CWeb Form Protection with Turnstile for Elementor Forms vs Simple CAPTCHA with Cloudflare Turnstile

This plugin adds Cloudflare Turnstile — a free, privacy-friendly CAPTCHA alternative — to your WordPress site. Its key difference from other Turnstile plugins is per-form control for Elementor Pro: instead of toggling Turnstile globally for every Elementor form, you add a “Cloudflare Turnstile” field to the specific forms you want to protect, exactly like Elementor’s built-in reCAPTCHA field. Forms without the field are left untouched. If you prefer the all-at-once approach, an optional setting protects every Elementor Pro form automatically. Features Per-form Turnstile field for Elementor Pro Forms — drag it into the forms you choose. Optional “all Elementor Pro forms” switch — protect every Elementor Pro form at once, without adding the field to each one (off by default). Optional protection for the built-in WordPress forms: Login Registration Lost password Comments Optional protection for WooCommerce forms (one toggle each): Checkout (classic shortcode checkout) Login (My account, and the checkout “returning customer” login) Registration (My account) Account details One-click import of keys and settings from the “Simple Cloudflare Turnstile” plugin (no need to recreate your Cloudflare keys). Global widget appearance settings (theme, size, visibility, language). Strict server-side token verification (single-use tokens, 5-minute validity). Secure-by-default behaviour: missing/invalid tokens are always blocked; the behaviour when Cloudflare itself is unreachable is configurable. Write-only secret key (never displayed or sent to the browser). Lightweight: in the default per-form mode, the Cloudflare script loads only on pages that actually show a widget. (The optional “all forms” mode loads it across the front end so late-loaded forms are covered.) Requirements The Elementor field requires Elementor Pro (the Forms widget is a Pro feature). Without Elementor Pro, the WordPress form integrations still work. A free Cloudflare Turnstile site key and secret key. Third-party service This plugin renders the official Cloudflare Turnstile widget and verifies tokens with Cloudflare. When a protected form is displayed, the visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js from Cloudflare. When a protected form is submitted, your server sends a request to https://challenges.cloudflare.com/turnstile/v0/siteverify containing: the Turnstile token from the widget (cf-turnstile-response), your secret key, and — unless disabled with the cwebts_remoteip filter — the visitor’s IP address (REMOTE_ADDR). The secret key is never sent to the browser. Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/ Terms of Service: https://www.cloudflare.com/website-terms/ Privacy Policy: https://www.cloudflare.com/privacypolicy/ About the name The distinctive part of the name is CWeb Form Protection, after Collectif WEB, the agency that maintains this plugin. The trailing “with Turnstile for Elementor Forms” only describes what the plugin integrates with: “Turnstile” is the Cloudflare service it uses, and “for Elementor Forms” signals compatibility with Elementor’s Forms widget. This plugin is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. or Elementor Ltd. Trademarks Not affiliated with Cloudflare, Inc. or Elementor Ltd. “Cloudflare” and “Turnstile” are trademarks of Cloudflare, Inc. “Elementor” is a trademark of Elementor Ltd. These names are used only to describe compatibility.

Easily add Cloudflare Turnstile to all your WordPress website forms to protect them from spam! A user-friendly, privacy-preserving reCAPTCHA alternative. 100% free! Supported Forms You can currently enable Turnstile on the following forms: WordPress Login Form Registration Form Password Reset Form Comments Form WooCommerce Checkout Pay For Order Account Details Form Login Form Registration Form Password Reset Form Form Plugins WPForms Fluent Forms Contact Form 7 Gravity Forms Formidable Forms Forminator Forms Jetpack Forms Kadence Forms SureForms Other Integrations Elementor Pro Forms Easy Digital Downloads Forms Paid Memberships Pro Forms Mailchimp for WordPress Forms MailPoet Forms BuddyPress Registration Form bbPress Create Topic & Reply Forms MemberPress Forms Ultimate Member Forms WP-Members Forms WP User Frontend Forms WP User Manager Forms wpDiscuz Comments Form CheckoutWC & Flux Checkout Sunshine Photo Cart This plugin is also compatible with WordPress Multisite, and most two-factor authentication (2FA) plugins. Other Features The plugin includes several other features and options: Theme: Select the default theme for Turnstile. Language: Set the default language for Turnstile. Appearance Mode: Choose if Turnstile is always displayed, or only when an interaction is required. Disable Submit Button: Disable the submit button on forms until the Turnstile challenge is completed. Custom Error Message: Set your own custom error message for failed submissions. Whitelist: Prevent Turnstile from showing for logged in users, or certain IP addresses (wildcards are not supported). Resource Hint (Preconnect): Option to enable resource hint preconnect for improved performance. Failsafe Mode: Option to enable failsafe mode. When Cloudflare is down, this mode will either allow submissions, or fallback to reCAPTCHA. Debug Logging: Enable debug logging of Turnstile form submission events to help with troubleshooting. Getting Started It’s super quick and easy to get started with Cloudflare Turnstile! Simply generate a “site key” and “secret key” in your Cloudflare account, and add these in the plugin settings page. Select which forms Turnstile should be added to and click save. Finally, click the “TEST API RESPONSE” button to make sure the Turnstile API response is working OK. A new Cloudflare Turnstile challenge will then be displayed on your selected forms to protect them from spam! For more detailed instructions, please see our setup guide. What is Cloudflare Turnstile? Cloudflare Turnstile delivers frustration-free, CAPTCHA-free web experiences to website visitors. Turnstile is an anti-spam filter that stops abuse and confirms visitors are real without the data privacy concerns or awful UX that CAPTCHA thrusts on users. Learn more here: https://www.cloudflare.com/en-gb/products/turnstile/ Is it free to use? Yes, this plugin is completely free with no paid version, and does not include any additional data tracking. Cloudflare Turnstile is also a completely free service. Plugin Languages Currently available in 14 languages. Thank you to all the contributers! If you would like to help contribute translations, please click here. Other Information For help & suggestions, please create a support topic. Follow the developer @ElliotSowersby on Twitter. View on GitHub Support The Plugin If you would like to support the continued development and support of this plugin, you can make a donation. Trademark Notice Cloudflare, the Cloudflare logo, and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. This plugin is not affiliated with, endorsed, or sponsored by Cloudflare, Inc.