How to Use Cloudflare Turnstile in WordPress

What Is the Cloudflare Turnstile feature?

Cloudflare Turnstile is a free, privacy-first captcha alternative to Google reCAPTCHA. It validates that the user is human without tracking them, without showing puzzles (in most cases), and without selling data to advertisers.

The Cloudflare Turnstile feature in Classic Monks adds Turnstile to your WordPress, WooCommerce, and comment forms. Users see a small Turnstile widget (usually invisible or one-click) instead of solving a captcha puzzle.

Why You Need It

Standard captcha solutions have issues:

• Google reCAPTCHA v3: Tracks users across the web, sells data
• reCAPTCHA v2: Shows puzzles that frustrate users
• hCaptcha: Better than reCAPTCHA but still tracks some user behavior

Cloudflare Turnstile is different:

• No tracking: Doesn’t follow users across the web
• No puzzles (usually): Validates in the background; users only see a challenge if suspicious
• Free: No usage limits, no enterprise pricing
• Fast: Reduces form abandonment vs traditional captchas

For most sites, Turnstile is the best captcha option in 2026.

How to Use Cloudflare Turnstile in WordPress

1. 1
   Step 1

   Create a Cloudflare Account

   If you don’t have one, sign up at cloudflare.com.

2. 2
   Step 2

   Create a Turnstile Widget

   Go to Cloudflare Dashboard > Turnstile. Click Add Widget. Configure:

   • Widget Name: Any descriptive name (e.g., “My WordPress Site”)
   • Domain: Your site domain
   • Widget Mode: Choose “Managed” (recommended) or “Non-Interactive” (always show)
   • Hosted Domain: Your site domain

   Click Create. Cloudflare provides a Site Key and Secret Key.

3. 3
   Step 3

   Navigate to Settings

   Click into the Classic Monks plugin settings in your WordPress dashboard.

4. 4
   Step 4

   Go to the Security Tab

   Click on the Security menu, then click the WP Protection subtab.

5. 5
   Step 5

   Enable Cloudflare Turnstile

   Scroll to Enable Cloudflare Turnstile and toggle on. Nested options expand.

   

6. 6
   Step 6

   Configure API Keys

   Enter the Cloudflare Site Key and Cloudflare Secret Key from Step 2.

7. 7
   Step 7

   Configure Form Scope

   Select which forms get Turnstile:

   • WordPress Login Forms: Login, registration, password reset
   • WooCommerce Forms: Login, registration, checkout (if applicable)
   • Comment Forms: Standard WordPress comments
   • Frontend Post Submission: Frontend post submission plugins (e.g., frontend post forms)
8. 8
   Step 8

   Save Changes

   Click Save Changes.

9. 9
   Step 9

   Test

   Visit the login form. The Turnstile widget should appear (or run invisibly in the background).

Configuration Options

What Gets Affected

• The login form: shows Turnstile widget
• The registration form: shows Turnstile widget
• The password reset form: shows Turnstile widget
• WooCommerce forms: shows Turnstile widget
• The comment form: shows Turnstile widget
• Form submission: requires Turnstile validation to succeed

What Does NOT Get Affected

• The admin (after login): not affected
• The user experience for legitimate users (Turnstile is usually invisible)
• The form fields themselves: only the captcha is added
• The form data: submitted normally once Turnstile passes

Advanced Options (Developers)

This feature registers 7 WordPress hooks in cloudflare-turnstile.php:

Actions:

• login_enqueue_scripts calls cm_enqueue_turnstile_script() (Enqueues Turnstile JS on login pages (priority 5))
• login_form calls cm_add_turnstile_to_forms() (Adds Turnstile widget to login form)
• woocommerce_login_form calls cm_add_turnstile_to_forms() (Adds Turnstile to WooCommerce login)

Filters:

• authenticate calls cm_verify_turnstile_response() (Verifies Turnstile token during authentication (priority 30))
• registration_errors calls cm_verify_turnstile_response() (Verifies Turnstile token during registration (priority 10))
• comment_form_field_comment calls cm_add_turnstile_to_comment_form() (Adds Turnstile to comment form)
• preprocess_comment calls cm_verify_turnstile_comment() (Verifies Turnstile token for comments)

// Hooked in cloudflare-turnstile.php
add_action( 'login_enqueue_scripts', 'cm_enqueue_turnstile_script' );

The feature modifies WordPress behavior by registering or removing hooks. Disabling it reverses those changes and WordPress returns to its default behavior.

Troubleshooting

5 problems and how to fix each one.