Kitgenix CAPTCHA for Cloudflare Turnstile

Spam is expensive: it wastes time, clogs inboxes, creates fake accounts, and on stores it can lead to abandoned checkout noise and fraudulent activity. Traditional CAPTCHA solutions can also hurt conversions by adding friction.

Cloudflare Turnstile is a modern, privacy-first CAPTCHA alternative designed to reduce friction for real people while still blocking bots.

Kitgenix CAPTCHA for Cloudflare Turnstile is a production-ready Turnstile integration for WordPress that focuses on reliability in real-world setups:
– Server-side token verification (using Cloudflare’s official endpoint)
– Fast, conditional loading (only where needed)
– Support for dynamic/AJAX forms and modern WooCommerce Blocks / Store API checkout
– Security features: replay protection, proxy-aware IP handling, whitelisting, and developer mode (warn-only)

You can enable/disable each integration (and many per-form toggles), choose auto-injection vs shortcode-only placement, customise display and messaging, and use built-in diagnostics and Site Health checks to troubleshoot.

The plugin also includes a real setup-verification gate for sensitive flows, a Portability tab for JSON export/import, a Support tab with active protection alerts, per-integration analytics, CSV exports, privacy-safe metrics, and recent verification events, and support for defining keys through wp-config.php constants or environment variables.

Supported integrations (where Turnstile can be added)

All integrations are enable-able from settings. Many also support Mode: Auto vs Shortcode.

WordPress Core
– Login
– Custom login screens rendered with wp_login_form()
– Registration
– Lost password
– Reset password
– Comments (standard WordPress comment forms, including safe handling for comment failures/redirects)

WooCommerce (Classic)
– Checkout
– Product reviews
– My Account login
– My Account registration
– Lost password

WooCommerce Blocks (Store API / Block Checkout)
– UI rendering inside block-based checkout
– Adds token to Store API requests (header and/or extensions payload when available)
– Server-side validation of Store API checkout requests
– Supports “shortcode-only mode” behaviour so you can control placement

Easy Digital Downloads (EDD)
– Checkout
– Login
– Register
– Profile editor

Form plugins
– Contact Form 7 (CF7)
– WPForms
– Fluent Forms
– Formidable Forms
– Forminator
– Gravity Forms
– JetFormBuilder
– Jetpack Forms
– Kadence Forms
– Elementor Forms (including popups and AJAX submissions)

Membership / community / newsletters
– Ultimate Member (login, registration, password reset)
– MemberPress (signup / checkout)
– Paid Memberships Pro (checkout / registration)
– MailPoet forms
– wpDiscuz comment forms

Community / forums
– bbPress (topic/reply flows where applicable)
– BuddyPress (flows where applicable)

Core features (site-wide)

Turnstile widget rendering
– Uses Cloudflare’s official Turnstile API script
– Widget options:
– Theme: auto / light / dark
– Size: normal / compact / flexible
– Appearance: stored as Turnstile “appearance” option (defaults to always)
– Language: auto or explicit locale (passed via hl=...)

Read the full description on the official page →