Yes. Automatic placement is available for supported integrations, and many integrations include a shortcode-only placement option. The [kitgenix_turnstile]<\/code> shortcode can also render a widget manually.<\/p><\/dd>\nCan I use the shortcode on any custom form?<\/h3><\/dt>\nThe shortcode can render the widget, but an unsupported custom form still needs a server-side validation integration. Rendering a widget alone is not sufficient security.<\/p><\/dd>\n
Can different forms use different Turnstile themes or sizes?<\/h3><\/dt>\nYes. Global theme, size and language settings can be overridden per integration.<\/p><\/dd>\n
What does Developer Mode do?<\/h3><\/dt>\nDeveloper Mode is warn-only. Failed verification is recorded but does not block the submission. Individual integrations can also be placed in Test Mode without putting the entire site into warn-only mode.<\/p><\/dd>\n
What is replay protection?<\/h3><\/dt>\nReplay protection helps reject a Turnstile token that has already been accepted or processed. This reduces the usefulness of captured or repeatedly submitted tokens.<\/p><\/dd>\n
Does the plugin include a honeypot?<\/h3><\/dt>\nYes. The optional honeypot can reject simple automated submissions before Cloudflare Siteverify is contacted.<\/p><\/dd>\n
Can I whitelist administrators or trusted visitors?<\/h3><\/dt>\nThe plugin can whitelist logged-in users, configured IP addresses\/ranges and User-Agent strings. Whitelisted visitors do not need to complete Turnstile, and the frontend Turnstile script is skipped for them.<\/p><\/dd>\n
Does it work behind Cloudflare or another reverse proxy?<\/h3><\/dt>\nYes. Proxy-aware IP detection is included. For security, forwarded headers are trusted only when proxy trust is enabled and the connecting proxy matches your configured trusted proxy list.<\/p><\/dd>\n
Can I stop the visitor IP address being sent to Cloudflare Siteverify?<\/h3><\/dt>\nDevelopers can return false<\/code> from the kitgenix_turnstile_send_remoteip<\/code> filter. See the External Services section for the default data flow.<\/p><\/dd>\nCan I store the Site Key and Secret Key outside the WordPress database?<\/h3><\/dt>\nYes. The plugin supports the KITGENIX_CAPTCHA_FOR_CLOUDFLARE_TURNSTILE_SITE_KEY<\/code> and KITGENIX_CAPTCHA_FOR_CLOUDFLARE_TURNSTILE_SECRET_KEY<\/code> constants and matching environment variables.<\/p><\/dd>\nCan I move settings between sites?<\/h3><\/dt>\nYes. Export settings to JSON and import them using Replace or Merge mode. Credentials are excluded by default unless you explicitly include them.<\/p><\/dd>\n
Why is the widget not appearing?<\/h3><\/dt>\nCheck that the Site Key exists, the integration and relevant form toggle are enabled, the visitor is not whitelisted, and another plugin or optimisation rule is not blocking https:\/\/challenges.cloudflare.com<\/code>. Also check the plugin's duplicate-loader warning and Site Health test.<\/p><\/dd>\nWhy do I see expired, missing or replayed-token errors?<\/h3><\/dt>\nTurnstile tokens are short-lived and single-use. Cached forms, back-button resubmissions, double-clicks, delayed JavaScript or submitting after a token has expired can all require a fresh Turnstile challenge.<\/p><\/dd>\n\n<\/dl>\n\n\n
2.0.0 (31 August 2026)<\/h4>\n\n\n- New: Redesigned the admin settings interface around the shared Kitgenix design system with a sticky topbar, cross-plugin branding, grouped navigation, an Advanced dropdown for Security, Advanced, and Portability, and a light\/dark theme toggle that remembers the selected preference.<\/li>\n
- New: Added in-page settings search with \"\/\" and Cmd\/Ctrl+K keyboard shortcuts, filtering the active tab's cards and rows as you type and displaying a dedicated no-results state when nothing matches.<\/li>\n
- New: Added a central Kitgenix Hub page for discovering, installing, activating, and reviewing Kitgenix plugins from one screen, integrated into the same topbar and navigation shell as the plugin settings.<\/li>\n
- New: Added a shared Kitgenix component library providing reusable modals, collapsible sections, copy-to-clipboard controls, sortable\/searchable tables, and toast notifications.<\/li>\n
- New: Added a dedicated Log tab containing active alerts, site-impact statistics, per-integration analytics, and the recent diagnostic log, moving diagnostics out of the Support tab.<\/li>\n
- New: Added Ninja Forms integration with Turnstile tokens delivered through a request header rather than a hidden field, matching Ninja Forms' JSON-based submission architecture.<\/li>\n
- New: Documented and re-verified the existing Kitgenix Plugin Score integration for login, registration, and forgotten-password protection.<\/li>\n
- New: Added per-integration widget overrides for Theme, Widget Size, and Language, allowing individual integrations to override the global display settings or inherit them unchanged.<\/li>\n
- New: Added an optional honeypot fallback under Settings \u2192 Security that rejects bots which blindly populate hidden fields before any request is sent to Cloudflare's
siteverify<\/code> endpoint.<\/li>\n- New: Added Test Mode per Integration under Settings \u2192 Developer Mode, allowing individual integrations to operate in warn-only mode while the rest of the site remains fully enforced.<\/li>\n
- New: Diagnostic log entries now record Cloudflare
siteverify<\/code> round-trip latency so slow successful responses can be distinguished from failures and timeouts.<\/li>\n- New: Added a Protection Health card to the Log tab with actionable states including Healthy, No recent traffic, High failure rate, Cloudflare unavailable, Duplicate Turnstile loader, and Configuration problem.<\/li>\n
- New: Added Integration, Result, Category, and Time Period filters to the recent diagnostic log alongside the existing free-text search.<\/li>\n
- New: Renamed the per-integration analytics table to \"Integration health matrix\" and added each integration's Enabled\/Disabled state and Auto\/Shortcode injection mode.<\/li>\n
- New: Settings imports now provide a client-side preview showing setting-key count, export date, whether Site\/Secret keys are included, included settings groups, and plugin-identifier mismatch warnings before Replace or Merge is committed.<\/li>\n
- New: On WordPress 7.1 and later, the Kitgenix brand icon is registered with the WordPress Icon Registration API as
kitgenix\/mark<\/code> for discovery through wp_get_icon()<\/code> and the icons REST endpoint.<\/li>\n- Improved: All settings areas \u2013 Site Keys, Display, Integrations, Security, Advanced, and Portability \u2013 now use consistent cards, labelled rows, toggle switches, and unified alert components.<\/li>\n
- Improved: Refreshed the admin and public-facing Turnstile widget colours from the previous purple palette to the updated Kitgenix blue palette, including light and dark mode variants.<\/li>\n
- Improved: The plugin-specific admin stylesheet now builds on the shared Kitgenix admin UI stylesheet for consistent spacing, typography, and component styling.<\/li>\n
- Improved: The recent diagnostic log is now displayed as a searchable, paginated table with time, integration, outcome, and a plain-English note instead of a read-only text block.<\/li>\n
- Improved: Retained the \"Copy recent log\" action for quickly copying the raw diagnostic log for troubleshooting or support.<\/li>\n
- Improved: Per-integration analytics now supports live search and pagination.<\/li>\n
- Improved: The Support tab is now three focused cards \u2013 a donate card with a collapsible monthly-amount picker, a \"what your support funds\" summary, and a \"get involved\" panel for reviews and plugin links.<\/li>\n
- Improved: Stale WordPress security tokens are no longer counted as blocked attempts or included in the failure-spike alert threshold because they represent recoverable session or caching friction rather than genuine security rejections.<\/li>\n
- Improved: The replayed-token diagnostic message now explains that the event can result from legitimate actions such as double-clicks or back-button resubmissions as well as malicious replay attempts.<\/li>\n
- Improved: Both Turnstile validation entry points now consistently respect site-wide Developer Mode and the new per-integration Test Mode.<\/li>\n
- Fix: WooCommerce lost\/reset-password protection is now self-contained. Enabling only the WooCommerce lost-password integration now validates its own My Account reset-request form without depending on the separate WordPress Core integration.<\/li>\n
- Fix: WooCommerce lost-password validation is scoped to WooCommerce's own form and does not interfere with the native
wp-login.php<\/code> lost-password flow.<\/li>\n- Fix: WooCommerce login verification now runs only once per request when both modern and legacy WooCommerce login-error filters fire, preventing legitimate submissions from being incorrectly rejected as replayed or expired.<\/li>\n
- Fix: bbPress forum creation now validates Turnstile exactly once on the correct pre-insert action instead of running a second redundant validation through
bbp_new_forum_pre_insert<\/code>.<\/li>\n- Fix: Removed incorrect handling that could replace bbPress forum post data with an unexpected validation return value.<\/li>\n
- Fix: WPForms Turnstile errors now render the actual error message instead of the literal text \"Array\".<\/li>\n
- Fix: The admin language allow-list is now sourced from
Script_Handler::get_allowed_languages()<\/code> so global and per-integration language settings cannot drift apart.<\/li>\n- Fix: Elementor AJAX handling is now scoped to the form that actually submitted a solved Turnstile token instead of affecting every Elementor form on the page.<\/li>\n
- Fix: Elementor widgets are now hidden or cleared only after a confirmed successful form submission, preserving the widget after validation failures so visitors can retry.<\/li>\n
- Security: Completed a full hook-by-hook enforcement audit of every supported integration to verify that a failed Turnstile check in enforcement mode actually blocks the protected action rather than merely being logged.<\/li>\n
- Security: Fixed Contact Form 7 shortcode-only mode so the
wpcf7_validate<\/code> validation filter is always registered. Previously shortcode-only placement could render the widget while allowing submissions to bypass validation completely.<\/li>\n- Security: Contact Form 7 shortcode mode now correctly respects the integration's enable\/disable setting.<\/li>\n
- Security: Removed request-method fail-open checks from Contact Form 7 and Elementor validation. Validation now runs whenever the host plugin invokes the relevant validation hook rather than trusting
$_SERVER['REQUEST_METHOD']<\/code> as a security boundary.<\/li>\n- Security: Fixed Easy Digital Downloads login protection by replacing the nonexistent
edd_process_login_form<\/code> hook with WordPress's real authenticate<\/code> filter, scoped to EDD login submissions through EDD's own nonce field.<\/li>\n- Security: Fixed Fluent Forms enforcement by replacing the nonexistent
fluentform_submit_validation<\/code> hook with Fluent Forms' actual fluentform\/validation_errors<\/code> validation filter.<\/li>\n- Security: Rebuilt Kadence Forms protection against the current Kadence Blocks \"Form (Adv)\" implementation using
kadence_blocks_advanced_form_submission_reject<\/code>, replacing dead hooks and an invalid class check that meant validation previously never ran.<\/li>\n- Security: Kadence Advanced Form widget injection now uses an appropriate frontend script bridge because the block does not expose a suitable PHP render filter.<\/li>\n
- Security: Fixed Ninja Forms token delivery by attaching the token to the relevant AJAX request header rather than inserting a hidden DOM field that Ninja Forms never included in its JSON submission payload.<\/li>\n
- Security: Ninja Forms failed Turnstile checks now terminate the submission request directly instead of writing to an error-array structure that Ninja Forms does not consult.<\/li>\n
- Security:
Turnstile_Validator::validate_token()<\/code> now respects site-wide Developer Mode and per-integration Test Mode consistently with is_valid_submission()<\/code>.<\/li>\n- Security: Confirmed diagnostic and analytics CSV exports do not introduce spreadsheet formula\/DDE injection because they contain plugin-generated labels and counters rather than raw user-submitted form values.<\/li>\n
- Security: Confirmed settings exports continue to exclude the Site Key and Secret Key unless an administrator explicitly opts to include them.<\/li>\n
- Security: Re-verified trusted-proxy client IP resolution against spoofed proxy headers and out-of-range CIDRs.<\/li>\n
- Security: Proxy headers including
CF-Connecting-IP<\/code>, True-Client-IP<\/code>, X-Forwarded-For<\/code>, and X-Real-IP<\/code> are only trusted when REMOTE_ADDR<\/code> matches an administrator-configured trusted proxy address or CIDR.<\/li>\n- Security: Client IP values extracted from trusted proxy headers must be valid public addresses; private and reserved addresses are rejected.<\/li>\n
- Performance: Frontend Turnstile script loading remains unchanged. Cloudflare
api.js<\/code> continues to load once and only when a widget will actually render for the current visitor.<\/li>\n- Performance: Whitelisted requests continue to skip Turnstile frontend script loading entirely.<\/li>\n
- Performance: The existing duplicate Turnstile loader detector remains unchanged.<\/li>\n
- Compatibility: Confirmed compatibility with WordPress 7.1.<\/li>\n
- Compatibility: Declared WooCommerce High-Performance Order Storage (HPOS \/
custom_order_tables<\/code>) compatibility.<\/li>\n- Compatibility: Re-verified that Checkout Blocks order verification metadata uses WooCommerce's
WC_Order<\/code> CRUD API through update_meta_data()<\/code> and save()<\/code> rather than direct database access.<\/li>\n- Compatibility: Verified WooCommerce 11.x compatibility across Classic Checkout, Checkout Blocks\/Store API, and WooCommerce My Account login, registration, and lost-password flows against current WooCommerce source.<\/li>\n
- Dev: Added
Turnstile_Validator::get_all_integration_keys()<\/code> as the canonical list of integrations eligible for Test Mode and per-integration settings, sourced consistently with get_integration_label()<\/code>.<\/li>\n- Dev: Updated Kitgenix logo and favicon filenames and references throughout the plugin and Kitgenix Hub to use the shared brand asset set.<\/li>\n
- Dev: Refreshed the Kitgenix Hub plugin directory listing, including the renamed MultiStore for WooCommerce entry and the new Image Optimizer listing.<\/li>\n
- Dev: Added automated tests covering enforcement regressions discovered during the integration audit.<\/li>\n
- Dev: Added automated tests covering spoofed trusted-proxy headers and out-of-range CIDR scenarios.<\/li>\n
- Documentation: Documented the Kitgenix Plugin Score integration in the readme for the first time.<\/li>\n
- Documentation: Expanded the changelog to distinguish security-sensitive enforcement fixes from general bug fixes.<\/li>\n
- Documentation: Documented the previously undocumented
kitgenix_turnstile_skip_wp_login_validation<\/code> filter under Developers \u2192 Filters.<\/li>\n<\/ul>","raw_excerpt":"Add Cloudflare Turnstile to WordPress, WooCommerce and popular forms with server-side verification and anti-spam controls.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/245569","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=245569"}],"author":[{"embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/kitgenix"}],"wp:attachment":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=245569"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=245569"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=245569"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=245569"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=245569"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=245569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}