Turnstile

Turnstile is Cloudflare’s privacy-friendly check that tells real people from bots on your forms, without making visitors solve puzzles. You place a small widget on a page, and it runs a check in the background, so the visitor usually sees little or nothing.

What is Turnstile?

If the check passes, the widget gives the form a token that your server can verify.

Classic CAPTCHAs ask people to click traffic lights or read distorted letters. Turnstile aims to confirm that a visitor is a real person using signals from the browser, with a visible step only when needed. Cloudflare presents it as an alternative to traditional CAPTCHAs, and it can be used on pages that are not otherwise served by Cloudflare.

To use it, you create a widget in your Cloudflare account. This gives you two keys: a site key, which goes into the page and is public, and a secret key, which you keep on the server side only. The names and the exact steps can change, so follow Cloudflare’s current documentation when you set it up.

What Turnstile means for your PHP site

Contact forms, comment forms and login forms attract automated submissions. On a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, every submission starts PHP and may write to a database or send an email, so a flood of spam costs server time and fills inboxes. A check at the front of the form reduces that.

On a static websiteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes., there is no PHP behind the form, so the check moves to a small function. That function receives the form data and the token, asks Cloudflare whether the token is valid, and only then passes the message on. A serverlessServerless is a way to run code without looking after your own server: the provider runs your small pieces of code when needed and keeps the machinery updated. function is a natural place for this. The same idea applies to XML-RPCXML-RPC is an old WordPress feature that lets other apps post to your site without the normal login screen. Attackers often target it with login attempts. and other login endpoints on WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits., where automated attempts are common, though those need other protections too.

How to add it safely

1. Create the widget in your Cloudflare account and note the site key and secret key.
2. Add the widget code to the page with the form, using the site key.
3. In your form handler, read the token that comes with the submission.
4. Send the token and the secret key to Cloudflare’s verification endpoint from your server.
5. Accept the submission only if Cloudflare confirms the token is valid.

Keep the secret key out of the page and out of any public code repository. Store it in your platform’s secret storage. Also validate the form fields themselves, because a valid token does not mean the content is safe.

Testing the setup

Submit the form as a normal visitor and confirm that it arrives. Then submit it without a token, for example by calling the handler directly, and confirm that it is rejected. If both behave as expected, the check is wired correctly. Look at your logs after a few days to see how many submissions are blocked.

When to act

Add a check like Turnstile when your form attracts spam, when you move to a static site and replace server-side form handling, or when you want to drop an older CAPTCHA. Our WordPress to static site service includes forms that work without PHP on the server.