Adding Cloudflare Turnstile to a WordPress contact form

Getting the keys

1. Log in to the Cloudflare dashboard and open Turnstile.
2. Add a widget, enter your site's domain, and choose the managed mode unless you have a reason not to.
3. Copy the site key (public, used in the page) and the secret key (private, used by your server).

What happens when a visitor sends the form

The Turnstile script, loaded from challenges.cloudflare.com, runs in the visitor's browser and produces a token. Your server sends that token and your secret to Cloudflare, which answers pass or fail. Each token can be used once, so a copied token doesn't work twice.

In Formsafe Contact Form

Under Formsafe → Settings → Spam, choose Cloudflare Turnstile and paste the two keys. The secret is shown masked afterwards, with only its last four characters visible. The Turnstile script loads only on pages with a form, never across your whole site.

• Pass — the entry is saved and the notification sent.
• Fail — the visitor is asked to confirm they're human and press Send again, and nothing is saved.
• The widget is there, but unanswered — the visitor pressed Send before Turnstile had finished, or without ticking its box when it showed one. While Turnstile is passing your other visitors, they're asked to confirm they're human and press Send again, with what they typed kept.
• No widget at all — JavaScript is off, or Cloudflare's script is blocked, so there was nothing to answer. While Turnstile is passing your other visitors, the entry is saved under Spam with that reason, and the visitor sees the normal thank-you.
• Turnstile hasn't passed anyone for about a day — then it isn't running on your forms, and neither case is held against the visitor: entries are taken in without the check, and a notice tells you.
• Cloudflare doesn't answer — the entry is still accepted, marked as unverified, so an outage at Cloudflare never costs you a customer. The honeypot, time trap and address limit keep working.
• Cloudflare rejects your secret — that's a setup problem, not the visitor's fault. Entries are accepted without the check, and a notice on Formsafe's screens tells you to fix the key.
• The widget shows the visitor an error instead of its check — most often a site key that doesn't list your domain. The visitor had nothing to tick, so they aren't sent back: the entry is kept (under Spam while Turnstile is passing your other visitors, otherwise taken in), and a notice gives you the error code Turnstile showed.
• You change the site key or switch service — earlier passes were the old key's, so until a visitor passes with the new one, a form without an answer is taken in rather than sent back.

These are the same rules Formsafe uses for hCaptcha and reCAPTCHA v3; see when the CAPTCHA is down for why it fails open.

Coming from Contact Form 7

If your Contact Form 7 site already uses a CAPTCHA service, Formsafe's importer can take its keys over when you import the forms — only if you say yes to it.