How to Add Cloudflare Turnstile CAPTCHA in WordPress (5 Steps)

You can add Cloudflare Turnstile CAPTCHA in WordPress in about 15 minutes with a plugin and two keys from Cloudflare. Turnstile checks visitors in the background. Most real people never solve a puzzle at all.

We rechecked every Turnstile fact in this guide against Cloudflare’s own docs in October 2026. Cloudflare’s 2024 application security report found that 31.2% of the application traffic it handled was bot traffic.

The main route uses our WooCommerce Advanced CAPTCHA plugin, built by DevDiggers. You also get a free option for sites without WooCommerce, the reason a plugin is needed and fixes for a widget that will not show.

What Is Cloudflare Turnstile CAPTCHA?

Cloudflare Turnstile is a free CAPTCHA alternative that checks whether a visitor is human without image puzzles. It reads browser signals such as the IP address, TLS fingerprint and user agent. It works on any website, even one that does not use other Cloudflare services.

Classic image CAPTCHAs add friction to every form a real customer fills in. Many shoppers would rather leave than pick out traffic lights on a phone.

Cloudflare Turnstile replaces the puzzle with a quiet check. Visitors do not click images or type letters to prove they are human.

Turnstile has three widget modes. Managed shows a checkbox only when a visitor looks risky. Non-interactive never asks for a click, and Invisible hides the widget completely.

Here’s a list of reasons the Cloudflare Turnstile CAPTCHA tool is gaining popularity among WordPress users:

• Most real visitors pass with no puzzle and at most one click.
• The free plan allows up to 20 widgets and unlimited challenges as of October 2026.
• The Turnstile privacy addendum says its signals serve only to detect and block bots.
• Setup is easy with popular WordPress plugins or a shortcode.
• You do not need to move your DNS or traffic to Cloudflare.
• Lightweight script that increases loading speed (under 100ms delay on average)
• Privacy-first solution that does not use cookies and does not detect user behavior
• Easy setup using popular WordPress plugins or using shortcodes
• Compatible across all major browsers and mobile devices (today and in the future)

You can put it on WordPress login forms, comment sections, WooCommerce checkouts and custom contact forms.

Why Use Cloudflare Turnstile CAPTCHA on WordPress?

Turnstile protects your WordPress login, registration and comment forms without hurting the user experience. Bots get stopped on the server before the form submits. Real customers skip the image puzzles that make people quit, which matters most on a checkout page.

The Baymard Institute found that 17% of US shoppers abandoned an order because the checkout was too long or complicated. A hard CAPTCHA adds one more step to that checkout.

Here is how Turnstile compares with puzzle CAPTCHAs such as reCAPTCHA v2 or hCaptcha:

• No user challenges: Turnstile runs in the background with no “select all fire hydrants” puzzle.
• No Cloudflare DNS needed: The widget works on any host, whether or not the site uses Cloudflare.
• Privacy-first: The Cloudflare privacy addendum says Turnstile signals are never used to identify or profile people.
• Fewer drop-offs: A smoother form submission keeps more people on your checkout and register pages.
• Simple plugin setup: It works with plugins like WooCommerce Advanced CAPTCHA and Simple Cloudflare Turnstile.
• Risk-based checks: Managed mode raises the check only for visitors who look risky.
• Faster load speeds: Lightweight JS delivers better Core Web Vitals scores, which improves your SEO.
• Privacy-first: Does not use cookies or personal data and is fully GDPR-compliant.
• Increased form submission rates: Smoother user experience equates to fewer people leaving your login, checkout, and register pages.
• Simple plugin compatibility: Integrates seamlessly with plugins like WooCommerce Advanced CAPTCHA.
• More secure: Dynamic, risk-based checks make it that much harder for bots to get past.

Turnstile suits a WooCommerce shop, a blog or a membership site. It guards the forms bots target and leaves real visitors alone.

If you want to compare Turnstile with other engines, see the reCAPTCHA alternatives for WordPress and WooCommerce and their prices.

Why Do You Need a Plugin and the Cloudflare Dashboard?

The Cloudflare dashboard creates the Turnstile widget and gives you a site key and a secret key. It does not place the widget on your WordPress forms or check the answer. A WordPress plugin does both jobs. You need the dashboard and a plugin together.

Cloudflare’s server-side validation guide says the client-side widget alone does not protect your forms. Your site must send each token to the Siteverify API with the secret key.

A plugin handles three parts for you:

• Widget output: It prints the Turnstile script and widget on each form you pick.
• Token check: It sends the token to Cloudflare on submit and blocks the form when the check fails.
• Form hooks: It ties into WordPress and WooCommerce forms you cannot edit by hand.

Each token is valid for 5 minutes and works only once, per the same Cloudflare guide. A plugin also handles a customer who waits too long on the checkout page.

How to Add Cloudflare Turnstile CAPTCHA in WordPress

To add Cloudflare Turnstile CAPTCHA in WordPress, install a CAPTCHA plugin and create a widget in your Cloudflare dashboard. Paste the widget’s site key and secret key into the plugin. Then pick the forms to protect and test each one.

The steps below use WooCommerce Advanced CAPTCHA, built by DevDiggers. It supports Turnstile, Google reCAPTCHA (v2, v2 invisible and v3) and hCaptcha from one settings page. Licenses start at $29 a year as of October 2026.

Step 1: Install & Activate the WooCommerce Advanced CAPTCHA Plugin

1. Log in to your WordPress dashboard. Go to Plugins > Add Plugin.
2. Click the Upload Plugin button.
3. Click on Choose File and upload the WooCommerce Advanced CAPTCHA plugin zip file.
4. Click Install Now.
5. Then click Activate.

Note: This plugin is built for WooCommerce stores. Activate WooCommerce before you install it. On a site without WooCommerce, use the free option further down.

Step 2: Get Your Cloudflare Turnstile Site & Secret Keys

1. Log in to the Cloudflare dashboard and select your account. Go to Turnstile and select Add widget.
2. Fill out the Widget name.
3. Fill in your website’s hostname or pick one of your existing Cloudflare sites. Each widget on the free plan takes up to 10 hostnames.
4. Select the widget mode. Cloudflare recommends Managed for most sites.
5. Copy your Site Key and Secret Key.

Tip: Keep both keys handy for the plugin settings. Treat the secret key like a password and never paste it into page code.

Step 3: Configure the Plugin to Use Cloudflare Turnstile

1. In your WordPress dashboard, go to the Advanced CAPTCHA menu or click Configuration.
2. Under CAPTCHA Type, select Cloudflare Turnstile CAPTCHA.
3. Visit the Cloudflare Turnstile CAPTCHA tab and paste the Site Key and Site Secret from Cloudflare.
4. Scroll down to choose where to display CAPTCHA:
   • Login Form
   • Registration Form
   • Lost Password Form
   • Comment Forms
   • Checkout Page
   • Add Payment Method
   • Billing Address
   • Shipping Address
   • Account Details
   • Product Reviews

Important: Click Save Changes before you leave the page.

Step 4: Use Shortcodes

Do you want to place the Cloudflare Turnstile CAPTCHA manually inside a custom form?

Use this shortcode anywhere:

[ddwcac_captcha]

You can place this inside:

• Elementor form widget using a shortcode block
• Custom PHP templates
• Contact forms using HTML blocks

Step 5: Test the Integration

With everything now installed, test each form:

• Try to log in to WordPress with a demo account.
• Log in as a customer in WooCommerce.
• Add an item to the cart and proceed to checkout.

How to Add Turnstile to WordPress Without WooCommerce

A blog or business site without WooCommerce can use the free Simple Cloudflare Turnstile plugin from WordPress.org. Cloudflare lists it on its own Turnstile community resources page as the WordPress option. It covers the WordPress login, registration, lost password and comment forms.

The setup takes the same two keys from the Cloudflare steps above:

1. Go to Plugins > Add Plugin and search for Simple Cloudflare Turnstile.
2. Install and activate the plugin.
3. Open Settings > Cloudflare Turnstile.
4. Paste the site key and secret key from your Turnstile widget.
   
5. Tick the forms you want to protect and save the settings.
   
6. Log out and load each form in a private window to see the widget.

As of October 2026 the plugin is on version 1.44.0 with more than 200,000 active installs. Pick WooCommerce Advanced CAPTCHA when you also need the checkout, account and review forms of a store covered.

Why Is the Turnstile Widget Not Showing?

A Turnstile widget that does not show or always fails points to a key, hostname or script problem. Cloudflare’s Turnstile error codes page names the cause for each case. Open your browser console on the form page and match the code you see.

These are the fixes for the problems WordPress sites hit most:

• Hostname mismatch (110200): The domain is not on the widget. Add it under hostname management, including any www or staging version.
• Invalid site key (110100 or 110110): The key is wrong or deleted. Copy it again from the widget and paste it with no spaces.
• Iframe will not load (200500): Something blocks challenges.cloudflare.com. Check your security plugin and Content Security Policy rules.
• Cached or delayed script: A caching or script-delay plugin can hold back the widget. Exclude the Turnstile script and clear the page cache.
• Missing footer hook: Some themes skip the wp_footer() call. Switch to a default theme for a minute to test this.

A form that shows the widget but still lets spam through often means the secret key is wrong. The token is never checked on the server in that case.

Conclusion

You can add Cloudflare Turnstile CAPTCHA in WordPress with two keys from Cloudflare and one plugin. The dashboard creates the widget, and the plugin places it on your forms and checks each token.

For a WooCommerce store, WooCommerce Advanced CAPTCHA covers these jobs from one settings page:

• It protects the WordPress login, registration and comment forms.
• It covers the WooCommerce checkout, account and product review forms.
• It adds Contact Form 7 and page builder forms through a shortcode.
• It lets chosen IP addresses and user roles skip the check.
• Improve the conversion rates on forms, registration forms, etc, and SEO
• Complete confidence of being GDPR compliant – zero tracking required
• With the added flexibility to integrate into Elementor, CF7, and WooCommerce

On a site without WooCommerce, the free Simple Cloudflare Turnstile plugin does the basic job. Read our guide to making a WooCommerce site GDPR compliant before you add any new script.

Frequently Asked Questions (FAQs)

Most often, WordPress users ask these questions about Cloudflare Turnstile CAPTCHA setup: