Cloudflare Turnstile

Pro

Protect forms with a Cloudflare Turnstile widget, verified on the server and configured to fail closed.

Get xpac Pro Read the docs

One licence covers every Pro plugin

Visitor

a token, verified server-side

Turnstile

Verified

Version: 1.0.0
WordPress: 6.5+
PHP: 7.4+
Tested up to: 7.1
Licence: GPLv3

What it does

No puzzles for your visitors

Turnstile decides from browser signals rather than traffic lights and bicycles, so most people never notice it is there.

Sized and themed to the form

Normal or compact, light, dark or automatic, and shown always or only when Turnstile wants an interaction.

Fails closed by design

A missing key, an unreachable verifier or an unverified token all reject the submission. A misconfiguration cannot quietly turn the protection off.

Getting it working

01
Create a Turnstile widget

In the Cloudflare dashboard, add a Turnstile site and copy its site key and secret key.
02
Add both keys

Paste them into the xpac settings screen and choose the appearance, mode and size.
03
Enable it per form

Switch Turnstile on for the forms that need it.

Every setting

What you can configure, and where it lives. Site settings apply everywhere; the rest are set on the form itself.

Setting	Scope	Notes
Site Key	Site setting	Public. Reaches the browser.
Secret Key	Site setting	Write-only. Server side only.
Appearance mode	Site setting	Always, or interaction only.
Theme	Site setting	Light, dark or auto.
Size	Site setting	Normal or compact.

Questions

Ask support

Do I need my site on Cloudflare?

No. Turnstile works on any host. You only need a free Cloudflare account to create the widget.

Is it free?

Turnstile itself is free from Cloudflare. This plugin is part of xpac Pro.

What does “fails closed” mean in practice?

If verification cannot happen, the submission is rejected with a clear message rather than accepted unchecked. You lose the odd submission during an outage instead of taking a flood of spam.

Can I use it with reCAPTCHA at the same time?

You can, but there is rarely a reason to. Pick one challenge and pair it with Akismet if you want a second opinion on content.

More in Anti-spam & security

All plugins

Pro MaxMind Look up a visitor's country from their IP address using MaxMind's GeoLite2 service, so XPAC User Targeting can vary popups and forms by country. Pro Google reCAPTCHA Protect XPAC Forms with Google reCAPTCHA v3 scores, server-side verification, and fail-closed configuration checks. Pro Akismet Classify XPAC Forms submissions with Akismet while keeping credentials write-only and failures reviewable.

Start using Cloudflare Turnstile