Cloudflare Turnstile: Stop Form Spam Without Annoying CAPTCHAs
Turnstile checks that visitors are human without image puzzles, but only if your server validates every token. Here is how to choose a mode, wire it up and pair it with rate limiting and honeypots.
If your contact form, login page or sign-up page is filling up with junk, Cloudflare Turnstile is one of the simplest fixes available: it checks that a visitor is human without making anyone click on traffic lights, it is available on Cloudflare's Free plan, and it does not require moving your website or DNS to Cloudflare. The catch is that it only works if your server checks every token with Cloudflare's Siteverify API. Adding the widget to the page and stopping there leaves the door open. This guide explains how Turnstile works, which mode to choose, how to wire it up correctly, and what to pair it with.
What Turnstile is (and how it differs from image CAPTCHAs)
Traditional CAPTCHAs ask people to read distorted text or pick images. They frustrate customers, slow down forms on phones and can be a barrier for people who use screen readers. Turnstile takes a different approach. According to Cloudflare's documentation, it runs small, mostly non-interactive JavaScript checks in the browser and only shows a simple checkbox when it needs more confidence. There are no images or text to decipher.
A few points that matter for a business website:
- No Cloudflare proxy required. Cloudflare states Turnstile can be embedded on any site "without sending traffic through Cloudflare." Your site can stay with your current host and DNS provider.
- Free plan limits. Cloudflare's Turnstile plans page lists up to 20 widgets on the Free plan, 10 hostnames per widget, unlimited challenges and 7 days of analytics. That covers most small and mid-sized businesses.
- Accessibility. Cloudflare states Turnstile is WCAG 2.2 AA compliant, which is a meaningful improvement over puzzle-style CAPTCHAs.
- Privacy. Cloudflare says Turnstile does not access, store or transmit form entries or other page inputs. Its data practices are described in a separate Turnstile Privacy Addendum.
Choosing a widget mode
When you create a widget in the Cloudflare dashboard you pick one of three modes. Each widget gets its own sitekey (public, goes in the page) and secret key (private, stays on your server).
| Mode | What the visitor sees | Good fit |
|---|---|---|
| Managed (recommended) | Usually nothing to do; a checkbox only when the visitor looks risky | Contact, quote-request and sign-up forms |
| Non-interactive | A small widget with a loading spinner; never asks for a click | Forms where you want visible reassurance but no extra step |
| Invisible | Nothing at all; checks run in the background | Login pages and checkout flows where any visible element feels intrusive |
Two practical notes from Cloudflare's widget documentation:
- If you use Invisible mode, you must reference Cloudflare's Turnstile Privacy Addendum in your own privacy policy.
- If your site uses a Content Security Policy, you must allow connections to
challenges.cloudflare.com, or the widget will silently fail to load.
For most businesses, Managed mode is the right default. Use separate widgets for separate purposes (for example, one for the website contact form and one for the client portal login) so you can read their analytics separately and rotate keys independently.
The step people skip: server-side validation
Here is how a Turnstile-protected form actually works:
- The widget runs in the visitor's browser and produces a token.
- The token is submitted with the form (by default in a hidden field named
cf-turnstile-response). - Your server sends that token, together with your secret key, to Cloudflare's Siteverify endpoint:
POST https://challenges.cloudflare.com/turnstile/v0/siteverify. - Cloudflare answers whether the token is valid. Only then should your server accept the form.
If step 3 is missing, a bot can simply post to your form without ever loading the widget. Cloudflare's documentation is explicit that tokens must be validated server-side. A few rules to build in:
- Tokens expire after 300 seconds (5 minutes). A visitor who leaves a form open for a long time will get a
timeout-or-duplicateerror. Your page should refresh the widget (Cloudflare'sturnstile.resetfunction) instead of showing a confusing failure. - Each token can be validated only once. A replayed token is rejected. That is a feature: it stops one solved challenge from being reused across thousands of submissions.
- Keep the secret key on the server. Never place it in JavaScript, a public repository or a front-end config file. If it leaks, rotate it in the dashboard.
- Send the visitor's IP in the optional
remoteipfield when you have it, and use the optionalidempotency_keyif your code may retry a request. - Fail safely. If Siteverify returns
internal-error, retry once. Decide in advance whether a form should be accepted and flagged for review or rejected when Cloudflare cannot be reached, and log the decision either way. - Check the error codes.
invalid-input-secretusually means a mistyped or rotated key;missing-input-responsemeans the token never reached your server, often because a page builder stripped the hidden field.
WordPress: plugin options
On WordPress you do not need to write the integration yourself, but choose carefully:
- Dedicated Turnstile plugins. Plugins such as "Simple CAPTCHA with Cloudflare Turnstile" (listed on WordPress.org) add the widget to WordPress login, registration, password reset and comment forms, WooCommerce checkout and popular form builders such as WPForms, Contact Form 7 and Gravity Forms. Its readme states it is not affiliated with Cloudflare; the same is true of other Turnstile plugins, so treat them like any third-party plugin.
- Form builders with built-in support. Some form plugins include a Turnstile option in their own settings. If yours does, use it rather than adding a second plugin.
Whatever you choose, test it properly: submit a form normally, then submit one with the Turnstile field removed (your developer can do this with the browser's developer tools). The second submission must be rejected. If it is accepted, server-side validation is not working. And keep the plugin updated, as we explain in our guide to cleaning up hacked websites, outdated plugins are a common way in.
Turnstile is one layer, not the whole wall
Turnstile tells you a real browser was involved. It does not stop a determined person from typing spam by hand, and it does not protect endpoints that bypass your forms. Pair it with:
Rate limiting
If your site is proxied through Cloudflare, a rate limiting rule can slow down repeated hits to /wp-login.php, /contact or an API path. Cloudflare's documentation lists one rate limiting rule on the Free plan (counting by IP over a 10-second period), two on Pro and five on Business. For login pages, also enforce account lockouts or delays in the application itself. Our article on protecting your website with the Cloudflare WAF covers firewall rules in more depth.
Honeypot fields
A honeypot is a hidden form field that humans never see or fill in. Simple bots fill every field, so any submission with that field populated can be discarded quietly. It costs nothing, adds no friction and catches a different class of bot than Turnstile.
Server-side checks
- Validate and cap the length of every field.
- Reject submissions with dozens of links in the message body.
- Never send automatic replies that echo the visitor's message back, because spammers abuse those to relay content through your domain.
Strong authentication on logins
On login forms, Turnstile reduces automated password guessing but does not replace multi-factor authentication. Turn on MFA for every administrator account.
A short rollout checklist
- Create a Turnstile widget in the Cloudflare dashboard (Managed mode), adding only the hostnames you own.
- Store the secret key in your server's environment or secrets manager.
- Add the widget script and element to each form.
- Implement Siteverify on the server and reject any form without a valid token.
- Handle expiry with
turnstile.resetand show a friendly retry message. - Update your Content Security Policy and, for Invisible mode, your privacy policy.
- Add a honeypot field and, if you use Cloudflare's proxy, a rate limiting rule for login paths.
- Test valid, missing, expired and replayed tokens before going live.
- Review Turnstile analytics after a week to confirm real visitors are passing.
Need a hand?
Core Florida IT is an independent IT provider; we are not affiliated with Cloudflare, but we set up Turnstile, rate limiting and form hardening for business websites as part of our cybersecurity and web hosting management services. If spam, fake sign-ups or login attacks are wasting your team's time, request a free IT assessment and we will review your forms and website security for your Miami-Dade or South Florida business.
