CleanTalk Spam Protection
CAPTCHA-free cloud anti-spam for comments, registrations, WooCommerce and 100+ form plugins, with a firewall for known bots. From $12/year.
85
Simple Cloudflare Turnstile
Free plugin that adds Cloudflare Turnstile CAPTCHA to WordPress, WooCommerce and 30+ form, membership and community plugins.
Free installs200K+WordPress.org, active
Rating4.7/5262 reviews
Price fromFreeFree
Last updated31 Oct 2026Version 1.44.5
Overview
Simple Cloudflare Turnstile (listed on WordPress.org as Simple CAPTCHA with Cloudflare Turnstile) is a free plugin from RelyWP that places Cloudflare’s Turnstile challenge on WordPress forms. Turnstile is Cloudflare’s alternative to traditional CAPTCHAs: most visitors pass it automatically without solving a puzzle, and it does not rely on tracking cookies.
Setup is a matter of creating a free site key and secret key in the Cloudflare dashboard, pasting them into the plugin, and ticking the forms you want to protect. The plugin then injects the widget and validates each submission server-side.
Coverage
The integration list is long for a free plugin. Beyond the core WordPress login, registration, password reset and comment forms, it covers WooCommerce (classic and block checkout, Pay for Order, account forms), form builders such as WPForms, Gravity Forms, Contact Form 7, Fluent Forms, Formidable, Forminator, Kadence and SureForms, Elementor Pro forms, and membership and community plugins including MemberPress, Paid Memberships Pro, Ultimate Member, BuddyPress and bbPress.
Controls
- Theme, language, widget size, appearance mode and custom error text
- Allowlisting for logged-in users, IP addresses or CIDR ranges and user agents
- Failsafe mode that either lets submissions through or falls back to Google reCAPTCHA if Cloudflare is unreachable
- Optional analytics and a debug log that record passed and failed checks with failure reasons
- Scripts loaded only where a widget is needed, with deferral and preconnect options
Free vs paid
There is no paid edition: the readme states the plugin is completely free, and Turnstile itself is a free Cloudflare service. Support runs through the WordPress.org forum.
Limitations
Protection depends entirely on Cloudflare’s service, so it is not a fit for sites that want all checks to run locally. It offers no honeypot, cloud spam-content filtering, country blocking or block lists of IPs or words; it is a challenge tool, not a full anti-spam filter, so human-typed spam still gets through.
It suits site owners who want a privacy-friendly, mostly invisible CAPTCHA across many plugins without paying for a licence.
Best for: Sites that want free, low-friction Cloudflare Turnstile protection across WordPress, WooCommerce and many form plugins.
Simple Cloudflare Turnstile gives broad Turnstile coverage and sensible reliability options at no cost. It is a challenge layer rather than a complete anti-spam system, so pair it with a content filter if human spam is a problem.
Pros
- Completely free with no features held back for an upgrade
- Covers 30+ integrations including WooCommerce block checkout, form builders and membership plugins
- Turnstile usually passes real visitors without a puzzle and avoids tracking cookies
- Failsafe mode can allow submissions or fall back to reCAPTCHA during Cloudflare outages
- Allowlists for logged-in users, IP/CIDR ranges and user agents
- Optional analytics and debug log show passed and failed checks
Cons
- Depends on Cloudflare's service; no local or self-hosted challenge
- No honeypot, content-based spam filtering or country blocking
- Only allowlists; no block lists for IPs, emails or words
- Support is limited to the WordPress.org forum
Key features
What Simple Cloudflare Turnstile highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Cloudflare Turnstile on core WordPress forms
- WooCommerce classic and block checkout
- WPForms, Gravity Forms, CF7 and more
- Elementor Pro forms support
- BuddyPress, bbPress and Ultimate Member
- MemberPress and Paid Memberships Pro
- Theme, size, language and appearance options
- Allowlist IPs, user agents, logged-in users
- Failsafe mode with reCAPTCHA fallback
- Submission analytics and debug log
- Scripts load only where needed
- Multisite compatible
Feature checklist
34 of 46 features we track in CAPTCHA & Spam, feature score 73/100
Protection methods 3/7
Google reCAPTCHA Key
Supports Google reCAPTCHA (v2 checkbox, invisible or v3 score-based).
Only as a fallback in failsafe mode when Cloudflare is unavailable; Turnstile is the main challenge.
Partial
Cloudflare Turnstile Key
Supports Cloudflare Turnstile, the privacy-friendly CAPTCHA alternative.
Cloudflare Turnstile is the plugin's core challenge.
Included
hCaptcha
Supports hCaptcha challenges.
Only Turnstile, with reCAPTCHA as an outage fallback.
Not included
Built-in CAPTCHA
Own image, math or puzzle CAPTCHA with no third-party service.
No built-in math or image CAPTCHA; verification is done by Cloudflare.
Not included
Honeypot fields
Hidden fields and timing checks that catch bots without a visible challenge.
No honeypot fields; protection relies on the Turnstile check.
Not included
Cloud spam filtering Key
Submissions checked against a cloud spam database of known spammers.
Does not check submission content against a spam database.
Not included
No challenge for real users
Blocks bots without asking visitors to solve anything.
Turnstile usually passes humans without a puzzle; an interaction-only mode hides the widget unless needed.
Included
Where it protects 7/7
Comments Key
Protects WordPress comments from spam.
WordPress comments and wpDiscuz comment forms.
Included
Login & password reset Key
Protects the login and lost-password forms.
WordPress and WooCommerce login and password reset forms.
Included
Registration
Protects the user registration form.
WordPress, WooCommerce and several membership registration forms.
Included
WooCommerce checkout & account Key
Protects WooCommerce checkout, login and registration forms.
Classic and block checkout, Pay for Order, login, registration and account forms.
Included
Form plugin support Key
Works with popular form plugins such as Contact Form 7, WPForms or Gravity Forms.
WPForms, Gravity Forms, CF7, Fluent, Formidable, Forminator, Jetpack, Kadence and SureForms.
Included
Page builder forms
Protects forms built in Elementor, Divi or similar builders.
Elementor Pro forms and Kadence forms are supported.
Included
Community & membership plugins
Protects BuddyPress, bbPress, Ultimate Member or similar.
BuddyPress registration, bbPress topics/replies, Ultimate Member and other membership forms.
Included
Rules & controls 4/5
Block and allow lists
Block or allow specific IPs, emails, words or user roles.
Allowlists only: IPs/CIDR ranges and user agents can skip the check; no block lists.
Partial
Country & language filters
Block submissions by country or language.
No country or language blocking options.
Not included
Spam log & statistics
Log of blocked submissions with counts and reasons.
Optional analytics and debug log record passed/failed checks with failure reasons.
Included
Skip for logged-in users
Hide the challenge for logged-in or trusted users.
Option to hide the challenge for logged-in users.
Included
Custom labels & error messages
Change challenge text, errors, theme or language.
Theme, language, size, label text and custom error messages.
Included
Privacy & performance 3/4
Privacy & GDPR options
No tracking cookies, data minimisation or a documented GDPR mode.
Plugin adds no tracking; readme notes Turnstile does not use cookies to collect data.
Included
Works without an external service
Core protection runs entirely on your own server.
Each check is verified by Cloudflare's Turnstile service.
Not included
Scripts load only where needed
CAPTCHA scripts are only loaded on pages that have a protected form.
Readme says scripts load only on pages that need them; defer option on by default.
Included
Multisite support
Works across a WordPress multisite network.
Readme states WordPress Multisite compatibility.
Included
Form & plugin integrations 15/17
Contact Form 7 Key
Protects Contact Form 7 forms.
Free integration, with a [cf7_simple_turnstile] form tag for placement.
Included
WPForms
Protects WPForms forms.
WPForms is a listed free form integration.
Included
Gravity Forms
Protects Gravity Forms forms.
Gravity Forms supported in free, including multi-page forms.
Included
Elementor Pro forms
Protects Elementor Pro form widgets.
Elementor Pro forms, including popups and templates.
Included
Ninja Forms
Protects Ninja Forms forms.
Plugin docs state there is no Ninja Forms integration.
Not included
Formidable Forms
Protects Formidable Forms forms.
Formidable Forms is a listed free integration.
Included
Fluent Forms
Protects Fluent Forms forms.
Fluent Forms is a listed free integration.
Included
Forminator
Protects Forminator forms.
Forminator is a listed free integration.
Included
Divi contact forms
Protects Divi contact form modules.
No Divi contact form module integration listed; only Divi checkout/Woo form compatibility.
Not included
Easy Digital Downloads
Protects EDD checkout, login or registration.
Easy Digital Downloads forms are a listed free integration.
Included
BuddyPress
Protects BuddyPress registration and activity.
BuddyPress registration form only.
Included
bbPress
Protects bbPress topics and replies.
bbPress create topic and reply forms.
Included
Ultimate Member
Protects Ultimate Member login and registration.
Ultimate Member forms are a listed free integration.
Included
MemberPress
Protects MemberPress signup and login.
MemberPress forms, with an option to limit by membership ID.
Included
Mailchimp for WP (MC4WP)
Protects MC4WP newsletter sign-up forms.
MC4WP forms supported via a dedicated shortcode in the form.
Included
wpDiscuz
Protects wpDiscuz comment forms.
wpDiscuz comment form is a listed free integration.
Included
Custom forms & developer API
Protect any custom form via shortcode, function or hooks.
Documented helper functions render and verify Turnstile in custom forms; shortcodes too.
Included
Advanced protection 2/6
Bot firewall
Blocks known spam bots before pages load.
No bot firewall; protection is the Turnstile check on forms.
Not included
Disposable email blocking
Rejects throwaway or fake email addresses.
No email address validation or disposable-domain list.
Not included
Card-testing protection
Stops bots testing stolen cards at WooCommerce checkout.
Turnstile on classic/block checkout and Pay for Order; no dedicated card-testing detection.
Partial
REST API & XML-RPC protection
Blocks spam or abuse through the REST API or XML-RPC.
Login and register checks are skipped for XML-RPC requests; no REST/XML-RPC blocking.
Not included
Spam review & false-positive recovery
Review blocked submissions and approve false positives.
Analytics and a debug log only; no queue to review or release blocked submissions.
Not included
Test mode & debugging
Test keys, debug logs or a test mode to check setup safely.
Test API Response button, Cloudflare dummy test keys and an optional debug log.
Included
Pricing
Free
$0On WordPress.org
Free
FreelifetimeUnlimited
Fully free; no paid edition. Cloudflare Turnstile keys are also free.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Simple Cloudflare Turnstile?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
200K+
Active installations reported by WordPress.org.
Vendor claim
—
The vendor does not publish a total.
Estimated Pro / paid installs
n/a
There is no paid version.
Stats & health
Weekly downloads
289,283 downloads last week, 3.4M all time
Rating breakdown
| Version | 1.44.5 |
|---|---|
| Last updated | 31 Oct 2026 (3 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 4.7+ |
| Support threads (2 months) | 23 of 39 resolved |
| On WordPress.org since | 15 Oct 2022 |
Company & policy
| Refund policy | Not applicable (free plugin) (source, 6 Oct 2026) |
|---|
Simple Cloudflare Turnstile compared
Antispam Bee/Simple Cloudflare Turnstile
Akismet Anti-spam/Simple Cloudflare Turnstile
Advanced Google reCAPTCHA/Simple Cloudflare Turnstile
Simple Cloudflare Turnstile/WP Armour – Honeypot Anti Spam
reCAPTCHA for WooCommerce/Simple Cloudflare Turnstile
hCaptcha for WordPress/Simple Cloudflare TurnstileCleanTalk Spam Protection/Simple Cloudflare Turnstile
CAPTCHA 4WP/Simple Cloudflare Turnstile Alternatives to Simple Cloudflare Turnstile
hCaptcha for WordPress
Free plugin that adds hCaptcha to WordPress core, WooCommerce and 60+ form, builder and community plugins, with honeypot and IP controls.
84
Advanced Google reCAPTCHA
WebFactory's free CAPTCHA and login-protection plugin with reCAPTCHA and a built-in math CAPTCHA; WP Captcha PRO adds hCaptcha, Turnstile and a firewall.
81
WP Armour – Honeypot Anti Spam
Honeypot anti-spam plugin that blocks bots on comments and many form plugins with no CAPTCHA, API key or external calls; Extended adds…
67
CAPTCHA 4WP
Freemium CAPTCHA plugin: free reCAPTCHA for core WordPress forms; Premium adds hCaptcha, Turnstile, WooCommerce, form plugins and geoblocking.
67
Akismet Anti-spam
Automattic's cloud spam filter for WordPress comments and many form plugins; free keys for personal sites, paid plans for commercial use.
43
FAQ
Is Simple Cloudflare Turnstile free?
Yes. Simple Cloudflare Turnstile has a free version on WordPress.org.
How many sites use Simple Cloudflare Turnstile?
WordPress.org reports 200K+ active installations of the free version.
Does Simple Cloudflare Turnstile have google recaptcha?
Yes: partial. Only as a fallback in failsafe mode when Cloudflare is unavailable; Turnstile is the main challenge.
Does Simple Cloudflare Turnstile have cloudflare turnstile?
Yes: included. Cloudflare Turnstile is the plugin's core challenge.
Does Simple Cloudflare Turnstile have cloud spam filtering?
No: not included. Does not check submission content against a spam database.
Does Simple Cloudflare Turnstile have comments?
Yes: included. WordPress comments and wpDiscuz comment forms.
Does Simple Cloudflare Turnstile have login & password reset?
Yes: included. WordPress and WooCommerce login and password reset forms.
Does Simple Cloudflare Turnstile have woocommerce checkout & account?
Yes: included. Classic and block checkout, Pay for Order, login, registration and account forms.
Does Simple Cloudflare Turnstile have form plugin support?
Yes: included. WPForms, Gravity Forms, CF7, Fluent, Formidable, Forminator, Jetpack, Kadence and SureForms.
Does Simple Cloudflare Turnstile have contact form 7?
Yes: included. Free integration, with a [cf7_simple_turnstile] form tag for placement.
Is there a Pro version of Simple Cloudflare Turnstile?
No. The plugin is free with no paid edition, and Cloudflare's Turnstile service is free to use as well.
Does it work with the WooCommerce block checkout?
Yes. It supports both the classic and block checkout, plus Pay for Order and the WooCommerce login, registration, password reset and account details forms.
What happens if Cloudflare is down?
You can enable failsafe mode, which either allows submissions through or switches to Google reCAPTCHA until Turnstile is reachable again.
Will visitors have to solve a puzzle?
Usually not. Turnstile checks the browser in the background and only asks for interaction when it is unsure, and the plugin offers an interaction-only appearance mode.
Last updated 6 Oct 2026. Spotted something wrong? Suggest an edit.