Linux 软件免费装
Banner图

Kitgenix CAPTCHA for Cloudflare Turnstile

开发者 kitgenix
carlbensy16
更新时间 2026年1月2日 03:20
捐献地址: 去捐款
PHP版本: 8.0 及以上
WordPress版本: 6.9
版权: GPLv3 or later
版权网址: 版权信息

标签

captcha woocommerce anti-spam cloudflare turnstile

下载

1.0.12.1 1.0.13 1.0.12 1.0.11 1.0.14 1.0.15 1.0.8 1.0.7 1.0.10 1.0.9 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6

详情介绍:

Spam is expensive. It wastes time, fills your inbox, creates fake accounts, and on WooCommerce sites it can even lead to abandoned checkout noise and fraudulent activity. At the same time, traditional CAPTCHA systems can hurt conversions. If real customers have to click traffic lights and buses just to place an order, you’ll feel it in your revenue. Cloudflare Turnstile is designed to solve that: it’s a modern, privacy-first CAPTCHA alternative that reduces friction for real people while still blocking bots. Kitgenix CAPTCHA for Cloudflare Turnstile is a production-ready Turnstile integration for WordPress that focuses on three things: It works across the places spam actually happens, it validates properly on the server, and it stays fast. This plugin adds Cloudflare Turnstile to WordPress core forms, WooCommerce checkout and account forms (including WooCommerce Blocks / Store API checkout), Elementor (forms and popups), Easy Digital Downloads, BuddyPress and bbPress, plus a range of popular form plugins like Contact Form 7, WPForms, Gravity Forms, Forminator, Fluent Forms, Formidable and more. It also includes security features you’d expect from a serious implementation: replay protection, proxy-aware client IP handling, flexible whitelisting, and a developer mode that lets you log failures without blocking users. Cloudflare Turnstile for WordPress, WooCommerce and forms (without the usual headaches) Many Turnstile plugins work “in simple cases”, then break when you: enable caching, switch to WooCommerce Blocks checkout, use an Elementor popup, or run behind Cloudflare / a reverse proxy. Kitgenix Turnstile is built to handle those real-world setups. It uses conditional script loading, renders widgets carefully to avoid duplicates, and verifies tokens server-side using Cloudflare’s official endpoint. If you’re looking for: Where Turnstile is added (supported integrations) You can enable or disable each integration from the settings, so you only protect what you need. WordPress Core: Login, registration, lost password, reset password, comments.\ This includes special handling for WooCommerce product reviews where needed so the widget appears in the right place. WooCommerce (Classic): Checkout, My Account login, My Account registration, lost password. WooCommerce Blocks (Store API): Blocks checkout UI rendering plus server-side validation of Store API checkout requests. This matters for modern WooCommerce sites that use the block-based checkout. Elementor (Page Builder): Elementor forms and dynamic content. Designed to behave correctly with popups, delayed popups, AJAX submission and multiple forms on one page. Easy Digital Downloads: Adds Turnstile protection to key EDD flows to reduce automated purchases and abuse. Forms: Contact Form 7, WPForms, Gravity Forms, Forminator, Fluent Forms, Formidable, Jetpack Forms, Kadence Forms. Forums / community: bbPress topic and reply forms, plus BuddyPress flows where spam signups and automated posting are common. Why Kitgenix Turnstile is different It validates on the server (properly). A CAPTCHA is only as good as its verification. This plugin verifies tokens server-side against Cloudflare’s official siteverify endpoint for supported forms. Missing, expired and invalid tokens are handled consistently. Replay protection is enabled by default. Bots love replaying tokens. Kitgenix caches recent tokens (hashed) and rejects re-use. TTL is filterable. It’s proxy-aware, without trusting spoofed headers. If your site sits behind Cloudflare or another proxy, IP headers like CF-Connecting-IP and X-Forwarded-For are only trustworthy if the request is actually coming from your proxy. This plugin lets you configure trusted proxies so headers are honoured safely. It stays fast. Turnstile scripts are conditionally loaded only where needed. The plugin uses modern WordPress script loading and keeps public CSS scoped and lightweight. It’s built for dynamic forms. Elementor popups, AJAX forms, multi-step flows and dynamically injected forms are common sources of “widget didn’t render” issues. This plugin listens for the events those systems use and triggers safe re-renders when appropriate. It includes a staging-friendly mode. Developer mode (warn-only) logs failures but doesn’t block submissions. That’s ideal when you want to test keys, caching behaviour or proxy settings without risking customer friction. Manual placement (shortcode) If you have a custom theme form or a plugin we don’t support yet, you can manually render the widget using: [kitgenix_turnstile] Many integrations also support “shortcode only” behaviour to give you full control over placement. Quick Start (recommended setup)
  1. Install and activate the plugin.
  2. Open the Turnstile settings under the Kitgenix hub in wp-admin.
  3. Add your Cloudflare Turnstile Site Key and Secret Key.
  4. Enable the integrations you want (WordPress, WooCommerce, forms, etc).
  5. Save changes, then test the forms that matter most: login, checkout, registration and your main contact form.
Tip: Use Developer mode (warn-only) first on staging or during initial rollout. Once you’re happy, disable warn-only to enforce strict blocking. Performance and caching notes (important for WooCommerce sites) Turnstile is lightweight, but aggressive optimisation can break it if the loader is delayed too heavily. If you use caching or optimisation plugins:

安装:

  1. Go to Plugins → Add New.
  2. Search for “Kitgenix Turnstile” and click Install Now.
  3. Activate the plugin.
  4. Open the settings under the Kitgenix hub.
  5. Enter your Site Key and Secret Key from Cloudflare Turnstile.
  6. Enable the integrations you want and save.

屏幕截图:

  • WordPress registration form protected (anti-spam for new accounts).
  • WooCommerce Classic checkout protected near the Place order area.
  • WooCommerce Blocks / Store API checkout protected inside the block-based checkout UI.
  • WooCommerce My Account login/register protected (reduces bot account creation and login abuse).
  • Contact Form 7 form protected (Turnstile injected and validated correctly).
  • WPForms form protected (works with AJAX and standard submissions).
  • Elementor form protected on a landing page.
  • Settings overview: keys, display options, integration toggles and security features.
  • Security settings: replay protection, proxy trust configuration and whitelisting rules.

升级注意事项:

1.0.15 Maintenance and compatibility update. Recommended for all sites.

常见问题:

Do I need a Cloudflare account?

Yes. You need Turnstile keys from Cloudflare. A free account is enough.

Is Cloudflare Turnstile a reCAPTCHA alternative?

Yes. Turnstile is widely used as a privacy-first alternative to Google reCAPTCHA and typically offers a smoother experience for real users.

Does this plugin support WooCommerce checkout?

Yes. It supports WooCommerce Classic checkout and also WooCommerce Blocks / Store API checkout.

Do you verify tokens on the server?

Yes. Tokens are verified server-side using Cloudflare’s official siteverify endpoint.

What is replay protection?

Replay protection blocks re-used tokens (a common bot technique). It is enabled by default and can be tuned via a filter.

Does it work with Elementor forms and popups?

Yes. Elementor is supported with attention to popups, delayed popups, AJAX flows and multiple forms on a page.

Which form plugins are supported?

Contact Form 7, WPForms, Gravity Forms, Forminator, Fluent Forms, Formidable, Jetpack Forms and Kadence Forms.

Do you support bbPress and BuddyPress?

Yes. The plugin includes integrations for bbPress and BuddyPress to reduce automated spam posting and related abuse.

Does it support Easy Digital Downloads?

Yes. The plugin includes an EDD integration to help protect key EDD flows from automated abuse.

Can I whitelist logged-in users or certain IPs?

Yes. You can whitelist logged-in users, IPs (including CIDR and wildcards) and user agents. Developers can also filter whitelist behaviour.

I’m behind Cloudflare / a reverse proxy. Is IP handling correct?

Yes. The plugin supports proxy-aware IP detection and lets you configure trusted proxies so headers are honoured safely.

The widget isn’t showing. What should I check?

Check your keys, confirm the integration and form location are enabled, clear caches, and review optimisation settings. If scripts are heavily delayed, allowlist Cloudflare’s Turnstile domain.

Users keep seeing verification errors. Why?

Common causes include cached form pages (token expiry), aggressive script delay, blocked outbound requests to Cloudflare, or misconfigured proxy trust settings. Developer mode (warn-only) can help diagnose without blocking users.

更新日志:

1.0.15 (01 January 2026) 1.0.14 (09 December 2025) 1.0.13 (22 November 2025) 1.0.12.1 (22 November 2025) 1.0.12 (21 November 2025) 1.0.11 (19 October 2025) 1.0.10 (16 October 2025) 1.0.9 (15 October 2025) 1.0.8 (15 October 2025) 1.0.7 (14 October 2025) 1.0.6 (10 September 2025) 1.0.5 (10 September 2025) 1.0.4 (17 August 2025) 1.0.3 (12 August 2025) 1.0.2 (12 August 2025) 1.0.1 (11 August 2025) 1.0.0 (11 August 2025)