Easy setup, dramatically reduces spam

Unfortunately, bots and spam are part of life these days, but annoying captchas don’t have to be! CloudFlare’s Turnstile captcha is simple, user-friendly (no solving puzzles!), and extremely effective at stopping bots.

This plugin makes implementing it a cinch: just add the needed keys from your CloudFlare account, adjust the settings as you see fit, and your site is protected.

The effectiveness is great: in a few weeks, I’ve had nearly 18,000 malicious attempts (either comment spam or brute-force login attempts). This plugin blocked all but three, and those three were blocked by another line of defense (Akismet for the spam, not having a valid username/password/2FA for the login), all while not interfering with legitimate users at all.

I really like the plugin’s detailed analytics, and it’s interesting to see how the bots just don’t even engage with the captcha at all and instead just try to keep doing their thing, seemingly unaware of their failure.

One very cool feature I like is that I can hide the captcha entirely from view unless CloudFlare decides the captcha requires user interaction. All the other checks are automatic and transparent and the captcha box isn’t shown: for most users, there’s no indication there’s a captcha at all and the forms work as expected without extra clutter. Visitors that CloudFlare judges to be potentially higher risk see the captcha and just need to check a “I’m human.” checkbox. Easy. (I use Turnstile in Managed mode, but you can also use it in a fully-non-interactive way so it’s always invisible at the risk of being slightly less effective at blocking bots.)

While I’ve eventually switched to passkey-only login for accounts so brute-force attacks aren’t an issue, this plugin and Turnstile protect the comment forms from the overwhelming majority of spam attempts which makes my life much easier.

In short: it’s awesome. You should use it.