Priceless Pick: Simple Cloudflare Turnstile

CAPTCHAs are a central part of our online experience, for better or worse. For instance, we’ve all had to struggled with websites with insane, multi-step tests to get to the content we want. Modern CAPTCHAs are fantastic at stopping most bots, but they can also be a net negative for the user experience. Simple Cloudflare Turnstile proves that the answer to stopping bots is not through user testing, nor removing security measures.

The plugin is a free CAPTCHA alternative (with enterprise options) that doesn’t require users to go through those tests to validate they’re human. The service offers multiple types of verification widgets, but none of them require anything more complex than ticking a box.

For this Priceless Pick, we’ll be taking a look at Simple Cloudflare Turnstile, its key features, notes from the developer, and how it works. Let’s get to it.

Introducing Simple Cloudflare Turnstile

Simple Cloudflare Turnstile offers a quick way to integrate the Cloudflare Turnstile service with WordPress. If your site has forms, you’ll need a way to protect them. This plugin can help you implement a CAPTCHA without much fuss and it works with a lot of other WordPress tools too.

Simply enter the keys, select what forms to enable Turnstile for from a list of predetermined options, and that’s it. By default, Simple Cloudflare Turnstile works with login, registration, password reset, and comments forms.

Simple Cloudflare Turnstile also integrates with WooCommerce, most popular form plugins (including options such as WPForms, Contact Form 7, and Gravity Forms), and several other options. On top of that, you get handful of customization options, support for changing the default language, and the ability to hide the verification widget altogether.

At first glance, this is a niche plugin. However, Cloudflare is an incredibly popular Content Delivery Network (CDN) option for most websites, including many of the biggest sites in the world. As such, many WordPress sites (big and small) use Cloudflare. Growing sites and personal projects can benefit greatly from using the CDN’s free plan to speed up their websites too.

If you’re already using Cloudflare as a CDN, integrating Turnstile too is almost a quick win, particularly if you’re tired of solutions such as reCAPTCHA.

Simple Cloudflare Turnstile: From The Developer

One of the things WP Mayor likes to do is talk directly to the creators and developers when reviewing their plugins. Knowing who’s behind the plugins you use is important, since it can tell you a lot of about their plans, how they see user interactions—and if your site is in good hands if you use their tools.

Simple Cloudflare Turnstile is part of the Rely WP suite. Elliot Sowersby is the guy behind Rely WP, a company that provides hosting and WordPress maintenance plans, and supports a long list of free and premium plugins. Here’s how he started working on WordPress plugins:

In 2015 during my final year at university I started doing some freelance WordPress work, and became a full-time WordPress developer after I graduated in 2016.

The first plugin I officially released was “Coupon Affiliates” in 2015. It initially started out as a small plugin called “coupon usage statistics”, which was suggested by one of my first ever customers. After many years of feedback and development, it has now become my biggest project.

Elliot Sowersby

This isn’t the first CAPTCHA-related plugin he’s worked on: reCAPTCHA for WooCommerce is also part of the Rely WP suite. When Turnstile launched, developing a quick, simple plugin for it was a smart move to bring across users tired of reCAPTCHA. Now Simple Cloudflare Turnstile has many more installations than its relative.

In 2022, when Cloudflare announced that they were launching Turnstile (a CAPTCHA alternative), I saw this as a great opportunity to develop another alternative plugin specifically for “Cloudflare Turnstile”, considering it was brand new and no other plugins existed for it yet.

Having already developed a CAPTCHA plugin before, I essentially forked my existing code, made the necessary changes, and managed to have it published on the WP.org directory quickly. This was followed by a rapid development of improvements and new integrations in the following weeks and months, which certainly helped with its success.

In case you’re curious, managing a plugin is a lot of work. Even with free plugins, you’re required to put in a lot of time to provide updates and support and a lot of users can be quite aggressive about it.

At one point, the support requests were getting a little overwhelming. I was getting a mixture of posts on the forums, tags on social media, DMs, along with emails through my personal and company website. This included a mixture of feedback, suggestions, and small bugs/issues. Of-course, this is to be expected with a popular plugin, though it can be quite time consuming, considering I have other things to work on too.

The lesson is that free plugins are part of the glue that holds WordPress together. As such, be nice to the people who make them when you’re opening a support ticket!

Key Features

Simple Cloudflare Turnstile is fairly straightforward. There isn’t a lot of features because it’s designed to only do one thing. Here’s what you get:

• Quick integration with Turnstile. Set up a widget in Turnstile, get the corresponding keys, add them to the plugin, and you’re good to go.
• Two theme options. Light and dark: the only two real choices you need for a simple widget (and most UIs).
• Preferred language. You can set a default language or have Turnstile set it automatically.
• Custom error message settings. If the widget fails to load, this is the message that will appear.
• Options to hide the widget. If you’re not using a clickable widget, you can hide it altogether so users don’t see any security verification, it just happens in the background.
• Form selection. You choose what forms to enable Turnstile for.

That’s it! If the widget is set up properly in Turnstile, you shouldn’t need to do anything else. If you want to disable Turnstile for specific forms, you simply uncheck those boxes in the plugin’s settings.

How Simple Cloudflare Turnstile Works

If you’re considering adding security to your forms (which you should) or moving away from traditional CAPTCHAs, you’ll want to consider using Turnstile. Here’s how Simple Cloudflare Turnstile works, in a few short steps.

The plugin is free, so there are no licenses to deal with. Once you install it, add the site and secret key for the Turnstile widget you want to use. Cloudflare provides a full tutorial on creating a Turnstile widget: he process is very fast if you already have a Cloudflare account.

To configure the plugin, go to Settings > Cloudflare Turnstile in the WordPress dashboard. Paste your site and secret keys at the top of the screen:

Now set a theme for the widget and change the default language if you don’t want to use auto-detect. The light theme is the default option, and it’s the one you usually see with Cloudflare Turnstile widgets across the web.

The advanced settings include options such as tinkering with the widget size and hiding it—and you can skip them if you want a simple integration. Now scroll down to the Enable Turnstile on your forms section and select the forms you want to enable the widget for:

As a rule of thumb, it doesn’t hurt to add security to any of your forms. It helps reduce spam and potentially prevent your website from attacks.

If you’re using any of the plugins that Simple Cloudflare Turnstile supports, you’ll see more options in the list of forms. When you’re done, click on Save Changes and that’s it. Adding protection to all forms on your site only took a matter of minutes.

What Makes Simple Cloudflare Turnstile a Priceless Pick

Pretty much every WordPress website with forms can benefit from using some type of CAPTCHA solution or alternative. These measures are necessary because, otherwise, you’ll be drowning in form spam. I’m not exaggerating either.

That’s contact form spam from a site that uses Akismet, and isn’t even indexed on search engines. If you plan on growing your site and you use contact forms to collect leads in any way, do yourself a favor and protect those forms from spam.

The most popular options for form security are traditional CAPTCHAs, such as Google’s reCAPTCHA. Modern versions of reCAPTCHA support verification without interactions, such as Turnstile. However, a lot of the web is still using clunky, outdated CAPTCHAs:

Running a successful website that people enjoy using is largely about not making interactions annoying. If your site is difficult to use or some part of the experience affectsyour users, there’s a chance they’ll grow frustrated and leave. CAPTCHAs can be incredibly frustrating, depending on the implementation, hence alternatives like Turnstile popping up.

The real Priceless Pick here is Turnstile. It’s a great alternative to services such as reCAPTCHA, it’s free (unless you’re running an enterprise application), and you can easily use it alongside the CDN. Simple Cloudflare Turnstile is a Priceless Pick by association, since it offers the best, most user-friendly way to implement the service in WordPress.

Final Thoughts

Running a WordPress website involves a ton of tasks you might not have imagined, like managing admin notices, troubleshooting errors, setting up contact forms, dealing with spam, and more. If you want to stay sane, you’ll want to find easy, automated solutions for most of these tasks, and Turnstile offers just that.

Using Turnstile, you should be able to reduce fake login attempts, spam form submissions, and a lot of other annoyances involving forms. Simple Cloudflare Turnstile offers a quick solution for integrating Turnstile, setting it up for the forms you want, then forgetting all about it.

In short, if you’re not happy with reCAPTCHA, consider using Simple Cloudflare Turnstile.