Title: CWeb Form Protection with Turnstile for Elementor Forms Author: Alexandre Alves Published: June 10, 2026 Last modified: August 13, 2026 --- Search plugins ![](https://ps.w.org/cweb-form-protection-turnstile-elementor/assets/banner-772x250. png?rev=3568108) ![](https://ps.w.org/cweb-form-protection-turnstile-elementor/assets/icon.svg?rev =3568108) # CWeb Form Protection with Turnstile for Elementor Forms By [Alexandre Alves](https://profiles.wordpress.org/alexandreminem/) [Download](https://downloads.wordpress.org/plugin/cweb-form-protection-turnstile-elementor.1.2.2.zip) * [Details](https://en-ca.wordpress.org/plugins/cweb-form-protection-turnstile-elementor/#description) * [Reviews](https://en-ca.wordpress.org/plugins/cweb-form-protection-turnstile-elementor/#reviews) * [Installation](https://en-ca.wordpress.org/plugins/cweb-form-protection-turnstile-elementor/#installation) * [Development](https://en-ca.wordpress.org/plugins/cweb-form-protection-turnstile-elementor/#developers) [Support](https://wordpress.org/support/plugin/cweb-form-protection-turnstile-elementor/) ## Description This plugin adds [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/)— a free, privacy-friendly CAPTCHA alternative — to your WordPress site. Its key difference from other Turnstile plugins is **per-form control for Elementor Pro**: instead of toggling Turnstile globally for every Elementor form, you add a **“Cloudflare Turnstile” field** to the specific forms you want to protect, exactly like Elementor’s built-in reCAPTCHA field. Forms without the field are left untouched. If you prefer the all-at-once approach, an optional setting protects **every** Elementor Pro form automatically. #### Features * **Per-form Turnstile field for Elementor Pro Forms** — drag it into the forms you choose. * **Optional “all Elementor Pro forms” switch** — protect every Elementor Pro form at once, without adding the field to each one (off by default). * Optional protection for the built-in WordPress forms: - Login - Registration - Lost password - Comments * Optional protection for WooCommerce forms (one toggle each): - Checkout (classic shortcode checkout) - Login (My account, and the checkout “returning customer” login) - Registration (My account) - Account details * One-click import of keys and settings from the “Simple Cloudflare Turnstile” plugin (no need to recreate your Cloudflare keys). * Global widget appearance settings (theme, size, visibility, language). * Strict server-side token verification (single-use tokens, 5-minute validity). * Secure-by-default behaviour: missing/invalid tokens are always blocked; the behaviour when Cloudflare itself is unreachable is configurable. * Write-only secret key (never displayed or sent to the browser). * Lightweight: in the default per-form mode, the Cloudflare script loads only on pages that actually show a widget. (The optional “all forms” mode loads it across the front end so late-loaded forms are covered.) #### Requirements * The Elementor field requires **Elementor Pro** (the Forms widget is a Pro feature). Without Elementor Pro, the WordPress form integrations still work. * A free Cloudflare Turnstile site key and secret key. #### Third-party service This plugin renders the official Cloudflare Turnstile widget and verifies tokens with Cloudflare. * When a protected form is displayed, the visitor’s browser loads `https://challenges. cloudflare.com/turnstile/v0/api.js` from Cloudflare. * When a protected form is submitted, your server sends a request to `https://challenges. cloudflare.com/turnstile/v0/siteverify` containing: the Turnstile token from the widget (`cf-turnstile-response`), your secret key, and — unless disabled with the `cwebts_remoteip` filter — the visitor’s IP address (`REMOTE_ADDR`). The secret key is never sent to the browser. * Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/ * Terms of Service: https://www.cloudflare.com/website-terms/ * Privacy Policy: https://www.cloudflare.com/privacypolicy/ #### About the name The distinctive part of the name is **CWeb Form Protection**, after **Collectif WEB**, the agency that maintains this plugin. The trailing “with Turnstile for Elementor Forms” only describes what the plugin integrates with: “Turnstile” is the Cloudflare service it uses, and “for Elementor Forms” signals compatibility with Elementor’s Forms widget. This plugin is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. or Elementor Ltd. #### Trademarks Not affiliated with Cloudflare, Inc. or Elementor Ltd. “Cloudflare” and “Turnstile” are trademarks of Cloudflare, Inc. “Elementor” is a trademark of Elementor Ltd. These names are used only to describe compatibility. ## Screenshots [⌊The settings page (keys, appearance, WordPress form toggles).⌉⌊The settings page( keys, appearance, WordPress form toggles).⌉[ The settings page (keys, appearance, WordPress form toggles). [⌊The "Cloudflare Turnstile" field inside an Elementor Pro form.⌉⌊The "Cloudflare Turnstile" field inside an Elementor Pro form.⌉[ The “Cloudflare Turnstile” field inside an Elementor Pro form. [⌊The Turnstile widget displayed on a protected form.⌉⌊The Turnstile widget displayed on a protected form.⌉[ The Turnstile widget displayed on a protected form. ## Installation 1. Upload the plugin to `/wp-content/plugins/` or install it from the Plugins screen. 2. Activate it. 3. Go to **Settings CWeb Form Protection** and enter your Cloudflare **site key** and **secret key**. 4. (Elementor) Edit a form, add the **Cloudflare Turnstile** field where you want the widget, then save. 5. (WordPress forms) Enable the toggles for login, registration, lost password and/ or comments. 6. (WooCommerce) Enable the toggles under **WooCommerce forms** for the checkout, login, registration and/or account-details forms. ## FAQ ### Does it protect every Elementor form automatically? By default, no — and that is the point. You add the Turnstile field only to the forms you want to protect, and forms without the field are left untouched. If you prefer, turn on **Settings CWeb Form Protection Elementor Pro forms “All Elementor Pro forms”** to protect every Elementor Pro form automatically, without adding the field to each one. ### Does it work without Elementor Pro? The Elementor field needs Elementor Pro (Forms is a Pro module). The WordPress login, registration, lost password and comment integrations work on any WordPress site. ### Which WooCommerce forms are protected? Under **Settings CWeb Form Protection WooCommerce forms** you can protect the classic checkout, the login form (My account and the checkout “returning customer” login), the registration form and the account-details form — each with its own toggle. The lost-password form uses the existing “Lost password form” toggle, and product reviews use the “Comment form” toggle. This version protects the **classic (shortcode) checkout**. The newer **WooCommerce Checkout Block** (the Gutenberg block) is **not** covered yet, and the _Pay for order_ and _Add payment method_ forms are out of scope. Account creation during checkout is protected by the **Checkout** toggle (not the **Registration** toggle). ### Is the secret key safe? Yes. The secret key is stored server-side, is never printed in the page, and is never sent to the browser. The settings screen never displays it back. ### I already use “Simple Cloudflare Turnstile”. Do I have to recreate my keys? No. If that plugin’s settings are present, the **Settings CWeb Form Protection** page shows an “Import keys & settings” button that copies your site key, secret key, appearance options and form toggles over. Your existing Cloudflare keys keep working — nothing is regenerated, and the other plugin is left untouched. ### What happens if Cloudflare can’t be reached? Missing or invalid tokens are always rejected. If Cloudflare’s verification endpoint is unreachable (network error or timeout), the **“If Cloudflare is unreachable”** setting decides whether to block (default, more secure) or allow (more available) the submission. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CWeb Form Protection with Turnstile for Elementor Forms” is open source software. The following people have contributed to this plugin. Contributors * [ Alexandre Alves ](https://profiles.wordpress.org/alexandreminem/) [Translate “CWeb Form Protection with Turnstile for Elementor Forms” into your language.](https://translate.wordpress.org/projects/wp-plugins/cweb-form-protection-turnstile-elementor) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/cweb-form-protection-turnstile-elementor/), check out the [SVN repository](https://plugins.svn.wordpress.org/cweb-form-protection-turnstile-elementor/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/cweb-form-protection-turnstile-elementor/) by [RSS](https://plugins.trac.wordpress.org/log/cweb-form-protection-turnstile-elementor/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.2 * Fix, for the optional “All Elementor Pro forms” setting only: turning it on could leave forms showing no Turnstile widget while their submissions were already being rejected — visitors were asked to confirm they are not a robot, with nothing to confirm. Elementor 4 keeps the rendered HTML of each widget in a 24-hour cache, and a cached form never passes through the filter this plugin adds its widget with. Saving the setting now clears that cached markup, so the widget shows up right away. Forms carrying the “Cloudflare Turnstile” field were never affected. #### 1.2.1 * Tested with WordPress 7.1. * Fix: the plugin no longer asks WordPress for its translations while plugins load, which WordPress 6.7 and later report as too early. Form protection was never affected; this removes a PHP notice logged on every page load on sites that have debugging enabled. * When the “Error message” field is left empty, the default message is now translated as it is displayed, instead of the wording being frozen into your settings the moment you saved them. #### 1.2.0 * New: protect WooCommerce forms, with one opt-in toggle each (all off by default) under a new “WooCommerce forms” section — Checkout (classic shortcode checkout), Login (My account and the checkout “returning customer” login), Registration ( My account), and Account details. * The checkout widget sits right before the “Place order” button. WooCommerce reloads that area via AJAX when the customer changes shipping or payment, so the widget is re-rendered immediately afterwards to keep a valid token at submit time. * Registration is validated on the scoped `woocommerce_process_registration_errors` hook; account creation during checkout is covered by the Checkout toggle instead, so enabling Registration alone never blocks a checkout. * Scope: the classic (shortcode) checkout only. The WooCommerce Checkout Block ( Gutenberg) is not protected in this version; the lost-password form keeps its existing toggle and product reviews keep the comment toggle. #### 1.1.1 * Fix: replying to a comment from the WordPress admin (the `replyto-comment` AJAX action) was blocked when “Protect comments” was enabled. WordPress builds those replies server-side with no Turnstile widget, so no token is ever sent. Moderators now skip the check in the admin AJAX context; the public comment form stays protected. * Fix: a widget hitting a persistent render error (for example a site key restricted to another domain) retried forever, flooding Cloudflare with failed requests and flickering. It now retries a couple of times to recover from a transient network glitch, then stops; a successful challenge clears the counter. No change to server-side verification. #### 1.1.0 * New: optional “Protect all Elementor Pro forms” setting (off by default). When enabled, the Turnstile widget is added to every Elementor Pro form automatically— including forms loaded in popups or via AJAX — without adding the per-form field. The per-form field remains the default. #### 1.0.1 * Fix: the Cloudflare Turnstile widget now renders on the WooCommerce “Lost password” form (/my-account/lost-password/). Previously the widget did not appear and every password reset was rejected. #### 1.0.0 * Initial release: per-form Turnstile field for Elementor Pro; WordPress login, registration, lost password and comment integrations; global appearance settings; strict server-side verification. ## Meta * Version **1.2.2** * Last updated: **2 months ago** * Active installations: **200+** * WordPress Version: ** 5.8 or higher ** * Tested up to: **7.1.3** * PHP Version: ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/cweb-form-protection-turnstile-elementor/) * Tags: * [captcha](https://en-ca.wordpress.org/plugins/tags/captcha/)[cloudflare](https://en-ca.wordpress.org/plugins/tags/cloudflare/) [elementor](https://en-ca.wordpress.org/plugins/tags/elementor/)[spam](https://en-ca.wordpress.org/plugins/tags/spam/) [turnstile](https://en-ca.wordpress.org/plugins/tags/turnstile/) * [Advanced View](https://en-ca.wordpress.org/plugins/cweb-form-protection-turnstile-elementor/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/cweb-form-protection-turnstile-elementor/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/cweb-form-protection-turnstile-elementor/reviews/) ## Contributors * [ Alexandre Alves ](https://profiles.wordpress.org/alexandreminem/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/cweb-form-protection-turnstile-elementor/)