How to create Cloudflare Turnstile keys (2025 update)

Every single day, your contact forms get hammered by spam bots. Thousands of fake submissions, it’s exhausting.

We’ve been there. Managing over 200+ WordPress sites and dealing with spam on a daily base. Google’s reCAPTCHA helped, but honestly? Users hate it. They’d abandon forms rather than solve another puzzle. So we switched to Cloudflare Turnstile, and it’s been a game changer.

This guide shares everything we’ve learned from actually deploying it across dozens of sites.

What is Cloudflare Turnstile

Turnstile is different. It runs silently in the background using machine learning. Most legitimate visitors don’t see anything, they just submit the form. Bots get stopped before they even know what hit them.

Here’s the kicker: it’s completely free. No fancy pricing tiers. No “per verification” costs. Just free.

Why we actually switched (the real reasons)

Privacy, for one. With reCAPTCHA, Google gets your visitor data. They build profiles. Not cool. Turnstile keeps everything on your server or with Cloudflare. No creepy Google profiling. GDPR? Check. CCPA? Check.

User experience is dramatically better. We tested this. Form completion rates jumped just by removing reCAPTCHA (V2). Users filled out forms faster. Fewer bounce offs. Better conversions.

The spam actually stopped. After the first week with Turnstile, our spam inbox went down.

Why Turnstile beats reCAPTCHA (spoiler: it’s privacy)

Look, we still use reCAPTCHA on some older sites. We get it, it’s familiar. But here’s the honest comparison:

Turnstile vs reCAPTCHA Turnstile doesn’t send data to Google. It’s faster. Users prefer it. reCAPTCHA is fine. But it’s not great.

Turnstile vs hCaptcha Both respect privacy. But hCaptcha sometimes shows puzzles to users. Turnstile’s “Managed” mode usually doesn’t. In our experience, Turnstile has fewer false positives.

Turnstile vs traditional spam plugins Most WordPress spam plugins like WP SpamShield work after the bot submits. Your server processes fake submissions. That’s wasteful. Turnstile blocks them before they even arrive. Smarter approach.

Does it matter that much? For most sites, no. But if you care about privacy, user experience, and actually reducing server load? Yeah, it matters.

The quick version

• Create a Cloudflare account and add your domain
• Generate Site + Secret keys in Turnstile
• Install a form plugin (we recommend WPForms)
• Paste your keys into the plugin
• Add Turnstile to your form
• Submit a test form
• Watch the spam disappear

Done, that’s it.

Actually getting started: Cloudflare account

Okay, so here’s the thing. If you’re not already using Cloudflare for your DNS, this adds a small step. But it’s worth it.

First, the account itself

Go to cloudflare.com and hit “Sign up.” Give them your email. Create a password that’s actually strong (not “password123”). Verify your email. Takes 5 minutes.

Then add your domain

This part matters. You can’t just use Turnstile without adding your domain to Cloudflare first. You’re essentially telling Cloudflare, “Hey, this is my website. Protect it.”

1. In your dashboard, click “Add a site”
2. Type your domain (e.g., yourbusiness.com)
3. Choose the Free plan (Turnstile works on it)
4. Cloudflare will show you two nameservers to add
5. Go to your domain registrar (GoDaddy, Namecheap, whatever)
6. Update your nameservers to Cloudflare’s
7. Wait 5-30 minutes for DNS to propagate

Fair warning: Changing nameservers is one of those things that makes you nervous the first time. It usually works fine. If you’re uncomfortable, contact your hosting provider. They’ve done this a thousand times.

Make sure you have a DNS export in case things go wrong, you’ll need this eaither way to migrate the records correctly.

Once your domain is active on Cloudflare (you’ll get an email), you’re good to move forward. Check out Cloudflare’s account setup guide if you need more detailed help.

Generating your keys

Here’s where the actual Turnstile setup happens. For the full technical details, see Cloudflare’s Turnstile documentation.

In your Cloudflare dashboard:

1. Find Turnstile in the left sidebar
2. Click it
3. Hit Create site
4. Give it a name like “My Contact Forms” or “Lead Capture”
5. Add your domain
6. Choose Managed mode (that’s the one that doesn’t annoy users)
7. Click Create

Cloudflare spits out two things:

Site Key: This is public. Put it in your form. No security risk. It’s like a username.

Secret Key: This is private. Guard it like a password. If someone gets this key, they can forge verification tokens. Not ideal. If this ever leaks, regenerate it immediately in Cloudflare.

Copy both keys somewhere safe. You’ll need them in 2 minutes.

Which plugin? (our recommendation)

We’ve tested all of them on real sites. Here’s what we actually recommend.

Option A: WPForms (our default)

Honest opinion? If you’re asking which plugin to use, use WPForms. It’s not fancy, but it’s reliable, intuitive, and Turnstile integration is seamless.

The setup:

1. Plugins, Add New, search “WPForms”
2. Install and activate
3. Go to WPForms, Settings, Captcha tab
4. Choose Cloudflare Turnstile
5. Paste your Site Key and Secret Key
6. Save

Done. Now when you create a form, there’s a Captcha field you just drag into place.

Option B: Contact Form 7 (if you like free)

Contact Form 7 is completely free and lightweight. We like it for simple, single-form sites.

The catch: It’s less intuitive than WPForms. You have to edit shortcodes manually. If that makes you nervous, skip this.

If you’re going for it:

1. Install Contact Form 7
2. Contact, Integration, Setup Turnstile integration
3. Paste your keys
4. In your form code, add [turnstile] where you want it
5. Hope you don’t need to edit the shortcode again

Option C: Gravity Forms (if your forms are complex)

Gravity Forms is the “if you need it, you know you need it” option. Conditional logic, payment integrations, complex workflows, Gravity Forms handles it.

Setup is straightforward:

1. Buy it, install it, activate it
2. Forms, Settings, reCAPTCHA & Turnstile tab
3. Select Cloudflare Turnstile
4. Paste your keys
5. Add the Captcha field to your form

We use this for clients who need complex integrations. It’s solid. But it’s also probably more than you need.

Option D: Jet Form Builder (if you’re using page builders)

Using Elementor Pro or Crocoblock? Jet Form Builder integrates beautifully.

Setup:

1. Install Jet Form Builder
2. Settings, Integrations, Cloudflare Turnstile
3. Paste your keys
4. Add the Turnstile field to your form

Testing (don’t skip this)

Test before you consider this done.

Visit your website. Find your form. Look for the small Cloudflare badge in the bottom corner, you’ll see it. Fill out the form with legitimate info (your own name, real email). Submit it.

You should get a confirmation message.

If you don’t: Check that your plugin settings have the correct keys. Even a typo breaks it.

If the widget never appears: Clear your browser cache. Sometimes WordPress caches hurt you here. Also check that the domain in your Turnstile site matches your WordPress domain exactly.

Now here’s the sneaky part, go to your Cloudflare dashboard. Navigate to Turnstile. You should see analytics showing “Challenges issued” and “Likely human: 100%.” If you see that, congrats. It’s working.

When things get complicated

Once you’ve got the basics down, there’s some deeper stuff.

Different modes exist

Managed mode (what we recommend): Cloudflare decides if a challenge is needed. Most users pass through invisibly. Bots get challenged. It’s smart.

Non-Interactive mode: Always shows a widget. Every visitor interacts with it. Better for high-security situations, worse for user experience. We rarely use this.

Invisible mode: Verifies in the background with no visible widget. Sounds good, right? Except it’s limited to certain regions and honestly? The results are mixed. Skip it.

For detailed info on modes, check Cloudflare’s configuration documentation.

You can customize the look

Most plugins let you make the widget match your site. Light theme, dark theme, compact size, whatever. It’s in the field settings. Not a big deal, but nice to have.

Coming from reCAPTCHA? Here’s the migration

We’ve done this migration on at least 30 sites. Takes about 5 minutes per site. Here’s the exact process:

1. Create your Turnstile keys (see above)
2. In your form plugin, disable reCAPTCHA
3. Enable Cloudflare Turnstile
4. Paste your new keys
5. Replace reCAPTCHA fields with Turnstile fields in your forms
6. Test one form thoroughly before considering it done
7. Repeat for other forms on the site

The thing nobody tells you: This doesn’t delete any old form submissions. Your data is safe. You’re just changing how new submissions are protected.

Why migrate? Privacy, mainly. But also because users respond better to it. We’ve seen form completion rates improve just by making this switch. Seriously.

What goes wrong (and how we fixed it)

After deploying Turnstile on 100+ sites, we’ve seen some issues. Here’s what actually happens.

The widget just doesn’t appear

Most common cause: You pasted the Secret Key into the Site Key field, or vice versa. We’ve done it. Everyone does it. Double check those.

Second most common: Your domain doesn’t match. You set up Turnstile for “example.com” but you’re accessing it as “www.example.com”. Cloudflare is picky about this. Create a separate Turnstile site for the correct domain.

Third thing: plugin conflicts. Install a security plugin, and suddenly Turnstile breaks. Not always, but sometimes. If the widget vanishes, temporarily disable your other security plugins. If it reappears, that’s your culprit.

Our go to fix: Check the browser console (F12, Console). Look for red errors. If you see “turnstile error” or something, screenshot it. That tells you what’s actually broken.

Forms keep getting rejected

Your Secret Key changed. You regenerated it in Cloudflare but didn’t update it in WordPress. Happens all the time.

Or and this is less common but real the token timed out. If someone fills out your form super slowly (takes 30+ minutes), the token expires. They have to refresh and try again. It’s annoying, but it’s also secure by design.

Another scenario: Your form plugin isn’t verifying tokens correctly on the server side. Some plugins require extra setup steps. Check your plugin documentation or reach out to support.

“Why are my real customers getting blocked?”

This is rare.

If legitimate users are being rejected, it’s usually because:

• You’re not using Managed mode (switch to it)
• You have conflicting Cloudflare security rules (go to Security, WAF Rules and check what’s enabled)
• Your IP is being flagged for some reason (check Cloudflare’s threat intelligence)

If legitimate users are being blocked, there’s usually another security layer that’s the real problem. Turnstile itself is usually fine.

Secret key got exposed

This is a “oh crap” moment. If you accidentally committed your Secret Key to GitHub or posted it somewhere public:

1. Regenerate it immediately in Cloudflare. Click the regenerate button.
2. Copy the new key.
3. Update your WordPress plugin settings with the new key.
4. Done. The old key is now useless.

If you committed it to Git, clean up your history. This is important. Search your repo for the key and remove all traces.

Keeping your keys safe

This is less interesting than actual setup, but it’s important.

Do not:

• Share your Secret Key
• Put it in version control
• Post it in Slack or email
• Hardcode it in theme files
• Log it

Instead:

• Store it in your plugin settings (encrypted, generally safe)
• Use environment variables if you’re a developer
• For large organizations, use a secrets manager

Rotate it occasionally. We regenerate keys every 3 to 4 months. Go to Cloudflare, hit “Regenerate,” update WordPress. Takes 2 minutes. The old key stays valid for 24 hours, so there’s no downtime.

Watch your analytics. If you suddenly see a spike in bot traffic, you might be under attack. Check Cloudflare’s security logs. It’s usually nothing, but stay aware.

Questions we hear all the time

Need more help?

Check out the official Cloudflare Turnstile documentation for technical details and API information. You can also reach out to Cloudflare support if you hit any roadblocks.

The bottom line

Is it perfect? No. Nothing’s perfect. But it’s so much better than the alternatives that we honestly don’t understand why anyone still uses reCAPTCHA.

If you run WordPress and you care about spam, user experience, and privacy: do this today. You’ll thank us later.

Now go protect those contact forms.