How to Set Up Cloudflare Turnstile to Prevent Spam on Your Website

In a recent conversation with form expert Mark Westgard, he shared his two favorite methods for preventing spam from slipping through contact forms: setting up your website on Cloudflare and using Cloudflare’s Turnstile CAPTCHA. While I’ve already covered how to set up your website on Cloudflare in a previous guide, today, I’ll walk you through how to set up Turnstile and integrate it into your forms. It’s a simple process, and by the end of this post, you’ll have it up and running on your site.

Let’s dive in!

What Is Cloudflare Turnstile?

Cloudflare Turnstile is a CAPTCHA solution designed to reduce spam and bot activity on your website. Unlike traditional CAPTCHAs, Turnstile can operate invisibly in the background, analyzing user behavior to determine if they’re human—without requiring them to solve puzzles or click on images. This makes it a user-friendly option that minimizes friction while keeping your forms secure.

Setting Up Turnstile in Cloudflare

Step 1: Access the Turnstile Dashboard

Log in to your Cloudflare account and navigate to the dashboard. On the left-hand side, click on Turnstile. If you don’t have any Turnstile configurations set up yet, you’ll need to create one for each domain you want to protect.

Step 2: Add a New Site

Click Add Site and give your site a friendly name (e.g., “The Admin Bar”). This name is just for your reference. From the domain dropdown, select the domain you want to use Turnstile with. Note that your domain must already be registered with Cloudflare for this to work.

Step 3: Choose a Widget Mode

Cloudflare Turnstile offers three widget modes:

• Managed: Displays a visual CAPTCHA on the front end.
• Non-Interactive: Similar to Managed but with fewer interactions.
• Invisible: Operates entirely in the background without showing anything to users.

For this demo, I’ll use the Managed mode so we can see it in action. However, in production, I recommend using the Invisible mode to reduce user friction.

Once you’ve selected your widget mode, scroll down and click Create. Cloudflare will generate a Site Key and a Secret Key—you’ll need these to connect Turnstile to your website.

Integrating Turnstile with WS Form

If you’re using WS Form (a popular WordPress form plugin), integrating Turnstile is straightforward.

Step 1: Access WS Form Settings

In your WordPress dashboard, go to WS Form > Settings. Navigate to the Spam Protection tab.

Step 2: Enter Your Keys

Scroll down to the Turnstile section. If you’ve previously tested Turnstile, clear any existing keys to start fresh. Copy the Site Key and Secret Key from your Cloudflare dashboard and paste them into the corresponding fields in WS Form. Click Save Changes.

Step 3: Add Turnstile to a Form

Now, let’s add Turnstile to a form:

1. Go to WS Form > Add New and select a template (e.g., “Contact Us”).
2. On the right-hand side, search for the Turnstile widget and drag it into your form. Place it just above the submit button.
3. Save your changes and publish the form.

When you preview the form, you’ll see the Turnstile widget in action. If you switch to the Invisible mode in your Cloudflare settings and refresh the form, the widget will no longer be visible, but it will still function in the background.

Using the Cloudflare Turnstile Plugin

If you’re not using WS Form, you can still set up Turnstile with the Cloudflare Turnstile Plugin. Here’s how:

Step 1: Install the Plugin

In your WordPress dashboard, go to Plugins > Add New and search for “Cloudflare Turnstile.” Install and activate the plugin.

Step 2: Configure the Plugin

Once activated, the plugin will prompt you to enter your Site Key and Secret Key. After entering the keys, you can configure general settings and enable Turnstile on various parts of your website, such as:

• WordPress login pages
• Registration pages
• Password reset forms
• Comment sections

Step 3: Integrate with Other Form Plugins

The plugin supports most major form plugins, so you can easily enable Turnstile on forms created with plugins like Gravity Forms, Contact Form 7, or WPForms. Check your form plugin’s documentation for specific integration steps, or use the Turnstile plugin to simplify the process.

Why Use Cloudflare Turnstile?

After spending over an hour discussing spam prevention with Mark Westgard, it became clear that Cloudflare and Turnstile are two of the most effective tools for keeping bots out of your forms. Here’s why:

• Ease of Use: Both Cloudflare and Turnstile are simple to set up, even for beginners.
• User-Friendly: Turnstile’s invisible mode reduces friction for users while maintaining security.
• Cost: Both tools are completely free to use.

By implementing these solutions, I’ve significantly reduced spam on my websites, and I’m confident they’ll work for you too.

Final Thoughts

Setting up Cloudflare Turnstile is a quick and effective way to protect your website from spam. Whether you’re using WS Form, another form plugin, or the Cloudflare Turnstile plugin, the process is straightforward and well worth the effort.

If you’re tired of dealing with spam, I highly recommend giving Turnstile a try. It’s free, easy to use, and makes a big difference in keeping your forms secure.