Turnstile is a bot check for your WordPress site’s forms. It adds a small Verify you are human box to the login, registration, lost-password and comment forms, and to Contact Form 7 and WPForms forms, and refuses any submission that did not pass it. Bots that guess passwords, create fake accounts or fill your inbox with spam are stopped at the form – and real visitors almost never have to click anything. It is included with your hosting.
💡 Switching it on takes one click
Open your site, choose the Turnstile tab and press Turn on Turnstile. We create the keys, install everything on your site and check it worked – there is no plugin for you to install or configure.
Switching Turnstile on
- Open your site in the dashboard and choose the Turnstile tab.
- Tick the forms you want protected (all of them are ticked for you).
- Choose how visitors see the check (see below) – Managed suits almost everyone.
- Press Turn on Turnstile. After a few seconds the tab shows On and lists what is protected.
Which forms it protects
- Login form – stops password-guessing bots. It works on your own login address too, if your site uses a custom one.
- Registration form – stops fake accounts.
- Lost password form – stops bots flooding your users with reset e-mails.
- Comment form – stops comment spam. Signed-in users are not asked again.
- Contact Form 7 and WPForms forms – stops contact-form spam, when those plugins are installed on the site.
You can change the selection at any time on the same tab and press Save changes.
How visitors see the check
- Managed (recommended) – most visitors pass without clicking; a visitor that looks suspicious is asked to tick a box.
- Non-interactive – visitors see the box working but never have to click it.
- Invisible – nothing is shown at all; the check runs in the background.
Domains
Turnstile works on your site’s domain and all of its subdomains, www included. If the same WordPress also answers on the domain of another of your sites with us, add that domain in the Domains box.
Keys, changes and switching off
- Get new keys replaces the keys at once; your site receives the new ones automatically. Use it if you think a key has leaked.
- The site key shown on the tab is public – it is part of every page with the check. The secret key is kept on your site only and never shown.
- Turn off removes Turnstile from every form on the site and deletes the keys. You can switch it back on at any time.
- We check your site daily and put Turnstile back in place if a restore or an update removed it.
Sites on your own Cloudflare account
If a site uses your own Cloudflare account (connected on the Own CDN & DNS page), Turnstile is created in that account. Your Cloudflare API token then needs one more permission: Account · Turnstile · Edit, with Account Resources set to include your account. Edit the token in Cloudflare (My Profile → API Tokens), add the permission and save – the token stays the same, so there is nothing to re-enter with us. The Own CDN & DNS page shows whether the permission is there after the next check.
If you cannot log in
The one-click Admin login on your site page always works – it does not use the login form, so Turnstile never stands in its way. If the check will not load for you (for example a browser extension blocks it), use one-click login and switch Turnstile off or change the mode, or contact support.