Tech Dragon Divi Turnstile Nexus

Protect your Divi-powered WordPress site with Cloudflare Turnstile. Tech Dragon Divi Turnstile Nexus brings Turnstile protection to supported Divi forms, WordPress account and comment workflows, and WooCommerce customer and checkout flows. Instead of treating every visual form or Divi module as a separate transaction, Nexus integrates with the platform that actually processes the submission. The Free edition includes supported Divi, WordPress, and WooCommerce protection. Pro adds centralized management, verification statistics, and supported third-party form integrations for sites with more forms and protection surfaces to oversee. Protection included in Free Native Divi 4 and Divi 5 integration

• Divi Contact Form.
• Divi Email Optin using a supported server-side provider path.
• Turnstile enablement for individual supported Divi forms through Divi's Spam Protection settings.
• Form-specific widget and token handling that preserves Divi's native submission, validation, and feedback behavior.

WordPress protection

• Login.
• Registration.
• Lost-password requests.
• Interactive comments, including supported Divi Comments presentations.

WooCommerce protection

• Customer login, registration, and lost-password requests.
• Product reviews, including supported Divi Woo review presentations.
• Classic Checkout and Checkout Block / Store API checkout.
• Supported Divi Woo checkout layouts inherit the WooCommerce Checkout protection surface rather than adding separate checks for each layout module.

Global settings and site-wide protection

• Configure and verify Cloudflare Turnstile credentials in one place.
• Enable Core Protection for supported WordPress and WooCommerce transactions.
• If WooCommerce is installed or reactivated later, explicitly enable its protection in Nexus Control Center.
• Choose global widget theme, size, and language settings.
• Control optional, conditional Cloudflare preconnect.
• Access basic compatibility information and redacted support diagnostics.

Existing Divi Contact Form and Email Optin modules remain individually configured in Divi. The global Core Protection setting does not override their per-form selections. Why use Nexus?

• Server-side verification: Cloudflare Siteverify validates submitted tokens before the supported transaction is accepted.
• Native submission ownership: WordPress, WooCommerce, and Divi continue to handle their own account, checkout, form, and feedback lifecycles.
• Form and surface isolation: A token for one protected form or transaction cannot simply be claimed by another.
• Fail-closed behavior: Missing, invalid, expired, reused, or mismatched tokens are rejected for protected transactions.
• Careful privacy defaults: Nexus does not send the visitor's IP address in the optional Siteverify remoteip field, and does not collect submitted form content for verification statistics.
• No duplicate protection engines: Supported Divi Login, Comments, and WooCommerce presentation modules inherit the underlying WordPress or WooCommerce transaction protection.

Go further with Nexus Pro Nexus Pro is for administrators managing protection across multiple forms and site workflows. It adds a centralized Protection Surfaces management experience while using the same Core protection integrations as Free.

• Discover supported Divi forms, including verified linked Global Library locations, and view their protection status.
• Review WordPress and WooCommerce protection surfaces in one place.
• Search, filter, and sort supported forms and surfaces.
• Apply supported per-surface protection settings and presentation overrides.
• Enable or disable selected eligible forms and surfaces through centralized and bulk controls.
• Protect qualifying forms from supported MailPoet, WPForms, Mailchimp for WordPress (MC4WP), Constant Contact, and Contact Form 7 versions, plus supported local forms from the official Mailchimp plugin. Native CAPTCHA ownership and unsupported versions remain excluded.
• Identify items that need attention without making unsafe changes to ambiguous forms.
• See successful Turnstile verification counts and reset counters when needed.

A Turnstile verification is a protected submission attempt for which Cloudflare's server-side verification succeeded. It is not a count of completed checkouts, emails delivered, leads, blocked bots, or conversions. Pro is a separately offered paid edition. Free remains functional without a Pro license, including its supported protection integrations. Learn more about the product and Pro edition at https://thetechdragon.dev/. Compatibility and important boundaries

• Supported Divi versions: Divi 4.27.4 or later in the Divi 4 series, and native Divi 5.x. Divi 4 modules embedded in Divi 5 are not the supported native Divi 5 integration path.
• Divi Email Optin protection requires a supported server-side provider flow. Browser-only FeedBurner submissions are not protected.
• WooCommerce Checkout protection covers the supported classic and Checkout Block / Store API transaction paths. A third-party express wallet or payment method that bypasses those authoritative checkout paths is not automatically protected.
• Payment callbacks, redirects, webhooks, and separate 3D Secure steps are not challenged as new checkouts after the authoritative checkout submission.
• A compatible custom login URL can work when it preserves WordPress's native login lifecycle. Independent passwordless or magic-link login systems and separate second-factor screens are not automatically covered.
• WooCommerce Pay for Order, account-profile editing, Add to Cart, cart updates, coupon actions, and shipping calculators are not protected surfaces in this release.
• Third-party forms are not protected just because they appear in a Divi layout. Use the supported Pro integration for eligible Contact Form 7 and other qualified forms; Gravity Forms and unsupported vendor flows are not covered.
• Nexus protects supported interactive comment and review submissions, not arbitrary REST/XML-RPC comment creation enabled through custom code or third-party plugins.

Site owners should test their live form, account, payment gateway, optimization, and caching configurations before relying on protection in production. External service and privacy This plugin uses Cloudflare Turnstile, an external anti-bot service provided by Cloudflare, Inc. A Cloudflare Turnstile site key and secret key are required. Cloudflare's own service terms and privacy documentation apply. When an enabled Turnstile widget is displayed, the visitor's browser loads and communicates with Cloudflare's challenge service at https://challenges.cloudflare.com. Cloudflare may process browser, network, and device signals, including IP-related information, as described in its own policies. When a protected submission is checked, the WordPress server sends the Turnstile response token and configured secret key to Cloudflare's Siteverify endpoint at https://challenges.cloudflare.com/turnstile/v0/siteverify. Nexus does not add the visitor's IP address through the optional remoteip parameter or send submitted form fields to Siteverify. The built-in credential verification test also uses Cloudflare Turnstile.

• Turnstile documentation: https://developers.cloudflare.com/turnstile/
• Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
• Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
• Cloudflare website terms: https://www.cloudflare.com/website-terms/

Freemius: optional connection, updates, and licensing This plugin includes the Freemius SDK, provided by Freemius, Inc., for optional account connection, product updates and notifications, upgrades, and management of paid licenses. Free users see an optional Freemius connection screen and can select Skip without sharing their information with Freemius. The supported Free protection features remain available if they skip. If a site administrator opts in, Freemius may receive that administrator's name and email address, website URL, plugin version and activation status, WordPress and PHP versions, site language, and optionally the site's installed plugins and themes, according to the permissions selected. Freemius uses this information to provide the connected service, product communications, compatibility information, and related account functions. Paid purchases and Pro license activation use Freemius for payment, account and licensing services. Those transactions involve additional purchase, account and billing information under Freemius's terms. The Free opt-in and skip options are distinct from paid license activation.

• Freemius data practices: https://freemius.com/privacy/data-practices/
• Freemius terms of service: https://freemius.com/terms/

Tech Dragon Divi Turnstile Nexus is an independent third-party plugin. It is not affiliated with or endorsed by Elegant Themes or Cloudflare.

1. Install and activate Tech Dragon Divi Turnstile Nexus in WordPress.
2. Make sure your site uses PHP 8.3 or newer, WordPress 7.1 or newer, and a supported Divi version.
3. Create a Cloudflare Turnstile widget and copy its site key and secret key.
4. Open Nexus Control Center in your WordPress dashboard. Save your credentials and complete the built-in Turnstile connection verification.
5. For Divi Contact Form and Email Optin modules, open the module's Spam Protection settings and select Turnstile on each form you want to protect.
6. Enable Core Protection in Nexus Control Center for supported WordPress and WooCommerce workflows.
7. Review global presentation settings, then test your site's published forms, account pages, comments, product reviews, and checkout.

For support and documentation, visit https://thetechdragon.dev/plugins/divi-turnstile-nexus/support/.

1.2.1

• Added Pro support for eligible MailPoet, WPForms, MC4WP, Constant Contact, Contact Form 7, and official Mailchimp signup forms.
• Improved Divi 4 and Divi 5 form reliability, Turnstile compatibility, and secure handling of repeated or expired challenges.
• Improved Pro form discovery, bulk management, and Divi Global Library form-location reporting, including drafts and private pages.
• Simplified Control Center status indicators and show third-party coverage only when compatible forms are found.
• Strengthened server-side verification and form isolation across supported integrations.
• Updated minimum PHP requirement to 8.3.

1.1.0

• Security hardening: enforce server-owned Divi 4 Contact and Email Optin token/action isolation.
• Improved compatibility with third-party plugins' Cloudflare Turnstile implementations (Divi 4 Contact Forms).

1.0.1

• Security hardening.

1.0.0

• Initial Release.