboard</a> and create a free Turnstile site. You’ll receive a Site Key and Secret Key – these are like your plugin’s credentials to communicate with Cloudflare’s verification service. Don’t worry, it’s completely free for most websites.
Step 2: Install and Activate 
Install this plugin just like any other WordPress plugin. You can upload it manually or install it directly from the WordPress plugin directory. Activate it, and you’ll be automatically redirected to the settings page.
Step 3: Enter Your Keys 
Paste your Site Key and Secret Key into the API Configuration tab. This connects your WordPress site to Cloudflare’s Turnstile service.
Step 4: Choose Your Forms 
Navigate to the Integrations tab and select which forms you want to protect. You can enable Turnstile on WordPress login forms, WooCommerce checkout, Contact Form 7 submissions, and more. Enable as many or as few as you need.
Step 5: Customize (Optional) 
Visit the General Settings tab to customize the widget’s appearance, language, and behavior. Want a dark theme? Done. Need it in Spanish? No problem. Prefer the widget to only appear when necessary? You got it.
Step 6: Test It 
Click the TEST CREDENTIALS button to verify everything is configured correctly. You’ll get instant feedback confirming your setup is working.
Step 7: You’re Protected! 
That’s it! Your forms are now protected by enterprise-grade bot detection. Sit back and watch as spam submissions drop to zero while your legitimate users breeze through without frustration.
<h3>External Services</h3>
This plugin connects to Cloudflare Turnstile, a third-party captcha service, to provide spam protection and bot detection for your WordPress forms.
<h4>What the service is and what it is used for</h4>
Cloudflare Turnstile is a privacy-friendly captcha alternative that helps protect your website forms from spam submissions and automated bot attacks. It replaces traditional CAPTCHAs with a more user-friendly verification system.
<h4>What data is sent and when</h4>
<ul>
<li>When a user interacts with a protected form, the plugin sends the Turnstile response token to Cloudflare’s verification endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify) for validation</li>
<li>The plugin loads Cloudflare’s Turnstile JavaScript API (https://challenges.cloudflare.com/turnstile/v0/api.js) to render the captcha widget</li>
<li>Data sent includes: the response token, your site’s secret key, and the user’s IP address (as part of the verification process)</li>
<li>This occurs every time a user submits a form that has Turnstile protection enabled</li>
</ul>
<h4>Service provider information</h4>
<ul>
<li>Service: Cloudflare Turnstile</li>
<li>Provider: Cloudflare, Inc.</li>
<li>Terms of Service: https://www.cloudflare.com/terms/</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Turnstile Documentation: https://developers.cloudflare.com/turnstile/</li>
</ul>
<h4>User consent and configuration</h4>
By enabling this plugin and configuring Turnstile on your forms, you acknowledge that user interactions with protected forms will be processed by Cloudflare’s service. Users are not required to create accounts or provide personal information beyond what’s necessary for form submission verification.

By MountDev: Cloudflare Turnstile

Protect your WordPress site from spam and bots with Cloudflare Turnstile - a modern, privacy-friendly CAPTCHA alternative that respects your users.

Kitgenix

Just There

Cloudflare Turnstile, done properly for WordPress.
Kitgenix CAPTCHA for Cloudflare Turnstile is a lightweight, privacy-first reCAPTCHA alternative that adds Cloudflare Turnstile to your WordPress, WooCommerce and form plugins with server-side validation, replay protection and proxy-aware IP detection.
Protect:
<ul>
<li>WordPress core forms – login, registration, lost/reset password, comments</li>
<li>WooCommerce – checkout, account login/registration, lost password (Classic and Blocks / Store API)</li>
<li>Form plugins – WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms</li>
<li>Elementor Pro Forms and Popups</li>
<li>Forums – bbPress topic and reply forms</li>
</ul>
All with conditional, async loading, no extra cookies or tracking and zero unnecessary front-end bloat.
<h4>Why Kitgenix?</h4>
<ul>
<li>
Ultra-lightweight and fast
<ul>
<li>Uses the modern WordPress Script API (6.3+) with <code>strategy=async</code></li>
<li>Scripts load only on protected pages and forms</li>
</ul>
</li>
<li>
Privacy-first
<ul>
<li>The plugin itself does not add cookies or tracking</li>
<li>Cloudflare Turnstile is designed to minimise data collection</li>
</ul>
</li>
<li>
Rock-solid server-side validation
<ul>
<li>Uses Cloudflare’s official <code>siteverify</code> endpoint</li>
<li>Validates tokens server-side for all supported forms</li>
</ul>
</li>
<li>
Replay protection
<ul>
<li>Rejects reused tokens by default (TTL is filterable)</li>
</ul>
</li>
<li>
Proxy-aware client IP
<ul>
<li>Correctly resolves IPs behind Cloudflare, reverse proxies and load balancers</li>
<li>Honours proxy headers only from configured trusted proxies</li>
</ul>
</li>
<li>
Deep integrations
<ul>
<li>WordPress core, WooCommerce (Classic and Blocks), Elementor Pro</li>
<li>WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms</li>
<li>bbPress forums</li>
</ul>
</li>
<li>
Smart UX
<ul>
<li>Optional “disable submit until verified”</li>
<li>Token freshness timers and auto-resets</li>
<li>Clean inline error hints designed to match Cloudflare’s own UI</li>
</ul>
</li>
<li>
Production-ready admin
<ul>
<li>Onboarding wizard and Site Health integration</li>
<li>JSON export/import (with optional secret key)</li>
<li>Collapsible sections, search/filter box and an “Unsaved changes” bar</li>
</ul>
</li>
<li>
Multisite-aware
<ul>
<li>Per-site settings</li>
<li>Clean uninstall removes settings site-wide (and network-wide if run via Network Admin)</li>
</ul>
</li>
</ul>
<h4>Supported Forms and Integrations</h4>
WordPress Core
<ul>
<li>Login (<code>wp-login.php</code>)</li>
<li>Registration</li>
<li>Lost and Reset Password</li>
<li>Comments</li>
</ul>
Turnstile is injected into each core form and validated only on POST submissions. Invalid, expired or reused tokens block the action with a clear message.
WooCommerce (Classic)
<ul>
<li>Checkout</li>
<li>Login</li>
<li>Registration</li>
<li>Lost Password</li>
</ul>
Turnstile appears near the Place order button and WooCommerce account forms. Validation runs during checkout and account actions. Designed to work safely with checkout fragments and avoids duplicate rendering.
WooCommerce (Blocks / Store API)
<ul>
<li>Checkout (Blocks / Store API)</li>
</ul>
The widget renders in the Blocks checkout UI and validates Store API requests server-side. Tokens can be forwarded via <code>X-Turnstile-Token</code> or similar headers and are handled automatically by the plugin.
Elementor Pro (Forms and Popups)
<ul>
<li>Elementor Pro Forms (including popups and dynamically loaded forms)</li>
</ul>
The widget injects before or after the submit area, listens for Elementor popup and AJAX events and ensures a fresh token for each attempt. Handles multiple forms, popups and delayed popups reliably.
Contact Form 7
<ul>
<li>All CF7 forms</li>
</ul>
Auto-injects the widget and re-renders after AJAX errors. A shortcode <code>[kitgenix_turnstile]</code> is available for manual placement. In Shortcode-only mode, CF7 forms are passed through <code>do_shortcode()</code> so manual placement works reliably.
Fluent Forms
<ul>
<li>All Fluent Forms</li>
</ul>
Auto-injects, validates server-side and handles AJAX and multi-step flows with automatic re-renders.
Formidable Forms
<ul>
<li>All Formidable Forms</li>
</ul>
Injects near the submit area, validates on submit and re-renders after client or server validation errors.
Forminator Forms
<ul>
<li>All Forminator forms</li>
</ul>
Works with regular and AJAX forms, including multi-step flows. Tokens are reset on failed submissions.
Gravity Forms
<ul>
<li>All Gravity Forms</li>
</ul>
Widget placement before or after submit, with server-side validation on Gravity’s native hooks. Handles AJAX and multi-page forms with safe re-render and no overlapping buttons.
Jetpack Forms
<ul>
<li>Jetpack Contact Forms</li>
</ul>
Adds Turnstile to Jetpack forms with proper validation and AJAX behaviour.
Kadence Forms (Kadence Blocks)
<ul>
<li>Kadence form blocks</li>
</ul>
Auto-injects on Kadence form blocks, validates server-side and re-renders on validation errors.
WPForms
<ul>
<li>WPForms Lite and Pro</li>
</ul>
Injects before or after the submit area. Optional “disable submit until verified” UX, auto-resets on AJAX errors and prevents overlap or layout issues.
Forums – bbPress
<ul>
<li>Create Topic and Reply forms</li>
</ul>
Adds Turnstile to bbPress posting forms to reduce automated spam topics and replies, validating before content is saved.
You can enable or disable each integration and location under Settings → Cloudflare Turnstile.
<h4>How It Works</h4>
<ol>
<li>
Loads the Cloudflare Turnstile API 
 https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit 
using the WordPress Script API (async for WordPress 6.3+).
</li>
<li>
Injects a widget into enabled forms 
Handles AJAX, multi-step forms, popups and other dynamic DOM changes.
</li>
<li>
Verifies tokens server-side 
Uses Cloudflare’s <code>/v0/siteverify</code> endpoint with your secret key and request IP (when appropriate).
</li>
<li>
Enforces replay protection 
Caches recent tokens (hashed) and rejects re-use (TTL is filterable).
</li>
<li>
Blocks on failure 
Submissions with invalid, expired or reused tokens are blocked with a clear, user-friendly message.
</li>
</ol>
<h4>Quick Start</h4>
<ol>
<li>Install and activate from Plugins → Add New by searching for “Kitgenix Turnstile”.</li>
<li>Go to Settings → Cloudflare Turnstile.</li>
<li>Enter your Site Key and Secret Key from the Cloudflare Turnstile dashboard.</li>
<li>Enable the integrations and specific forms you want to protect.</li>
<li>Save changes, then test login, registration, comments, checkout and form pages.</li>
</ol>
<h4>Performance and Security</h4>
Performance playbook
<ul>
<li>Async by default using the WordPress Script API with <code>strategy=async</code> on WordPress 6.3+.</li>
<li>Conditional loading so Turnstile assets load only where protection is enabled.</li>
<li>Works with caching and optimisation plugins:
<ul>
<li>Allowlist <code>https://challenges.cloudflare.com</code> in defer/optimise settings.</li>
<li>Avoid inlining, combining or heavily delaying the Turnstile script.</li>
<li>Exclude login, account and checkout pages from full-page caching where possible.</li>
</ul>
</li>
<li>Resource hints (preconnect/dns-prefetch) for <code>https://challenges.cloudflare.com</code> to speed up first paint.</li>
</ul>
Security tips
<ul>
<li>Replay protection is enabled by default; adjust duration using <code>kitgenix_turnstile_replay_ttl</code>.</li>
<li>Configure trusted proxies when using Cloudflare/CDN/reverse-proxy so the correct client IP is used.</li>
<li>Use Developer Mode (warn-only) on staging to log failures without blocking users.</li>
<li>Whitelisting (logged-in users, IPs and user agents) is supported but should be used sparingly.</li>
</ul>
<h4>Troubleshooting</h4>
Widget not showing
<ul>
<li>Confirm Site and Secret Keys are correct.</li>
<li>Check that the integration and specific form location are enabled.</li>
<li>Verify you are not whitelisted (user, IP or user agent).</li>
<li>Clear caches (page, object, CDN).</li>
<li>Allowlist <code>challenges.cloudflare.com</code> in optimisation plugins.</li>
<li>Check the browser console for blocked or failed scripts.</li>
</ul>
Always seeing “Please verify you are human”
<ul>
<li>Token may be expired or invalid.</li>
<li>Reduce page cache TTL on form pages.</li>
<li>Do not full-page cache auth or checkout pages.</li>
<li>Ensure your server can reach Cloudflare (no firewall blocks).</li>
</ul>
Elementor popups or AJAX forms
<ul>
<li>Avoid over-deferring Elementor or form plugin JavaScript.</li>
<li>The plugin listens to Elementor events and re-renders containers dynamically.</li>
</ul>
WooCommerce checkout issues
<ul>
<li>Avoid caching dynamic fragments.</li>
<li>Confirm the widget renders before the Place order button.</li>
<li>If using custom checkout flows, ensure the token is forwarded correctly.</li>
</ul>
<h3>Minimum Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.0 or higher</li>
<li>Cloudflare Turnstile Site and Secret Keys (free)</li>
</ul>
<h3>Developers</h3>
Key filters
<ul>
<li>
<code>kitgenix_captcha_for_cloudflare_turnstile_script_url( $url, $settings )</code> 
Override the Turnstile script URL or append query arguments.
</li>
<li>
<code>kitgenix_turnstile_freshness_ms</code> 
Control token auto-reset interval (milliseconds).
</li>
<li>
<code>kitgenix_turnstile_replay_ttl</code> 
Adjust replay protection cache duration (seconds).
</li>
<li>
<code>kitgenix_turnstile_is_whitelisted( $is_whitelisted, $context )</code> 
Modify whitelist decisions programmatically.
</li>
</ul>
Shortcode
<ul>
<li><code>[kitgenix_turnstile]</code> – Render the Turnstile widget manually. Integrations detect the shortcode or rendered widget container and skip auto-injection to prevent duplicates.</li>
</ul>
Server-side endpoint
<ul>
<li>Validates via <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code>.</li>
</ul>
Text domain
<ul>
<li><code>kitgenix-captcha-for-cloudflare-turnstile</code> (POT file included).</li>
</ul>
<h3>Integration Files</h3>
Each integration maps to a dedicated adapter class for maintainability.
<ul>
<li>
WordPress Core:
<ul>
<li><code>includes/integrations/wordpress/class-wp-core.php</code></li>
</ul>
</li>
<li>
WooCommerce (Classic):
<ul>
<li><code>includes/integrations/ecommerce/class-woocommerce.php</code></li>
</ul>
</li>
<li>
WooCommerce (Blocks / Store API):
<ul>
<li><code>includes/integrations/ecommerce/class-woocommerce-blocks.php</code></li>
</ul>
</li>
<li>
Elementor Pro:
<ul>
<li><code>includes/integrations/page-builder/class-elementor.php</code></li>
</ul>
</li>
<li>
Form plugins:
<ul>
<li>Contact Form 7 — <code>includes/integrations/forms/contact-form-7.php</code></li>
<li>Fluent Forms — <code>includes/integrations/forms/fluent-forms.php</code></li>
<li>Formidable Forms — <code>includes/integrations/forms/formidable-forms.php</code></li>
<li>Forminator Forms — <code>includes/integrations/forms/forminator-forms.php</code></li>
<li>Gravity Forms — <code>includes/integrations/forms/gravity-forms.php</code></li>
<li>Jetpack Forms — <code>includes/integrations/forms/jetpack-forms.php</code></li>
<li>Kadence Forms — <code>includes/integrations/forms/kadence-forms.php</code></li>
<li>WPForms — <code>includes/integrations/forms/wpforms.php</code></li>
</ul>
</li>
<li>
Forums:
<ul>
<li>bbPress — <code>includes/integrations/forums/bbpress.php</code></li>
</ul>
</li>
<li>
Integration folders:
<ul>
<li><code>includes/integrations/</code></li>
<li><code>includes/integrations/ecommerce/</code></li>
<li><code>includes/integrations/forms/</code></li>
<li><code>includes/integrations/forums/</code></li>
<li><code>includes/integrations/page-builder/</code></li>
<li><code>includes/integrations/wordpress/</code></li>
</ul>
<h3>Roadmap</h3>
</li>
<li>Per-form controls and additional UI refinements</li>
<li>More granular placement options for page builders and theme forms</li>
<li>Expanded compatibility notes and presets for popular optimisation and caching plugins</li>
<li>Additional developer hooks and integration examples</li>
</ul>
<h3>External Services</h3>
This plugin connects to Cloudflare Turnstile to perform spam and abuse prevention checks. It sends:
<ul>
<li>Turnstile site key</li>
<li>Turnstile response token</li>
<li>User IP address and user agent (used by Cloudflare for verification)</li>
</ul>
No personal data is stored or processed by Kitgenix.
Cloudflare Turnstile Terms: https://developers.cloudflare.com/turnstile/ 
Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/
<h3>Trademark Notice</h3>
“Cloudflare” and the Cloudflare logo are trademarks of Cloudflare, Inc. This plugin is not affiliated with or endorsed by Cloudflare, Inc.
<h3>Copyright</h3>
Kitgenix CAPTCHA for Cloudflare Turnstile is built with ❤️ by Kitgenix.
<h3>Credits</h3>
Cloudflare Turnstile – https://www.cloudflare.com/products/turnstile/ 
Built with ❤️ by https://kitgenix.com
<h3>Support Development</h3>
If this plugin helps you stop spam and keep your forms fast and user-friendly, you can support ongoing development here:
https://buymeacoffee.com/kitgenix

Kitgenix CAPTCHA for Cloudflare Turnstile


I’m really impressed with Kitgenix CAPTCHA for Cloudflare Turnstile. Setting it up was super straightforward, I had it running in just a few minutes. It does exactly what it promises: keeps the bots out without making life harder for real visitors.



I love that it just works quietly in the background. No weird puzzles, no endless clicking boxes, just a smooth experience for genuine users. It also fits nicely into the site without slowing anything down.


Easy to Set Up, Works Like a Charm

Cloudflare Turnstile CAPTCHA for WordPress, WooCommerce, Elementor and popular forms. Fast, privacy-first anti-spam with server-side validation.

By MountDev: Cloudflare Turnstile vs Kitgenix CAPTCHA for Cloudflare Turnstile