Turnstile is Cloudflare’s smart CAPTCHA alternative. Contact Form 7 provides an integration module with Turnstile, which effectively protects your contact forms from spam bots. Unlike Google reCAPTCHA, Turnstile is available for free. We recommend Turnstile unless you have reasons to use reCAPTCHA.
Get started
First, create a Turnstile widget and obtain a pair of site key and secret key, following the Cloudflare Turnstile docs. As for the widget mode, choose the Managed mode as recommended. Copy the site key and secret key for later use. You don’t have to embed the widget manually; that is Contact Form 7’s task.
After that, move to your WordPress site dashboard. Go to Contact > Integration, then select Setup integration in the Turnstile section. Paste the site key and secret key there.
That’s all. Now, all of your contact forms automatically have the Turnstile widget and are protected from bot attacks.
Controlling the widget rendering
By default, the Turnstile widget is placed at the top of a form. If you want to move it, insert a [turnstile] form-tag into the form template.
In addition, you can specify the following options in a [turnstile] form-tag:
action— Specifies thedata-actionattribute value.appearance— Specifies thedata-appearanceattribute value.language— Specifies thedata-languageattribute value.size— Specifies thedata-sizeattribute value.tabindex— Specifies thedata-tabindexattribute value.theme— Specifies thedata-themeattribute value.
Example: [turnstile size:compact language:en]