Works with your stack
Cookie consent for Simple Cloudflare Turnstile
the form has to send
Simple Cloudflare Turnstile adds Cloudflare’s Turnstile check to your forms. If the script is held, protected forms refuse to send. Cookie Rocks classes Turnstile as necessary and never holds it.
By Elliot Sowersby · simpleturnstile.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Simple CAPTCHA with Cloudflare Turnstile
WordPress plugin
- Tested version
- 1.44.5
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 1.44.5 tested
- Active installs
- 200,000+
What Simple Cloudflare Turnstile adds to your visitors’ browser
No trackers In our test of Simple CAPTCHA with Cloudflare Turnstile 1.44.5 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What matters for consent with Simple Cloudflare Turnstile
Only where a form is
Turnstile loads from Cloudflare only on pages with a protected form and on the login page. With the Elementor integration on, it loads on every page by default.
Held means broken
If Turnstile is held, its field stays empty: comments end on an error page and logins are refused. Cookie Rocks classes it as necessary and never holds it.
The failsafe mode
An optional failsafe can load Google’s reCAPTCHA while Cloudflare is unreachable. It is off by default. If you switch it on, reCAPTCHA belongs in your cookie list too.
A check from your server
Each protected form is checked by your server with Cloudflare, with the visitor’s IP address. Mention it in your privacy policy.
What our tests found on Simple Cloudflare Turnstile
Depends on a setting · Simple CAPTCHA with Cloudflare TurnstileIf Turnstile is held, protected forms fail; Cookie Rocks never holds it
setting “cfturnstile_failover” · by default: off
A comment ends on a 403 error and a login is rejected. Cookie Rocks classes Turnstile as necessary. An optional failsafe mode can load Google reCAPTCHA while Cloudflare is unreachable.
Read in its code, 16 October 2026, Simple CAPTCHA with Cloudflare Turnstile 1.44.0.
Full detail
If the Turnstile script is held, its field stays empty and protected forms refuse to send: a comment ends on a 403 error page and a login is rejected with "Please verify that you are human." The optional failsafe mode can load Google reCAPTCHA (www.google.com/recaptcha/api.js) instead while Cloudflare is unreachable. The plugin adds its own exclusions for the delay and combine features of the main cache plugins. Cookie Rocks classes Turnstile as necessary and never holds it.
Set before the choice · Simple CAPTCHA with Cloudflare TurnstileSimple Cloudflare Turnstile loads only on pages with a protected form
setting “Elementor integration scope” · by default: all
Also on the login page, and on every page with its Elementor integration on. Each submission is checked with Cloudflare, sending the visitor's IP address. No WP Consent API support.
Read in its code, 16 October 2026, Simple CAPTCHA with Cloudflare Turnstile 1.44.0.
Full detail
Simple Cloudflare Turnstile loads challenges.cloudflare.com/turnstile/v0/api.js (deferred, data-cfasync=false) only on pages that show a protected form and on wp-login.php, and nothing at all without a site key and secret. With its Elementor integration on, the default scope loads it on every page. Each protected submission is checked by the server at Cloudflare's siteverify endpoint with the visitor's IP address. It has no WP Consent API support.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Simple CAPTCHA with Cloudflare Turnstile 1.44.5, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Simple CAPTCHA with Cloudflare Turnstile 1.44.5 on 7 November 2026, with WordPress 7.1.3.
Anti-spam
Other plugins of the same kind.
Questions
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with Turnstile
Forms keep working, consent stays clear.
never held
Every feature of the complete plugin for 30 days, no card. Simple Cloudflare Turnstile keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.