What Simple Cloudflare Turnstile does to your forms
Simple Cloudflare Turnstile, listed on wordpress.org as “Simple CAPTCHA with Cloudflare Turnstile” by Elliot Sowersby and RelyWP, adds Cloudflare’s Turnstile widget to your forms: the WordPress login, registration, lost password and comment forms, the WooCommerce login and checkout, plus Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Formidable, Forminator, Elementor Pro forms and about twenty other integrations. The visitor’s browser loads the Turnstile script from challenges.cloudflare.com; on submit, your server asks Cloudflare’s API to verify the token before it accepts the form.
Turnstile is Cloudflare’s alternative to the classic CAPTCHA: small invisible JavaScript checks assess the browser, and a checkbox only appears when doubt remains. Your site does not need to run through Cloudflare. The free plan covers up to 20 widgets and unlimited verifications; all you need is a site key and a secret key created in the Cloudflare dashboard.
The plugin itself is completely free, with no paid version, and support happens on the wordpress.org forum. Its settings live under Settings > Cloudflare Turnstile, split into three tabs (“Settings”, “Analytics”, “Import”). Once you enter the keys, a “TEST RESPONSE” button checks that they work: until that test passes, Turnstile is not added to any form.
Which sites Simple Cloudflare Turnstile suits
- Business sites and blogs that get messages or comments from bots and want a filter without image puzzles.
- WooCommerce stores hit by automated account sign-ups or card testing on the checkout page.
- Sites facing brute force attacks on
wp-login.php, alongside a login attempt limit. - Sites moving away from Google reCAPTCHA that still want a backup plan: the plugin can fall back to reCAPTCHA v2 if Cloudflare stops responding.
It is the wrong pick if you refuse any third-party script loaded from Cloudflare’s servers, or if your problem is spam written by humans: Turnstile checks that a real browser sent the form, not what the message says. In that case, a content filter such as Akismet or one of the methods in our WordPress anti-spam guide fits the need better.
Simple Cloudflare Turnstile strengths and limitations
Strengths
- Free from end to end. Neither the plugin nor Turnstile’s free plan caps the number of verifications.
- Lots of integrations. WordPress forms, WooCommerce, about ten form plugins, plus membership and forum plugins are all set up from a single screen.
- Little friction for visitors. In “Interaction Only” mode, the widget stays invisible for most legitimate visitors.
- A built-in backup plan. Failsafe mode lets submissions through or switches to reCAPTCHA v2 when Cloudflare’s API can’t be reached.
- Keys outside the database. You can define the keys in
wp-config.phpinstead of saving them in the settings.
Limitations
- An external service is mandatory. Every protected page loads a Cloudflare script, which belongs in your privacy policy.
- Some express payments go unchecked. On WooCommerce, certain express checkout methods (PayPal, Google Pay, Apple Pay, Amazon Pay) bypass Turnstile.
- A string of bypass fixes. In 2026, several releases fixed flaws that let a form be submitted without passing the challenge.
- No guaranteed support. Help comes through the wordpress.org forum, and the author says he cannot answer every request.
The settings we recommend
Labels from version 1.44.5. After each change, test every protected form from a private window, especially the login form, and keep an admin session open while you test.
| Setting | Recommended value | Why |
|---|---|---|
| “Site Key” and “Secret Key” Settings > Cloudflare Turnstile > Settings | Keys from a widget created for your domain, then “TEST RESPONSE” | Without a passed test, no form is protected. Option: define them in wp-config.php. |
| “Appearance Mode” Settings > Advanced Settings | “Interaction Only” | The widget only shows when an action is needed; “Always” (the default) stays visible to everyone. |
| “WordPress Login”, “WordPress Register”, “WordPress Reset Password” Settings > Default WordPress Forms | On | These are the forms bots target most. |
| “WooCommerce Checkout” Settings > WooCommerce Forms | On, then a test order with each payment method | Blocks automated orders; “Payment Methods to Skip” excludes a payment method that causes trouble. |
| “Logged In Users” Settings > Whitelist Settings | Off (the default) | The plugin itself warns that attackers could bypass Turnstile by creating an account. |
| “Enable Failsafe Mode” and “Failsafe Type” Settings > Failsafe Settings | On, with “Fallback to reCAPTCHA” if you have reCAPTCHA v2 keys | A Cloudflare outage no longer locks you out of your own login; “Allow submissions” lets spam through during the outage. |
| “Defer Scripts” and “Performance Plugin Compatibility” Settings > Advanced Settings > Performance | On (the default) | They keep a caching plugin’s delayed JavaScript from stopping the widget from showing. |
| “Enable Turnstile Analytics” Analytics tab | On | Counts passed and blocked checks per form, without storing IP addresses. |
| “Enable Turnstile Debug Logging” Analytics tab | Off, except while troubleshooting | The log stores the IP address and page URL of every check. |
“Disable Submit Button” locks the submit button until the challenge is complete. Leave it unchecked unless you need it: a bug fixed in 1.42.1 left the button disabled on the login page and could lock you out of your site.
- The settings screen confirms, in green, that Turnstile works with your keys.
- From a private window, login, registration and every protected contact form submit normally.
- A test order goes through with each of the store’s payment methods.
- After a few days, the Analytics tab shows blocked submissions and no complaints from real visitors.
Patched vulnerabilities in Simple Cloudflare Turnstile
For a protection plugin, the main risk is a bypass: a bot that submits the form without solving the challenge. Between September and October 2026, several releases fixed this kind of flaw, including CVE-2026-39741 (Contact Form 7 forms submitted without the challenge, up to 1.44.0, fixed in 1.44.1). CVE-2026-85116, fixed in 1.42.3, was more serious: an anonymous visitor could make the site run any registered shortcode from a Contact Form 7 field. Older, CVE-2023-5135 was a stored XSS through the Gravity Forms shortcode, limited to contributor accounts and fixed in 1.23.2.
The developer handles these reports quickly, which makes automatic updates for this plugin essential (see our guide to automatic plugin updates). WP Masquerade Pro removes the plugin folder and its file addresses from your page code, which makes the plugin harder for bots targeting these flaws to spot, without replacing updates; the Cloudflare script and the cf-turnstile class stay visible.
What WP Masquerade hides for Simple Cloudflare Turnstile
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Simple Cloudflare Turnstile: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- CSS classes
cf-turnstile - files served by the vendor
challenges.cloudflare.com
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Simple Cloudflare Turnstile FAQ
Does my site need to run through Cloudflare?
No. Turnstile works on any site: you only need a free Cloudflare account to create the widget and its two keys.
What happens if Cloudflare goes down?
Without Failsafe mode, protected forms, including the login form, reject submissions while the API can’t be reached. With it, the plugin lets submissions through or shows reCAPTCHA v2 instead, depending on the “Failsafe Type” you chose.
The widget doesn’t show up. What should I check?
Make sure the “TEST RESPONSE” check passed, that the form is ticked in the settings and that “Performance Plugin Compatibility” is on if a caching plugin delays JavaScript. Then clear the page cache.
A 401 error shows up in the browser console. Is that a problem?
No. According to the plugin and Cloudflare, it is a request for a Private Access Token that your browser doesn’t support yet; it doesn’t stop the verification.