Kitgenix CAPTCHA for Cloudflare TurnstilebyKitgenix

Stop spam without punishing real users. Kitgenix CAPTCHA for Cloudflare Turnstile integrates Cloudflare’s privacy-preserving CAPTCHA alternative with WordPress in a way that’s fast, stable, and production-ready. Protect WordPress login, registration, lost/reset password, and comments — plus WooCommerce checkout/auth flows and popular form builders — using server-side validation, replay protection, and proxy-aware IP detection. The plugin is engineered for performance (async scripts, conditional loading) and compliance (no cookies or tracking added by the plugin, GDPR-friendly).

Turnstile is a modern, low-friction, reCAPTCHA-free experience that keeps bots out while keeping conversions high. This plugin gives you a clean UI, sensible defaults, and per-integration controls so you can deploy protection confidently across your site.

Highlights

• Ultra-lightweight & fast – WP 6.3+ Script API (strategy=async), avoids render-blocking, loads only where needed.
• Privacy-first – No cookies or tracking added by the plugin; GDPR-friendly data flow.
• Rock-solid server-side validation – Tokens verified via Cloudflare’s official siteverify endpoint.
• Replay protection – Recent tokens cached (hashed) to prevent re-use.
• Cloudflare/Proxy-aware IP handling – Honors CF/Proxy headers only from trusted proxies.
• Seamless integrations – WordPress Core, WooCommerce (Classic + Blocks), Elementor Pro, and major form plugins.
• Smart UX – Optional “disable submit until verified”, token freshness timers, inline error hints.
• Production-ready admin – Onboarding, Site Health test, JSON import/export, accessible UI.
• Multisite aware – Clean uninstall removes settings site-wide (and network-wide on Multisite).

Supported Forms & Integrations (v1.0.5)

WordPress Core: Login, Registration, Lost/Reset Password, Comment Form
WooCommerce: Checkout (Classic & Blocks / Store API), Login, Registration, Lost Password
Elementor Pro: Forms & Popups (with dynamic re-render support)
Form Plugins: WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Contact Form 7, Forminator, Jetpack Forms, Kadence Forms (Kadence Blocks)

Enable/disable each integration and location in Settings → Cloudflare Turnstile.

How It Works (Technical)

1. Enqueues https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit using async strategy (WP 6.3+).
2. Injects a widget into enabled forms; re-renders for dynamic loads (AJAX, popups, multi-step).
3. Submissions are validated server-side via /v0/siteverify with your secret key and request IP (where appropriate).
4. On failure (invalid/expired/reused token), submission is blocked with clear, customizable messaging.

Quick Start

1. Install & Activate → Plugins → Add New → search “Kitgenix Turnstile”.
2. Add Keys → Settings → Cloudflare Turnstile → paste Site Key & Secret Key from Cloudflare Dashboard.
3. Choose Integrations → toggle WordPress/WooCommerce/Form plugins and specific locations.
4. Save & Test → try login/register/comments/checkout + your form pages.
5. Optional Hardening → enable Disable Submit Until Verified and review Tools → Site Health hints.

Full Setup Guide (Step by Step)

A. Generate Cloudflare Turnstile Keys

1. In Cloudflare, create a Turnstile site for your domain.
2. Copy the Site Key and Secret Key.

B. Configure the Plugin in WordPress

1. Go to Settings → Cloudflare Turnstile.
2. Paste Site Key and Secret Key and click Save.
3. Under Integrations, toggle WordPress, WooCommerce, Elementor Pro, and/or your form plugins.
4. For WordPress/WooCommerce, enable specific locations (e.g., Login, Register, Checkout, Comments).
5. In Display & Behavior, choose Theme (auto/light/dark), Appearance (always/interaction-only), Size (small/normal/large), and Language (auto or locale).
6. (Optional) Disable Submit Until Verified for high-risk flows like checkout.
7. (Optional) Defer Scripts to suit your optimizer.
8. (Optional) Configure Access Controls (whitelist logged-in users, IPs with exact/wildcard/CIDR, and user-agents).

How-to Guides (Common Setups)

1) WordPress Core Forms

• Enable: Settings → Cloudflare Turnstile → Integrations → WordPress.
• Pick locations: Login, Register, Lost/Reset Password, Comments.
• Test: Open /wp-login.php and your comment form; verify the widget appears and blocks invalid tokens.
• Tip: Avoid full-page caching for wp-login.php and admin/auth pages.

2) WooCommerce (Classic Checkout)

• Enable: Integrations → WooCommerce and toggle Checkout, Login, Register, Lost Password.
• Check placement: Turnstile renders near the Place order area.
• Best practices:
  • Do not cache mini-cart/checkout fragments.
  • If using page caching/CDN, exclude the checkout, cart, and account endpoints.
  • Consider Disable Submit Until Verified to prevent premature submits.

3) WooCommerce (Blocks / Store API Checkout)

• Enable: Same as Classic; Store API requests are validated server-side.
• Header support: Turnstile token can be provided via X-Turnstile-Token (handled automatically by the plugin/extension).
• Troubleshooting: If your custom checkout injects requests, ensure the token is present and not stale (avoid long-lived cache on checkout).

4) Elementor Pro Forms (including Popups)

• Enable: Integrations → Elementor Pro.
• Usage: Open your form in Elementor; the widget is placed before/after the submit area as needed.
• Popups & AJAX: The plugin re-renders Turnstile on popup open and AJAX transitions.
• Tips:
  • Give forms unique names/IDs to avoid collisions.
  • Don’t defer Elementor’s own JS in a way that stops its events from firing.
  • If using strict optimizers, allowlist challenges.cloudflare.com.

5) Contact Form 7

• Enable: Integrations → Contact Form 7.
• Behavior: Automatically injects on all CF7 forms; no shortcode tag needed.
• AJAX errors: The widget re-renders after failed submissions.
• Tip: If a form uses heavy HTML caching, exclude that page or reduce TTL.

6) WPForms / Fluent Forms / Gravity Forms / Formidable / Forminator / Jetpack / Kadence Forms

• Enable: Toggle each in Integrations.
• Behavior: Auto-inject across forms for that plugin.
• AJAX & Multi-step: The widget resets and re-renders on step changes or validation errors.
• If a single form should not use Turnstile: Disable the integration temporarily while editing, or create form/plugin-level conditions (varies by plugin).

Performance Playbook (Speed & Core Web Vitals)

• Async by default: We use the Script API (strategy=async) on WP 6.3+.
• Conditional loading: Scripts load only where the integration is active.
• Optimization plugins:
  • Do not inline or block the Turnstile script; allowlist https://challenges.cloudflare.com.
  • Exclude login, checkout, and account pages from full-page caching.
  • If you defer JS globally, ensure your form plugin’s events still fire.
• Resource hints: We add preconnect/dns-prefetch for faster first paint.

Security Hardening Tips

• Replay protection: Enabled by default; adjust TTL via kitgenix_turnstile_replay_ttl.
• Trusted proxies: If behind Cloudflare/NGINX proxy, configure Trusted Proxies in settings so request IPs are accurate.
• Developer Mode (warn-only): On staging, log failures without blocking to diagnose issues safely.
• Whitelisting: Use sparingly (logged-in/IP/UA). Overuse reduces protection.

Troubleshooting

• Widget not showing

  • Verify keys and that the integration/location is enabled.
  • Make sure you’re not whitelisted (logged-in/IP/UA).
  • Clear caches; allowlist challenges.cloudflare.com.
  • Check console for third-party blockers.

• “Please verify you are human”

  • Token expired/invalid: reduce cache TTL on form pages, avoid caching auth/checkout, ensure server can reach Cloudflare.

• Elementor popups / AJAX

  • Ensure Elementor/Form plugin JS isn’t over-deferred; the plugin listens for their events to re-render.

• WooCommerce checkout

  • Don’t cache fragments; confirm widget renders before clicking Place order.
  • For custom checkouts, ensure token is attached or forwarded correctly.

Developers

Filters
– kitgenix_captcha_for_cloudflare_turnstile_script_url( $url, $settings ) – Override the Turnstile script URL or add params.
– kitgenix_turnstile_freshness_ms – Control token auto-reset interval (ms).
– kitgenix_turnstile_replay_ttl – Adjust replay-protection cache duration (seconds).
– kitgenix_turnstile_is_whitelisted( $is_whitelisted, $context ) – Modify whitelist decisions programmatically.

Server-side endpoint
– Validates via https://challenges.cloudflare.com/turnstile/v0/siteverify.

Text domain
– kitgenix-captcha-for-cloudflare-turnstile (POT included).

Minimum Requirements

• WordPress 5.0+
• PHP 7.0+
• Cloudflare Turnstile site & secret keys (free)

Roadmap

• Additional per-form controls and UI refinements
• More granular placement options for additional builders
• Expanded compatibility notes per optimization plugin

Copyright

Kitgenix CAPTCHA for Cloudflare Turnstile is built with ❤️ by Kitgenix.

Disclaimer

This plugin is not affiliated with or endorsed by Cloudflare, Inc. “Cloudflare” is a registered trademark of Cloudflare, Inc.

Credits

Cloudflare Turnstile — https://www.cloudflare.com/products/turnstile/
Plugin developed by https://kitgenix.com

External Services

This plugin connects to Cloudflare Turnstile for spam prevention. It sends:
– Site key
– Response token
– User IP and user-agent (via the Cloudflare SDK)

No data is stored or processed by Kitgenix.

Cloudflare Turnstile Terms: https://developers.cloudflare.com/turnstile/
Privacy Policy: https://www.cloudflare.com/privacypolicy/