Tired of annoying CAPTCHAs that frustrate your visitors? Say goodbye to distorted text puzzles and hello to
Cloudflare Turnstile - the next-generation CAPTCHA solution that protects your WordPress site without compromising user experience.
By MountDev: Cloudflare Turnstile brings enterprise-grade bot protection to your WordPress site with zero hassle. Powered by Cloudflare's cutting-edge Turnstile technology, this plugin seamlessly integrates with your existing forms to stop spam, prevent automated attacks, and protect your site - all while keeping your legitimate users happy.
Why Choose Cloudflare Turnstile?
Better User Experience
Unlike traditional CAPTCHAs that force users to decipher distorted text or identify traffic lights, Cloudflare Turnstile works invisibly in the background. Most legitimate users won't even notice it's there - they'll just submit their forms and move on. No more frustrated visitors abandoning your registration or checkout process.
Privacy-First Approach
Cloudflare Turnstile is built with privacy in mind. It doesn't track users across sites or collect unnecessary personal data. Your visitors' privacy is respected, and you stay compliant with modern privacy regulations.
Lightweight & Fast
This plugin is optimized for performance. It won't slow down your site or add bloat to your WordPress installation. The Turnstile widget loads efficiently, and you have full control over script loading behavior to optimize for your specific needs.
Enterprise Security, Free to Use
Leverage the same powerful bot detection technology that protects millions of websites worldwide. Cloudflare's advanced algorithms analyze visitor behavior to distinguish between humans and bots - and it's completely free for most use cases.
Perfect for Every WordPress Site
Whether you're running a simple blog, a membership site, an online store, or a complex multi-site network, this plugin has you covered. It integrates seamlessly with WordPress core forms and extends support to popular plugins like WooCommerce, Contact Form 7, Elementor Pro, and Fluent Forms.
E-commerce Protection
Protect your WooCommerce store from fake registrations, fraudulent checkouts, and spam orders. Enable Turnstile on login, registration, password reset, checkout, and pay-for-order forms. You can even configure it to only appear for guest checkouts, keeping the experience smooth for your registered customers.
Form Builder Integration
Using Contact Form 7, Elementor Pro Forms, or Fluent Forms? No problem. Enable Turnstile across all your forms with a single click, or selectively protect specific forms. You have complete control over where and how protection is applied.
Multisite Ready
Managing a WordPress Multisite network? This plugin is fully compatible and can be configured independently for each site in your network.
Supported Forms
WordPress Core
- Login Form
- Registration Form
- Password Reset Form
- Comment Form
WooCommerce
- Login Form
- Registration Form
- Password Reset Form
- Checkout Form
- Pay for Order Form
Third-Party Form Plugins
- Contact Form 7 (all forms or specific forms via shortcode)
- Elementor Pro Forms (all forms)
- Fluent Forms (all forms with option to exclude specific form IDs)
Additional Features
- Fully compatible with WordPress Multisite environments
- Customizable widget positioning for different form types
- Guest checkout only option for WooCommerce
Powerful Features, Simple Configuration
- Visual Customization - Choose between light, dark, and auto themes to perfectly match your site's design aesthetic. The widget blends seamlessly into your forms.
- Global Language Support - Set the preferred display language for the Turnstile widget to match your audience. Provide a localized experience for your international visitors.
- Flexible Appearance Modes - Configure the widget to always be visible, or use managed/non-interactive modes where it only appears when suspicious activity is detected. Balance security with user experience.
- Form Submission Control - Enable submit button locking to prevent users from submitting forms until Turnstile validation is complete. Ensure every submission is verified.
- Branded Error Messages - Customize the error message displayed when validation fails. Maintain your brand voice even in error states and provide helpful guidance to users.
- Precise Widget Positioning - Control exactly where the Turnstile widget appears on different form types. Place it before or after buttons, within specific form sections, or wherever makes the most sense for your layout.
- Built-in Credential Testing - Verify your Cloudflare API keys are working correctly with one click. No more guessing if your configuration is correct - get instant confirmation.
- Performance Optimization - Enable script deferral to optimize page load times. The plugin is designed to be lightweight and won't bog down your site.
- Granular Form Control - Enable protection globally across all forms of a certain type, or selectively protect individual forms. You decide the level of security for each form.
- Guest Checkout Options - For WooCommerce stores, optionally show Turnstile only for guest checkouts while keeping the experience frictionless for logged-in customers.
- Developer Friendly - Clean, well-documented code that follows WordPress coding standards. Hooks and filters available for advanced customization.
1.0.5 - 2025-11-17
Critical Hotfix
- WP Remote 2FA (Disabled): Fixed login redirect issue when WP Remote 2FA is disabled
- Fixed infinite redirect loop where users were stuck on login page after successful authentication
- Added
login_init hook to redirect already-logged-in users to admin dashboard
- Improved session validation to only skip Turnstile when user is authenticated (WP_User object)
- Added
wp_login_failed hook to clear session on failed login attempts
- Fixed Turnstile widget re-appearing after wrong credentials
- Added Theme My Login plugin support for custom login pages
Bug Fixes
- Session Management: Enhanced session handling for WP Remote AJAX login flow
- Session now properly validates user authentication state before skipping Turnstile
- Session cleared on login failures to force Turnstile re-verification
- Fixed white page issue when accessing login page while already logged in
- Logout Functionality: Fixed logout being blocked by overly aggressive redirect logic
- Added action parameter check to prevent redirect during logout, register, lostpassword actions
- Theme My Login logout/register/lostpassword actions now work correctly
Technical Improvements
- Simplified session-verified token handling in
mountdev_turnstile_check()
- Enhanced
mountdev_turnstile_wp_login_check() to validate user authentication state
- Added
mountdev_turnstile_redirect_if_logged_in() function for proper redirect handling
- Added
mountdev_turnstile_wp_login_failed_clear() to clear session on failed attempts
- Improved compatibility with custom login page plugins (Theme My Login)
1.0.4 - 2025-11-05
New Features
- WPRemote 2FA Support: Full integration with WPRemote Two-Factor Authentication on WordPress login forms
- Seamless 2FA flow without requiring Turnstile re-verification after 2FA code submission
- Automatic detection and handling of WPRemote 2FA workflow
- Submit button remains enabled when 2FA field appears
- Session-based verification state tracking across multi-step authentication
Bug Fixes
- WordPress Login with 2FA: Fixed "Please verify that you are human" error when submitting 2FA code with WPRemote
- Submit Button State: Fixed submit button remaining disabled after 2FA field appears dynamically
Technical Improvements
- Enhanced frontend JavaScript to detect and handle WPRemote 2FA field structure
- Added MutationObserver to monitor for dynamically appearing 2FA fields
- Improved form submission logic to bypass Turnstile check for 2FA code submissions
- Updated backend to skip Turnstile verification when
twofa_code parameter is present
- Added comprehensive documentation in
docs/WPREMOTE_2FA_SUPPORT.md
- Updated all asset versions to 1.0.4 for cache busting
1.0.3 - 2025-10-30
Security Enhancements
- Encrypted Credential Storage: API credentials (Site Key and Secret Key) are now encrypted in the database using AES-256-CBC encryption
- Automatic Migration: Existing installations automatically migrate plain-text credentials to encrypted format on update - no manual action required
- API test status automatically reset after migration to verify encrypted credentials work correctly
- UI Security Improvements: Credentials are no longer visible or copyable from the settings page
- Password fields show masked placeholders (e.g.,
••••••••••1234)
- Fields are read-only by default to prevent autofill attacks
- Clear messaging when credentials are securely stored
- Backward Compatibility: Fully compatible with existing installations - seamless migration for all ~200 existing users
Bug Fixes
- WooCommerce Block Checkout: Fixed "Invalid input for parameter 'sitekey'" error caused by encrypted credentials being passed directly to Turnstile widget
- Contact Form 7: Fixed site key retrieval to use decrypted credentials
- Elementor Pro Forms: Fixed site key retrieval to use decrypted credentials
- All Integrations: Updated all credential retrieval points to properly decrypt stored credentials
Technical Improvements
- Added
CFTurnstile_Encryption class for secure credential management
- Added helper functions
mountdev_turnstile_get_site_key() and mountdev_turnstile_get_secret_key() for consistent credential access
- Updated all integrations (WooCommerce, Contact Form 7, Fluent Forms, Elementor, WordPress core) to use helper functions
- Encryption keys derived from WordPress salts for unique per-installation security
- Updated asset versions to 1.0.3 for cache busting
1.0.2 - 2025-10-27
Bug Fixes
- WooCommerce Blocks Checkout: Fixed "Please verify that you are human" error on checkout
- WooCommerce Lost Password: Fixed issue where the "Please verify that you are human" error would appear even after successful verification
- Button Disabling: Fixed issue where submit buttons would be disabled even when the "Disable Submit Button" setting was unchecked
- Elementor Integration: Fixed critical JavaScript errors preventing form submissions
- Fixed "Invalid or missing type for parameter 'sitekey', expected 'string', got 'object'" error in form re-render functions
- Fixed PHP validation to properly accept alphanumeric Elementor form IDs (previously only accepted numeric IDs)
- Updated callback function references to use proper function objects instead of string names
1.0.1 - 2025-10-22
Bug Fixes & Improvements
- Fixed: Admin test credentials button now always enabled and functional - you can re-test your API keys at any time
- Fixed: WooCommerce block-based checkout Turnstile verification now works correctly with improved error handling
- Improved: Enhanced Cloudflare API response validation to prevent processing invalid responses
- Improved: Better error handling for network communication failures with Cloudflare's service
- Code Quality: Stricter type checking and validation throughout verification functions
1.0.0 - 2025-10-21
Initial Release - Welcome to Cloudflare Turnstile for WordPress!
We're excited to bring enterprise-grade bot protection to WordPress with this first release. Here's everything included:
Core WordPress Integration
- Full support for WordPress login forms - protect your admin area from brute force attacks
- Registration form protection - stop fake account creation and spam registrations
- Password reset form security - prevent automated password reset abuse
-
Comment form spam prevention - say goodbye to comment spam forever
WooCommerce E-commerce Protection
-
WooCommerce login and registration forms - protect your customer accounts
- Password reset security for WooCommerce accounts
- Checkout form protection - stop fraudulent orders and fake transactions
- Pay for Order page security - protect payment processing pages
- Guest checkout options - show Turnstile only for guests, not logged-in customers
-
Flexible widget positioning for checkout pages
Third-Party Form Plugins
-
Contact Form 7 - Enable globally or use shortcode for specific forms
- Elementor Pro Forms - Full integration with customizable positioning
-
Fluent Forms - Protect all forms with option to exclude specific form IDs
Customization & Control
-
Three visual themes (light, dark, auto) to match any design
- Multi-language support for global audiences
- Flexible appearance modes (always visible, managed, non-interactive)
- Customizable widget positioning for each form type
- Custom error messages to maintain your brand voice
-
Submit button locking for enhanced security
Performance & Testing
-
Lightweight, optimized code that won't slow down your site
- Script deferral options for improved page load times
- Built-in credential testing - verify your setup with one click
-
Clean, well-documented code following WordPress standards
Enterprise Features
-
WordPress Multisite compatibility
- Developer-friendly with hooks and filters
- Granular control over which forms to protect
- Automatic redirect to settings on activation