Cloudflare Turnstile WordPress: Free Setup in 5 Steps

Cloudflare Turnstile WordPress setups have become the popular answer to form spam for one simple reason: they stop bots without asking people to click traffic lights. For visitors, the check is usually a tiny widget that passes on its own. For you, it is free.

This guide explains what Cloudflare Turnstile is, how it compares with Google reCAPTCHA and hCaptcha, how to add it to your WordPress forms in five steps, and when you do not need a captcha at all.

Why captchas are changing

Captchas were invented to separate people from programs with tasks only people could do: reading distorted letters, then later picking out street signs and shop fronts. Two things went wrong. Computers got very good at those tasks, and people got very tired of them. Every puzzle a visitor must solve is a moment where some give up and leave.

The newer approach, used by Turnstile and by reCAPTCHA v3, moves the work away from the visitor. The checks happen in the background, and most people never know they happened. That is better for conversions and for accessibility, as long as the checks do not wrongly block real people.

What is Cloudflare Turnstile?

Cloudflare Turnstile is a captcha replacement from Cloudflare. Instead of showing puzzles, it runs small, invisible checks in the visitor’s browser and decides whether they look like a person. Most people pass without doing anything. If Turnstile is unsure, it may ask for a single click on a checkbox.

A Cloudflare Turnstile WordPress form works like this: the widget adds a token to the form when the check passes, and when the form is sent, your site asks Cloudflare to confirm the token with your secret key. A bot without a valid token is refused.

How Cloudflare Turnstile decides who is human

Traditional captchas test people: can you read these letters, can you find the bicycles? Cloudflare Turnstile tests the browser instead. It runs a series of small, quick challenges in the background, looking at signals that ordinary browsers produce and simple bots do not. Cloudflare can adjust these challenges over time as bots change.

For the visitor, the result is simple. In most cases Cloudflare Turnstile passes on its own in a moment. If the signals are unclear, the widget may ask for one click. Only a small share of visitors ever need to do anything, and nobody is asked to solve an image puzzle.

Turnstile vs reCAPTCHA vs hCaptcha

All three work. The reason many site owners pick Cloudflare Turnstile for WordPress is the balance: almost no friction for visitors, no puzzles, and no cost.

Do you need a captcha at all?

Before you add any captcha, check whether invisible protection is enough. A honeypot field that only bots fill in, a time check that spots forms sent too fast, and a spam score that looks at the content stop most automated spam with nothing for visitors to do. FillKite has the honeypot and time check on every form by default.

Add Turnstile when spam still gets through those layers, or when a form is a target, such as a sign-up form being hit by bots. Our guide to WordPress form spam explains the layers and the order to add them.

How to set up Cloudflare Turnstile in WordPress in 5 steps

1. Create a free Cloudflare account

Sign up at Cloudflare if you do not have an account. You do not need to add your domain to Cloudflare or change your DNS: Turnstile works on any site.

2. Add a Turnstile widget

In the Cloudflare dashboard, open Turnstile and add a widget. Give it a name, such as “fillkite.com forms”, and add your domain, for example yourdomain.com. Add your staging domain too if you test there.

3. Choose the widget mode

Cloudflare offers three modes:

• Managed, the recommended default: Turnstile decides whether to show a checkbox.
• Non-interactive: a widget is shown, but visitors never need to click it.
• Invisible: nothing is shown at all.

Managed is a sensible choice for most Cloudflare Turnstile WordPress forms. Create the widget, and Cloudflare shows a site key and a secret key.

4. Paste the keys into your form plugin

In FillKite, go to FillKite → Settings → Spam protection, scroll to Captcha, choose Cloudflare Turnstile as the provider, paste the site key and secret key, and save. The captcha becomes active only when a provider and both keys are set, so a half-finished setup never breaks your forms.

5. Test it

Open a page with a form in a private browser window, fill it in, and send it. The widget should pass, the success message should appear, and the entry should reach your inbox. Then check the Turnstile analytics in Cloudflare after a day or two: you should see challenges issued and solved.

Which Cloudflare Turnstile mode should you choose?

Start with Managed. If your form conversion rate drops after adding the widget, try Non-interactive and compare. Our guide to form conversion rate explains how to measure the change fairly.

Which forms need Cloudflare Turnstile most?

Not every form attracts the same bots. Add Turnstile first where the damage from spam is highest:

• Sign-up and newsletter forms, which bots use to flood your list with fake or stolen addresses.
• Download and discount forms, where people and bots grab the offer with throwaway details.
• Forms with auto-replies, which bots can abuse to make your site email strangers.
• Forms that create accounts or posts, where spam turns into content on your site.

A simple contact form protected by a honeypot, a time check and a spam score often needs nothing more.

Speed and privacy

Any captcha adds a script from another company to your page. Keep its cost small:

• Load it only where it is needed. FillKite loads the Turnstile script only on pages that contain a form, not across the whole site.
• Mention it in your privacy policy. Turnstile processes data about the visitor’s browser to decide whether they are human. List Cloudflare as a service used on your forms.
• Do not add it to every form by habit. A newsletter box in your footer may not need it; a heavily attacked sign-up form does.

If the captcha service cannot be reached

Any captcha depends on its provider being reachable. If the service has a problem, or a visitor’s network blocks it, the form can fail to send. Decide in advance which matters more on each form: blocking every possible bot, or never losing a real enquiry.

For most contact and quote forms, losing a real customer is worse than letting an occasional bot through, because the invisible layers still catch most spam. FillKite gives developers a filter, fillkite_captcha_fail_open, to choose how forms behave when the captcha cannot be checked. And because every entry is saved before any email is sent, an accepted entry is never lost later in the process.

Where the widget fits among your layers

Think of spam protection as a set of filters, each catching what the one before missed. The honeypot and time check catch simple bots for free. The spam score catches suspicious content. A rate limit stops floods from one address. The captcha sits after all of these and catches smarter bots that behave almost like browsers. Each layer is cheap on its own, and together they leave very little for you to clean up by hand.

Seen this way, a captcha is not the whole answer to spam. It is one filter, useful when the others are not enough, and easy to remove again if it turns out you do not need it.

Setting it up for clients

If you build sites for clients, create the widget in a Cloudflare account the client owns, or at least one they can access, and note the keys in your handover document. Keys stored only in your own account become a problem the day you part ways. Add both the live and staging domains, and remind the client to update the widget if the domain ever changes.

Turnstile beyond your forms

Your contact and quote forms are one target. Bots also try the WordPress login page, comment forms and shop checkouts. FillKite’s Cloudflare Turnstile setting protects FillKite forms only. For the login screen and comments, use a security plugin or a dedicated Turnstile plugin for those areas, and keep one clear owner for each so settings do not clash.

If your site already runs behind Cloudflare’s network, its bot protection and firewall rules add another layer before requests reach WordPress at all. Use them carefully: rules that are too strict can block real visitors and search engines.

Cloudflare Turnstile and accessibility

One reason to prefer Cloudflare Turnstile over puzzle captchas is accessibility. Image and audio puzzles are hard for people with low vision, people with motor difficulties and many older visitors. Turnstile avoids puzzles, and its checkbox, when shown, is a single control that works with a keyboard and screen readers.

Test it anyway. Fill in your form using only the keyboard, and with your phone’s screen reader switched on. If you get stuck, switch to a mode that asks for less interaction, or rely on invisible protection for that form.

Measure the result

Adding Turnstile should reduce spam without reducing real entries. Check both after two weeks:

1. Spam that reached your inbox: should fall sharply for bot spam.
2. Real entries per week: should stay about the same.
3. Turnstile analytics in Cloudflare: how many challenges were issued, solved and failed.

If real entries fall, Turnstile may be too strict for some of your visitors, or the widget may be failing on some pages. If spam still arrives, look at what gets through: typed pitches need content checks, not a captcha. See our guide to Contact Form 7 spam for the same principle applied to that plugin.

Caching and page builders

Captcha widgets rely on a fresh token for each visitor, so aggressive page caching can sometimes cause problems, such as an expired token on a page cached for hours. Turnstile generates its token in the browser when the page loads, which avoids most of these issues, but test a cached page anyway. If you use a page builder such as Elementor, place the form with the plugin’s own widget so the captcha is added correctly.

Where Cloudflare Turnstile WordPress setups go wrong

The last row matters: a captcha proves a person is there, not that the person is not a spammer. SEO pitches typed by real people pass Cloudflare Turnstile easily. FillKite’s local spam score, which looks at links, pasted text and spam phrases, catches many of those, and every caught entry goes to a separate Spam tab.

A Cloudflare Turnstile checklist

• Invisible layers are on first: honeypot, time check, spam score.
• A Turnstile widget exists in Cloudflare with your live and staging domains.
• Managed mode is selected unless you have a reason to change it.
• The site key and secret key are pasted in the right boxes, and saved.
• The script loads only on pages with forms.
• Your privacy policy lists Cloudflare as a service used on forms.
• A test submission passes, and real entries are measured for two weeks.

Personal data rules apply to captchas too; our guide to the GDPR contact form covers what to say in your privacy policy.

Frequently asked questions

Is Cloudflare Turnstile free for WordPress?

Yes. Turnstile is free to use, and you only need a free Cloudflare account to create the keys. Your site does not need to use Cloudflare’s network or DNS.

Is Turnstile better than reCAPTCHA?

For most small sites it offers a smoother experience, because visitors rarely see anything to solve. reCAPTCHA v3 is also invisible but scores visitors and can block some real people. Both work; choose one and add it only if you need it.

Does Cloudflare Turnstile stop all spam?

It stops most automated spam. It does not stop spam typed by people, such as sales pitches. Combine it with a spam score or Akismet for that.

Will Turnstile slow down my site?

It adds one script to pages that show it. Loading it only on pages with a form, as FillKite does, keeps the effect small.

What does the visitor see if the check fails?

The form is not sent, and the visitor is asked to try again. That is why a mode that rarely challenges people, and a quick test on your own phone, matter before you rely on it.

Can I use Turnstile on some forms and not others?

In FillKite the captcha is a site-wide setting for forms. If you need it only on one heavily attacked form, consider whether the spam score and rate limit on that form solve the problem first.

Do I need to change anything when I move my site?

Add the new domain to your Turnstile widget in Cloudflare, or the widget will show an error on the new address.