{"id":332702,"date":"2026-06-28T18:38:09","date_gmt":"2026-06-28T18:38:09","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/empex-cloudflare-turnstile\/"},"modified":"2026-06-28T18:37:29","modified_gmt":"2026-06-28T18:37:29","slug":"empex-cloudflare-turnstile","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/empex-cloudflare-turnstile\/","author":23523928,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.0","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Empex CAPTCHA for Cloudflare Turnstile","header_author":"Empex Digital","header_description":"Invisible bot protection for WordPress forms via Cloudflare Turnstile.","assets_banners_color":"cbe4d6","last_updated":"2026-06-28 18:37:29","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/www.empexdigital.com\/products\/","header_author_uri":"https:\/\/empexdigital.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":45,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"empexdigital","date":"2026-06-28 18:37:29"}},"upgrade_notice":{"1.0.0":"<p>Initial release. No upgrade action required.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3589136,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3589136,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3589136,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.JPG":{"filename":"screenshot-1.JPG","revision":3589136,"resolution":"1","location":"assets","locale":"","width":1191,"height":1045},"screenshot-2.JPG":{"filename":"screenshot-2.JPG","revision":3589136,"resolution":"2","location":"assets","locale":"","width":1193,"height":1045},"screenshot-3.PNG":{"filename":"screenshot-3.PNG","revision":3589136,"resolution":"3","location":"assets","locale":"","width":1190,"height":1673},"screenshot-4.PNG":{"filename":"screenshot-4.PNG","revision":3589136,"resolution":"4","location":"assets","locale":"","width":1190,"height":1221}},"screenshots":{"1":"Settings page \u2014 API key setup with onboarding wizard and live key verification.","2":"Integration toggles \u2014 enable protection on 25+ supported form plugins with one click.","3":"Log viewer \u2014 real-time dashboard showing blocked attempts, pass rates, and form-level stats.","4":"WordPress Login form \u2014 the Turnstile widget rendering cleanly inside the login form."}},"plugin_section":[],"plugin_tags":[362,3882,600,599,214603],"plugin_category":[44,54],"plugin_contributors":[269312],"plugin_business_model":[],"class_list":["post-332702","plugin","type-plugin","status-publish","hentry","plugin_tags-captcha","plugin_tags-cloudflare","plugin_tags-security","plugin_tags-spam","plugin_tags-turnstile","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-empexdigital","plugin_committers-empexdigital"],"banners":{"banner":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/banner-772x250.png?rev=3589136","banner_2x":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/banner-1544x500.png?rev=3589136","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/icon-256x256.png?rev=3589136","icon_2x":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/icon-256x256.png?rev=3589136","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/screenshot-1.JPG?rev=3589136","caption":"Settings page \u2014 API key setup with onboarding wizard and live key verification."},{"src":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/screenshot-2.JPG?rev=3589136","caption":"Integration toggles \u2014 enable protection on 25+ supported form plugins with one click."},{"src":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/screenshot-3.PNG?rev=3589136","caption":"Log viewer \u2014 real-time dashboard showing blocked attempts, pass rates, and form-level stats."},{"src":"https:\/\/ps.w.org\/empex-cloudflare-turnstile\/assets\/screenshot-4.PNG?rev=3589136","caption":"WordPress Login form \u2014 the Turnstile widget rendering cleanly inside the login form."}],"raw_content":"<!--section=description-->\n<p><strong>Empex CAPTCHA for Cloudflare Turnstile<\/strong> adds invisible, privacy-friendly bot protection to every form on your WordPress site using <a href=\"https:\/\/www.cloudflare.com\/products\/turnstile\/\">Cloudflare Turnstile<\/a>. No puzzles. No friction. No CAPTCHAs.<\/p>\n\n<h4>Supported Forms<\/h4>\n\n<ul>\n<li><strong>WordPress Core<\/strong> \u2014 Login, Registration, Password Reset, Comments<\/li>\n<li><strong>WooCommerce<\/strong> \u2014 Classic Checkout, Blocks Checkout, My Account (Login, Register, Lost Password)<\/li>\n<li><strong>Contact Form 7<\/strong> \u2014 Automatic or manual widget injection<\/li>\n<li><strong>WPForms<\/strong> (Lite &amp; Pro)<\/li>\n<li><strong>Gravity Forms<\/strong><\/li>\n<li><strong>Fluent Forms<\/strong><\/li>\n<li><strong>Elementor Pro<\/strong> \u2014 Inline forms and popups<\/li>\n<li><strong>Formidable Forms<\/strong><\/li>\n<li><strong>Forminator<\/strong><\/li>\n<li><strong>Kadence Forms<\/strong><\/li>\n<li><strong>SureForms<\/strong><\/li>\n<li><strong>Jetpack Forms<\/strong><\/li>\n<li><strong>MemberPress<\/strong> \u2014 Registration, Login<\/li>\n<li><strong>Ultimate Member<\/strong> \u2014 Register, Login, Profile<\/li>\n<li><strong>Paid Memberships Pro<\/strong> \u2014 Checkout, Login<\/li>\n<li><strong>BuddyPress<\/strong> \u2014 Registration<\/li>\n<li><strong>wpDiscuz<\/strong> \u2014 Comments<\/li>\n<li><strong>WP User Manager<\/strong> \u2014 Register, Login, Password Reset<\/li>\n<li><strong>Easy Digital Downloads<\/strong> \u2014 Checkout<\/li>\n<\/ul>\n\n<h4>Key Features<\/h4>\n\n<ul>\n<li>\ud83d\udd12 <strong>Invisible protection<\/strong> \u2014 legitimate users never see a challenge<\/li>\n<li>\u26a1 <strong>One-click setup<\/strong> \u2014 enter your Cloudflare keys, enable forms, done<\/li>\n<li>\ud83d\udee1\ufe0f <strong>Token replay prevention<\/strong> \u2014 server-side one-time-use enforcement<\/li>\n<li>\ud83d\udd04 <strong>AJAX-safe<\/strong> \u2014 tokens refresh automatically after failed submissions<\/li>\n<li>\ud83d\udcca <strong>Logging dashboard<\/strong> \u2014 see blocked attempts, pass rates, form-level stats<\/li>\n<li>\ud83c\udf10 <strong>Multisite compatible<\/strong> \u2014 network or per-site activation<\/li>\n<li>\ud83e\udde9 <strong>Developer-friendly<\/strong> \u2014 filters, shortcode, extensible integration base<\/li>\n<li>\u267f <strong>Accessible<\/strong> \u2014 WCAG 2.1 AA on admin screens, ARIA labels on widgets<\/li>\n<\/ul>\n\n<h4>How It Works<\/h4>\n\n<ol>\n<li>Install and activate the plugin<\/li>\n<li>Enter your Cloudflare Turnstile Site Key and Secret Key<\/li>\n<li>Toggle which forms to protect<\/li>\n<li>That's it \u2014 bots are blocked, real users pass through invisibly<\/li>\n<\/ol>\n\n<h4>External Service<\/h4>\n\n<p>This plugin connects to the <strong>Cloudflare Turnstile<\/strong> service to verify form submissions:<\/p>\n\n<ul>\n<li><strong>Cloudflare Turnstile API<\/strong>: <code>https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code><\/li>\n<li><strong>Cloudflare Turnstile JavaScript<\/strong>: <code>https:\/\/challenges.cloudflare.com\/turnstile\/v0\/api.js<\/code><\/li>\n<\/ul>\n\n<p>When a user submits a form, their browser interaction data, IP address, and browser fingerprint are sent to Cloudflare for verification. This is required for the plugin to function.<\/p>\n\n<ul>\n<li><a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Cloudflare Privacy Policy<\/a><\/li>\n<li><a href=\"https:\/\/www.cloudflare.com\/website-terms\/\">Cloudflare Terms of Service<\/a><\/li>\n<\/ul>\n\n<p>The plugin itself does not store personal data by default. IP address logging is opt-in and must be explicitly enabled in Settings.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>empex-cloudflare-turnstile<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install directly from the WordPress plugin directory.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Go to <strong>Settings \u2192 Empex Cloudflare Turnstile<\/strong>.<\/li>\n<li>Enter your Cloudflare Turnstile <strong>Site Key<\/strong> and <strong>Secret Key<\/strong> (get them from the <a href=\"https:\/\/dash.cloudflare.com\/\">Cloudflare Dashboard<\/a>).<\/li>\n<li>Click <strong>Verify &amp; Save<\/strong> to confirm your keys work.<\/li>\n<li>Enable protection on the forms you want to protect.<\/li>\n<\/ol>\n\n<h4>Recommended: Define Keys in wp-config.php<\/h4>\n\n<p>For production sites, define your keys as constants in <code>wp-config.php<\/code> to prevent exposure via the database:<\/p>\n\n<pre><code>define( 'EMPEX_CT_SITE_KEY', 'your-site-key-here' );\ndefine( 'EMPEX_CT_SECRET_KEY', 'your-secret-key-here' );\n<\/code><\/pre>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20cloudflare%20account%3F\"><h3>Do I need a Cloudflare account?<\/h3><\/dt>\n<dd><p>Yes. You need a free Cloudflare account to obtain Turnstile API keys. Turnstile itself is free for unlimited use.<\/p><\/dd>\n<dt id=\"will%20this%20slow%20down%20my%20site%3F\"><h3>Will this slow down my site?<\/h3><\/dt>\n<dd><p>No. The Cloudflare Turnstile script is loaded asynchronously and only on pages with protected forms. The plugin adds less than 5ms to server-side processing.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20cloudflare%20is%20down%3F\"><h3>What happens if Cloudflare is down?<\/h3><\/dt>\n<dd><p>You can configure \"Soft-Fail\" mode in Settings \u2192 Behaviour. In soft-fail mode, form submissions are allowed through (and logged) when Cloudflare is unreachable. In block mode (default), submissions are rejected.<\/p><\/dd>\n<dt id=\"does%20this%20work%20with%20page%20caching%3F\"><h3>Does this work with page caching?<\/h3><\/dt>\n<dd><p>Yes. The Turnstile widget renders fresh on each page visit regardless of HTML caching. We recommend excluding <code>\/wp-admin\/admin-ajax.php?action=empex_*<\/code> from your cache rules.<\/p><\/dd>\n<dt id=\"what%20if%20javascript%20is%20disabled%3F\"><h3>What if JavaScript is disabled?<\/h3><\/dt>\n<dd><p>The widget won't render and no token will be generated. The server treats this as a missing token and applies your configured fail mode (block or soft-fail).<\/p><\/dd>\n<dt id=\"is%20this%20gdpr%20compliant%3F\"><h3>Is this GDPR compliant?<\/h3><\/dt>\n<dd><p>The plugin itself collects no personal data by default. Cloudflare Turnstile is documented as GDPR-compliant by Cloudflare. IP address logging in the plugin is opt-in. See our privacy policy suggestion in Settings \u2192 Privacy.<\/p><\/dd>\n<dt id=\"can%20i%20use%20this%20with%20custom%20forms%3F\"><h3>Can I use this with custom forms?<\/h3><\/dt>\n<dd><p>Yes. Use the <code>[empex_ct_turnstile]<\/code> shortcode to add a widget to any form. Developers can verify tokens server-side using the <code>empex_ct_verify_shortcode<\/code> filter.<\/p><\/dd>\n<dt id=\"does%20it%20support%20multisite%3F\"><h3>Does it support multisite?<\/h3><\/dt>\n<dd><p>Yes. The plugin supports both network-wide and per-site activation. Settings are stored per-site.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<li>Core WordPress form protection: Login, Registration, Password Reset, Comments<\/li>\n<li>WooCommerce integration: Classic Checkout, Blocks Checkout, Account forms<\/li>\n<li>Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Elementor Pro support<\/li>\n<li>MemberPress, Ultimate Member, Paid Memberships Pro, BuddyPress, wpDiscuz support<\/li>\n<li>Easy Digital Downloads, Formidable, Forminator, Kadence, SureForms, Jetpack Forms<\/li>\n<li>Ninja Forms, Everest Forms, JetFormBuilder, weForms, Empex Form Builder support<\/li>\n<li>Admin settings with first-run onboarding wizard<\/li>\n<li>Clean widget fit on narrow login\/register\/lost-password forms (standard widget seated inside the login card)<\/li>\n<li>Token replay prevention with SHA-256 transients<\/li>\n<li>Rate limiting (configurable per IP) including failed attempts<\/li>\n<li>AES-256-GCM secret key encryption<\/li>\n<li>Event logging with retention and row cap<\/li>\n<li>Block and soft-fail modes<\/li>\n<li>Competing Turnstile plugin conflict detection<\/li>\n<li>Shortcode: [empex_ct_turnstile]<\/li>\n<li>WCAG 2.1 AA accessible admin UI<\/li>\n<li>Full multisite support<\/li>\n<li>Privacy policy integration<\/li>\n<li>PHPUnit test suite<\/li>\n<\/ul>","raw_excerpt":"Invisible bot protection for WordPress forms via Cloudflare Turnstile. Install once \u2014 protect every form.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/332702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=332702"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/empexdigital"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=332702"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=332702"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=332702"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=332702"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=332702"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=332702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}