We’ve added support for Cloudflare Turnstile to the Kadence CAPTCHA plugin. Turnstile is an invisible CAPTCHA alternative. You can still use Google’s reCAPTCHA versions 3 and 4, but you may want to switch to Cloudflare Turnstile for a better user experience on your WordPress login, comment, and WooCommerce screens. CAPTCHAs increase your site’s security by verifying user interactions are coming from humans, not bots. Turnstile can do this without your site’s visitors even knowing it’s there!
What is a CAPTCHA and Why Should I Use One?
CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.” Automated scripts and bots are widely used to simulate human interactions on the web for nefarious purposes like spamming your site’s forms or testing common or stolen login credentials on your site’s login forms. Carding attacks on WooCommerce are a security threat e-commerce site owners face.
Using a CAPTCHA lets you verify it’s a real person who is submitting a form, buying your products, or trying to log in to your site. Bots are screened out and blocked if they’re unable to pass the “prove you’re human” test presented to them by a CAPTCHA.
Google’s reCAPTCHA uses image identification puzzles to separate bots from humans. This can get annoying for us humans. If you have to identify photos and solve other puzzles to prove your humanity several times a day, this becomes very bothersome. Adding a CAPTCHA like this in your store’s checkout screen adds friction for customers and may reduce your sales.
That’s where Cloudflare Turnstile comes in as an invisible CAPTCHA or noCAPTCHA service.
What is Turnstile and Invisible CAPTCHA?
Cloudflare Turnstile uses machine learning and “non-intrusive browser challenges based on telemetry and client behavior” to determine which of your visitors are human — without asking them to do anything. Turnstile doesn’t even have to be visible on your site. You can make it completely invisible to your visitors. None of your traffic is sent through Cloudflare during this process.
How to Start Using Turnstile with Kadence
1. Get the Kadence CAPTCHA plugin
Download and Install the Kadence CAPTCHA plugin or update the previous Kadence reCAPTCHA version if you already have it installed. Your old settings will continue to work, and the user experience will be the same.
2. Get a Turnstile Site Key and Secret Key
If you want to set up Turnstile, you’ll need to have or create an account at Cloudflare, which is free. Once you’ve logged into your Cloudflare account at https://dash.cloudflare.com navigate to the Turnstile Settings screen from the Turnstile link in the left menu.
You’ll need to create a new site record, name it, and enter its domain name. You must also select how you want Turnstile to appear (or not appear) on your site.
At the bottom of your Turnstile settings, you will find your API Keys. Copy them and paste them into the corresponding fields in your Kadence CAPTCHA settings.
3. Add Your Site Key and Secret Key to Your Kadence CAPTCHA Settings
Go to Settings > Captcha Settings in your WordPress admin menu. In the API Keys tab, you can select either Google reCAPTCHA or Cloudflare Turnstile. Select Turnstile. (If you prefer to use reCAPTCHA, click here for setup instructions.)
4. Choose What You Want Turnstile to Protect
Finally, under the Form Settings tab, you can select where Turnstile will be used on your site to block bad bots that would abuse your comment, login, registration, and purchasing forms.
Under the Design Settings tab, you can optionally select whether to display the Turnstile widget (logo and CAPTCHA interface) in colors matched to light or dark backgrounds. This isn’t a relevant setting if you’ve opted to make the Turnstile widget totally invisible in your Cloudflare account settings.
Benefits of the Kadence Full Bundle
The Kadence CAPTCHA plugin is only available within the Kadence Full Bundle and is not sold separately. If you’re dealing with bot submissions, carding attacks, or spam, Kadence CAPTCHA gives you another tool to minimize malicious activity on your WordPress site.