Cloudflare Turnstile<\/a> \u2014 a free, privacy-friendly CAPTCHA alternative \u2014 to your WordPress site.<\/p>\n\nIts key difference from other Turnstile plugins is per-form control for Elementor Pro<\/strong>: instead of toggling Turnstile globally for every Elementor form, you add a \"Cloudflare Turnstile\" field<\/strong> to the specific forms you want to protect, exactly like Elementor's built-in reCAPTCHA field. Forms without the field are left untouched. If you prefer the all-at-once approach, an optional setting protects every<\/strong> Elementor Pro form automatically.<\/p>\n\nFeatures<\/h4>\n\n\n- Per-form Turnstile field for Elementor Pro Forms<\/strong> \u2014 drag it into the forms you choose.<\/li>\n
- Optional \"all Elementor Pro forms\" switch<\/strong> \u2014 protect every Elementor Pro form at once, without adding the field to each one (off by default).<\/li>\n
- Optional protection for the built-in WordPress forms:\n\n
\n- Login<\/li>\n
- Registration<\/li>\n
- Lost password<\/li>\n
- Comments<\/li>\n<\/ul><\/li>\n
- One-click import of keys and settings from the \"Simple Cloudflare Turnstile\" plugin (no need to recreate your Cloudflare keys).<\/li>\n
- Global widget appearance settings (theme, size, visibility, language).<\/li>\n
- Strict server-side token verification (single-use tokens, 5-minute validity).<\/li>\n
- Secure-by-default behaviour: missing\/invalid tokens are always blocked; the\nbehaviour when Cloudflare itself is unreachable is configurable.<\/li>\n
- Write-only secret key (never displayed or sent to the browser).<\/li>\n
- Lightweight: in the default per-form mode, the Cloudflare script loads only on pages that actually show a widget. (The optional \"all forms\" mode loads it across the front end so late-loaded forms are covered.)<\/li>\n<\/ul>\n\n
Requirements<\/h4>\n\n\n- The Elementor field requires Elementor Pro<\/strong> (the Forms widget is a Pro feature). Without Elementor Pro, the WordPress form integrations still work.<\/li>\n
- A free Cloudflare Turnstile site key and secret key.<\/li>\n<\/ul>\n\n
Third-party service<\/h4>\n\n
This plugin renders the official Cloudflare Turnstile widget and verifies tokens with Cloudflare.<\/p>\n\n
\n- When a protected form is displayed, the visitor's browser loads
https:\/\/challenges.cloudflare.com\/turnstile\/v0\/api.js<\/code> from Cloudflare.<\/li>\nWhen a protected form is submitted, your server sends a request to https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code> containing: the Turnstile token from the widget (cf-turnstile-response<\/code>), your secret key, and \u2014 unless disabled with the cwebts_remoteip<\/code> filter \u2014 the visitor's IP address (REMOTE_ADDR<\/code>). The secret key is never sent to the browser.<\/p><\/li>\nCloudflare Turnstile: https:\/\/www.cloudflare.com\/products\/turnstile\/<\/p><\/li>\n
- Terms of Service: https:\/\/www.cloudflare.com\/website-terms\/<\/li>\n
- Privacy Policy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/li>\n<\/ul>\n\n
About the name<\/h4>\n\n
The distinctive part of the name is CWeb Form Protection<\/strong>, after Collectif WEB<\/strong>, the agency that maintains this plugin. The trailing \"with Turnstile for Elementor Forms\" only describes what the plugin integrates with: \"Turnstile\" is the Cloudflare service it uses, and \"for Elementor Forms\" signals compatibility with Elementor's Forms widget. This plugin is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. or Elementor Ltd.<\/p>\n\nTrademarks<\/h4>\n\n
Not affiliated with Cloudflare, Inc. or Elementor Ltd. \"Cloudflare\" and \"Turnstile\" are trademarks of Cloudflare, Inc. \"Elementor\" is a trademark of Elementor Ltd. These names are used only to describe compatibility.<\/p>\n\n\n
\n- Upload the plugin to
\/wp-content\/plugins\/<\/code> or install it from the Plugins screen.<\/li>\n- Activate it.<\/li>\n
- Go to Settings \u2192 CWeb Form Protection<\/strong> and enter your Cloudflare site key<\/strong> and secret key<\/strong>.<\/li>\n
- (Elementor) Edit a form, add the Cloudflare Turnstile<\/strong> field where you want the widget, then save.<\/li>\n
- (WordPress forms) Enable the toggles for login, registration, lost password and\/or comments.<\/li>\n<\/ol>\n\n\n
\nDoes it protect every Elementor form automatically?<\/h3><\/dt>\nBy default, no \u2014 and that is the point. You add the Turnstile field only to the forms you want to protect, and forms without the field are left untouched. If you prefer, turn on Settings \u2192 CWeb Form Protection \u2192 Elementor Pro forms \u2192 \"All Elementor Pro forms\"<\/strong> to protect every Elementor Pro form automatically, without adding the field to each one.<\/p><\/dd>\nDoes it work without Elementor Pro?<\/h3><\/dt>\nThe Elementor field needs Elementor Pro (Forms is a Pro module). The WordPress login, registration, lost password and comment integrations work on any WordPress site.<\/p><\/dd>\n
Is the secret key safe?<\/h3><\/dt>\nYes. The secret key is stored server-side, is never printed in the page, and is never sent to the browser. The settings screen never displays it back.<\/p><\/dd>\n
I already use \"Simple Cloudflare Turnstile\". Do I have to recreate my keys?<\/h3><\/dt>\nNo. If that plugin's settings are present, the Settings \u2192 CWeb Form Protection<\/strong> page shows an \"Import keys & settings\" button that copies your site key, secret key, appearance options and form toggles over. Your existing Cloudflare keys keep working \u2014 nothing is regenerated, and the other plugin is left untouched.<\/p><\/dd>\nWhat happens if Cloudflare can't be reached?<\/h3><\/dt>\nMissing or invalid tokens are always rejected. If Cloudflare's verification endpoint is unreachable (network error or timeout), the \"If Cloudflare is unreachable\"<\/strong> setting decides whether to block (default, more secure) or allow (more available) the submission.<\/p><\/dd>\n\n<\/dl>\n\n\n1.1.1<\/h4>\n\n\n- Fix: replying to a comment from the WordPress admin (the
replyto-comment<\/code> AJAX action) was blocked when \"Protect comments\" was enabled. WordPress builds those replies server-side with no Turnstile widget, so no token is ever sent. Moderators now skip the check in the admin AJAX context; the public comment form stays protected.<\/li>\n- Fix: a widget hitting a persistent render error (for example a site key restricted to another domain) retried forever, flooding Cloudflare with failed requests and flickering. It now retries a couple of times to recover from a transient network glitch, then stops; a successful challenge clears the counter. No change to server-side verification.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- New: optional \"Protect all Elementor Pro forms\" setting (off by default). When enabled, the Turnstile widget is added to every Elementor Pro form automatically \u2014 including forms loaded in popups or via AJAX \u2014 without adding the per-form field. The per-form field remains the default.<\/li>\n<\/ul>\n\n
1.0.1<\/h4>\n\n\n- Fix: the Cloudflare Turnstile widget now renders on the WooCommerce \"Lost password\" form (\/my-account\/lost-password\/). Previously the widget did not appear and every password reset was rejected.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial release: per-form Turnstile field for Elementor Pro; WordPress login, registration, lost password and comment integrations; global appearance settings; strict server-side verification.<\/li>\n<\/ul>","raw_excerpt":"Add Cloudflare Turnstile to your forms \u2014 with a per-form field for Elementor Pro so you choose exactly which forms are protected.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/323710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=323710"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/alexandreminem"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=323710"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=323710"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=323710"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=323710"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=323710"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=323710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}