Title: Empex CAPTCHA for Cloudflare Turnstile Author: empexdigital Published: Junie 28, 2026 Last modified: Augustus 1, 2026 --- Soek deur uitbreidings ![](https://ps.w.org/empex-cloudflare-turnstile/assets/banner-772x250.png?rev=3589136) ![](https://ps.w.org/empex-cloudflare-turnstile/assets/icon-256x256.png?rev=3589136) # Empex CAPTCHA for Cloudflare Turnstile Deur [empexdigital](https://profiles.wordpress.org/empexdigital/) [Laai Af](https://downloads.wordpress.org/plugin/empex-cloudflare-turnstile.zip) * [Besonderhede](https://af.wordpress.org/plugins/empex-cloudflare-turnstile/#description) * [Aanbevelings](https://af.wordpress.org/plugins/empex-cloudflare-turnstile/#reviews) * [Installation](https://af.wordpress.org/plugins/empex-cloudflare-turnstile/#installation) * [Ontwikkeling](https://af.wordpress.org/plugins/empex-cloudflare-turnstile/#developers) [Hulp](https://wordpress.org/support/plugin/empex-cloudflare-turnstile/) ## Beskrywing **Empex CAPTCHA for Cloudflare Turnstile** adds invisible, privacy-friendly bot protection to every form on your WordPress site using [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/). No puzzles. No friction. No CAPTCHAs. #### Supported Forms * **WordPress Core** – Login, Registration, Password Reset, Comments * **WooCommerce** – Classic Checkout, Blocks Checkout, My Account (Login, Register, Lost Password) * **Contact Form 7** – Automatic or manual widget injection * **WPForms** (Lite & Pro) * **Gravity Forms** * **Fluent Forms** * **Elementor Pro** – Inline forms and popups * **Formidable Forms** * **Forminator** * **Kadence Forms** * **SureForms** * **Jetpack Forms** * **MemberPress** – Registration, Login * **Ultimate Member** – Register, Login, Profile * **Paid Memberships Pro** — Checkout, Login * **BuddyPress** – Registration * **wpDiscuz** – Comments * **WP User Manager** – Register, Login, Password Reset * **Easy Digital Downloads** – Checkout * **Empex Form Builder** – Inline forms #### Key Features * 🔒 **Invisible protection** – legitimate users never see a challenge * ⚡ **One-click setup** – enter your Cloudflare keys, enable forms, done * 🛡️ **Token replay prevention** – server-side one-time-use enforcement * 🔄 **AJAX-safe** – tokens refresh automatically after failed submissions * 📊 **Logging dashboard** – see blocked attempts, pass rates, form-level stats * 🌐 **Multisite compatible** – network or per-site activation * 🧩 **Developer-friendly** – filters, shortcode, extensible integration base * ♿ **Accessible** – WCAG 2.1 AA on admin screens, ARIA labels on widgets #### How It Works 1. Install and activate the plugin 2. Enter your Cloudflare Turnstile Site Key and Secret Key 3. Toggle which forms to protect 4. That’s it, bots are blocked, real users pass through invisibly #### External Service This plugin connects to the **Cloudflare Turnstile** service to verify form submissions: * **Cloudflare Turnstile API**: `https://challenges.cloudflare.com/turnstile/v0/ siteverify` * **Cloudflare Turnstile JavaScript**: `https://challenges.cloudflare.com/turnstile/ v0/api.js` When a user submits a form, their browser interaction data, IP address, and browser fingerprint are sent to Cloudflare for verification. This is required for the plugin to function. * [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/) * [Cloudflare Terms of Service](https://www.cloudflare.com/website-terms/) The plugin itself does not store personal data by default. IP address logging is opt-in and must be explicitly enabled in Settings. ## Screenshots [⌊Settings page - API key setup with onboarding wizard and live key verification.⌉⌊ Settings page - API key setup with onboarding wizard and live key verification.⌉[ Settings page – API key setup with onboarding wizard and live key verification. [⌊Integration toggles - enable protection on 25+ supported form plugins with one click.⌉⌊Integration toggles - enable protection on 25+ supported form plugins with one click.⌉[ Integration toggles – enable protection on 25+ supported form plugins with one click. [⌊Log viewer - real-time dashboard showing blocked attempts, pass rates, and form- level stats.⌉⌊Log viewer - real-time dashboard showing blocked attempts, pass rates, and form-level stats.⌉[ Log viewer – real-time dashboard showing blocked attempts, pass rates, and form- level stats. [⌊WordPress Login form - the Turnstile widget rendering cleanly inside the login form.⌉⌊WordPress Login form - the Turnstile widget rendering cleanly inside the login form.⌉[ WordPress Login form – the Turnstile widget rendering cleanly inside the login form. ## Installation 1. Upload the `empex-cloudflare-turnstile` folder to `/wp-content/plugins/`, or install directly from the WordPress plugin directory. 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Go to **Settings Empex Cloudflare Turnstile**. 4. Enter your Cloudflare Turnstile **Site Key** and **Secret Key** (get them from the [Cloudflare Dashboard](https://dash.cloudflare.com/)). 5. Click **Verify & Save** to confirm your keys work. 6. Enable protection on the forms you want to protect. #### Recommended: Define Keys in wp-config.php For production sites, define your keys as constants in `wp-config.php` to prevent exposure via the database: ``` define( 'EMPEX_CT_SITE_KEY', 'your-site-key-here' ); define( 'EMPEX_CT_SECRET_KEY', 'your-secret-key-here' ); ``` ## Kwel-vrae ### Do I need a Cloudflare account? Yes. You need a free Cloudflare account to obtain Turnstile API keys. Turnstile itself is free for unlimited use. ### Will this slow down my site? No. The Cloudflare Turnstile script is loaded asynchronously and only on pages with protected forms. The plugin adds less than 5ms to server-side processing. ### What happens if Cloudflare is down? You can configure “Soft-Fail” mode in Settings Behaviour. In soft-fail mode, form submissions are allowed through (and logged) when Cloudflare is unreachable. In block mode (default), submissions are rejected. ### Does this work with page caching? Yes. The Turnstile widget renders fresh on each page visit regardless of HTML caching. We recommend excluding `/wp-admin/admin-ajax.php?action=empex_*` from your cache rules. ### What if JavaScript is disabled? The widget won’t render and no token will be generated. The server treats this as a missing token and applies your configured fail mode (block or soft-fail). ### Is this GDPR compliant? The plugin itself collects no personal data by default. Cloudflare Turnstile is documented as GDPR-compliant by Cloudflare. IP address logging in the plugin is opt-in. See our privacy policy suggestion in Settings Privacy. ### Can I use this with custom forms? Yes. Use the `[empex_ct_turnstile]` shortcode to add a widget to any form. Developers can verify tokens server-side using the `empex_ct_verify_shortcode` filter. ### Does it support multisite? Yes. The plugin supports both network-wide and per-site activation. Settings are stored per-site. ## Aanbevelings There are no reviews for this plugin. ## Contributors & Developers “Empex CAPTCHA for Cloudflare Turnstile” is oopbron sagteware. Die volgende mense het bygedra tot die ontwikkeling van hierdie uitbreiding: Contributors * [ empexdigital ](https://profiles.wordpress.org/empexdigital/) [Translate “Empex CAPTCHA for Cloudflare Turnstile” into your language.](https://translate.wordpress.org/projects/wp-plugins/empex-cloudflare-turnstile) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/empex-cloudflare-turnstile/), check out the [SVN repository](https://plugins.svn.wordpress.org/empex-cloudflare-turnstile/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/empex-cloudflare-turnstile/) by [RSS](https://plugins.trac.wordpress.org/log/empex-cloudflare-turnstile/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.0.5 * Fix: empex-alignment.js repositions the widget above the submit button independently of the main script (on load, on every window resize, and after every re-render), using its own DOM-insertion logic that had not received the 2.0.4 fix. It re- inserted the widget as a sibling of the submit button itself rather than the button’s enclosing field row, undoing the 2.0.4 placement fix for any form whose button is wrapped in a dedicated, non-form-child container (e.g. The Plus Addons for Elementor). This affected every form using Auto alignment (the default setting)— including forms rendered by dedicated integrations, since this script repositions every `.empex-ct-widget-wrap` on the page regardless of which integration rendered it. It now walks up to the same insertion point as the main script. #### 2.0.4 * Fix: The Universal Form Engine inserted the widget as a sibling of the submit button itself. Some form builders (e.g. The Plus Addons for Elementor’s Form widget) wrap their submit button in a dedicated container built to hold only that button (icon spans, loading spinner, “inline button” positioning), and were never designed to hold a second block-level child — inserting the widget there squeezed it and the button together instead of onto their own lines. The widget is now inserted before the nearest ancestor that is a direct child of the form, so it always lands as its own top-level field row alongside the form’s other fields, regardless of how the submit button itself is wrapped. Forms where the submit button is already a direct child of the form (no wrapper) are unaffected. #### 2.0.3 * Fix: When an alignment class (Left/Right/Center/Auto) is active, the widget wrapper is a flex row, and the “please complete verification” message is appended as a sibling of the widget inside that same row. With no flex-wrap set, both items shrank to fit one line — crushing the message text into an unreadable vertical sliver and squeezing the widget along with it, most visible on the WordPress login card where the Normal-size widget leaves very little row space to begin with. The wrapper now wraps its flex children, and the message is given a full- width basis so it always drops to its own line beneath the widget instead of sharing space with it. #### 2.0.2 * Fix: The widget wrapper had no width rule, so in flex-wrap form layouts (e.g. Elementor’s fields container) it shrank to the width of the Turnstile box itself instead of claiming its own row. This left room for the submit button to slot onto the same line, causing the widget and button to collide regardless of the Static Alignment setting or the button’s own position. The wrapper now always occupies the full width of its row, guaranteeing the button is pushed to its own line beneath it. * Change: Removed the separate “Auto-Alignment” toggle and the “None” Static Alignment option. Alignment is now a single “Alignment” setting with four choices — Left, Right, Center, or Auto (match submit button position) — since the collision the toggle used to prevent is now handled unconditionally by the layout fix above. Existing sites are migrated automatically: sites with Auto-Alignment on keep Auto; sites with it off keep their chosen side (or move from the retired “None” to “Left”). #### 2.0.1 * New: “Static Alignment” setting (left/right/center) lets the widget be positioned deliberately with zero JavaScript when Auto-Alignment is disabled, rendered server- side. * Fix: When Auto-Alignment was disabled, the widget wrapper had no fallback horizontal spacing, so it could sit flush against the submit button in flex/inline form layouts. The wrapper now always keeps a minimum horizontal margin regardless of the Auto-Alignment setting. * Fix: Forms picked up by the Universal Form Engine (the generic JS-based scanner used for form markup not covered by a specific integration) never received any alignment class, so the new Static Alignment setting had no effect on them. The Universal Form Engine now applies the same alignment logic as the PHP-rendered widgets. * Fix: The left/right Static Alignment classes kept the base wrapper margin on the outer edge, leaving an unwanted gap between the widget and the form’s edge even when explicitly flush-aligned. The aligned classes now sit flush against their target edge. * Tweak: The Auto-Alignment script is no longer enqueued at all when Auto-Alignment is disabled in settings. #### 2.0.0 * New: Widget now auto-aligns with the form’s submit button by default (left/right/ center-aware, with padding) — can be disabled in settings. * New: Floating “Protected by Cloudflare Turnstile” badge, site-wide, with configurable bottom-left/bottom-right position (off by default). * New: Support for protecting Elementor pop-up forms, with a separate toggle from standard (non-pop-up) Elementor forms. Pop-up form protection did not exist in 1.0.0. * Fix: Turnstile widgets inside Elementor pop-up forms could be rendered while the pop-up was still hidden and permanently marked as already-rendered, so the widget never visually appeared even after the pop-up was opened. The widget now waits until the pop-up is actually visible before rendering. * Fix: The widget was not reliably positioned on the opposite side of the form’s submit button (e.g. it did not stay left-aligned when the button was right-aligned), because the alignment styling only affected the widget’s own internal contents rather than its position relative to the button. The widget now correctly seats on the opposite side of the button. * Fix: The bundled minified frontend script was a stale build that was missing recent event logic used to re-run button alignment after a widget renders dynamically( e.g. inside an AJAX-loaded pop-up). The minified build has been refreshed to match the current source. * Tweak: Added trademark attribution notice to the settings page. * Tweak: Renamed the settings page header to “Empex Cloudflare Turnstile for WordPress” for clarity. #### 1.0.0 * Initial release * Core WordPress form protection: Login, Registration, Password Reset, Comments * WooCommerce integration: Classic Checkout, Blocks Checkout, Account forms * Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Elementor Pro support * MemberPress, Ultimate Member, Paid Memberships Pro, BuddyPress, wpDiscuz support * Easy Digital Downloads, Formidable, Forminator, Kadence, SureForms, Jetpack Forms * Ninja Forms, Everest Forms, JetFormBuilder, weForms, Empex Form Builder support * Admin settings with first-run onboarding wizard * Clean widget fit on narrow login/register/lost-password forms (standard widget seated inside the login card) * Token replay prevention with SHA-256 transients * Rate limiting (configurable per IP) including failed attempts * AES-256-GCM secret key encryption * Event logging with retention and row cap * Block and soft-fail modes * Competing Turnstile plugin conflict detection * Shortcode: [empex_ct_turnstile] * WCAG 2.1 AA accessible admin UI * Full multisite support * Privacy policy integration * PHPUnit test suite ## Meta * Version **2.0.5** * Last updated **1 maand gelede** * Active installations **Minder as 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.0.4** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/empex-cloudflare-turnstile/) * Tags * [captcha](https://af.wordpress.org/plugins/tags/captcha/)[cloudflare](https://af.wordpress.org/plugins/tags/cloudflare/) [security](https://af.wordpress.org/plugins/tags/security/)[spam](https://af.wordpress.org/plugins/tags/spam/) [turnstile](https://af.wordpress.org/plugins/tags/turnstile/) * [Gevorderde Aansig](https://af.wordpress.org/plugins/empex-cloudflare-turnstile/advanced/) ## Punte-toekennings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/empex-cloudflare-turnstile/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/empex-cloudflare-turnstile/reviews/) ## Contributors * [ empexdigital ](https://profiles.wordpress.org/empexdigital/) ## Hulp Got something to say? Need help? [Gaan na die hulp-forum](https://wordpress.org/support/plugin/empex-cloudflare-turnstile/)