WHBMP

Cloudflare Turnstile (CAPTCHA)

Oct 19, 2026

Cloudflare Turnstile is a free, friendly CAPTCHA. Most visitors never click anything: it checks in the background and shows a small tick. You can use it instead of Google reCAPTCHA or hCaptcha. Only one provider is active at a time.

What it protects

You choose which forms get the widget:

Form Where
Shopping Cart Checkout The checkout page
Support Ticket Submission The new ticket form
Client Sign-in and Forgot Password The client sign-in (including the email code sign-in) and the password reset pages

The admin sign-in is never protected. This is deliberate: if a key ever expired or a hostname was missing, a CAPTCHA on the admin sign-in would lock every administrator out. Protect the admin with two-factor authentication and a custom admin path instead.

Step 1: Create the widget in Cloudflare

  1. Sign in to the Cloudflare dashboard and open Turnstile.

  2. Click Add widget manually.

    Cloudflare also offers Set up with Spin. Do not use it: it sends an AI coding agent to edit your website's code. WHBMP already has Turnstile built in.

  3. Give it a name, for example WHBMP.

  4. Under Hostnames add every address that shows a form: your main domain (example.com) and www.example.com if you use it. A widget only works on the hostnames listed here.

  5. Choose the widget mode Managed.

  6. Click Create.

  7. Copy the Site Key and the Secret Key.

Keep the Secret Key private. It stays on your server and is stored encrypted.

Step 2: Save and activate it in WHBMP

  1. Open Settings > General Settings > Security.
  2. In the Captcha Providers list open Cloudflare Turnstile.
  3. Paste the Site Key and the Secret Key.
  4. Click Test Connection. It should report success.
  5. Click Save, then Activate. The badge changes from Inactive to Active.

Saving the keys is not enough. Until the badge says Active, no widget is shown.

Step 3: Choose when and where

In the Captcha Policy card, still on the Security tab:

  • Captcha Form Protection: Always On, Off when logged in (clients and staff who are signed in are not asked) or Always Off.
  • Forms to Protect: tick the forms from the table above.

Click Save for the tab.

Step 4: Test it

  1. Open a private browser window, so you are not signed in.
  2. Visit the client sign-in page (/client/login).
  3. The Turnstile box appears above the sign-in button. Sign in once to confirm it passes.

If you chose Off when logged in and you are signed in as a client or administrator in that browser, you will not see the widget. That is expected.

Cloudflare proxy

Turnstile works whether or not your site is behind the Cloudflare proxy (orange cloud). It does not need to be.

Demo and test sites

The public demo blocks changes to CAPTCHA settings. Set it up on your live site only.

Troubleshooting

Problem Fix
No widget on the sign-in page The provider must say Active, Login forms must be ticked, and the mode must not be Always Off. Check in a private window.
The widget spins and never finishes The hostname you are visiting is not in the widget's hostname list in Cloudflare, or the Site Key is wrong. Add the hostname and try again.
"Please confirm that you are not a robot" every time The Secret Key is wrong. Paste both keys again, test and save.
No widget on the admin sign-in By design.

See also CAPTCHA widget is not showing and Security.

Powered by WHBMP