Turnstile is Cloudflare’s smart CAPTCHA alternative. Contact Form 7 provides an integration module with Turnstile, which effectively protects your contact forms from spam bots. Unlike Google reCAPTCHA, Turnstile is available for free. We recommend Turnstile unless you have reasons to use reCAPTCHA.
Get started
You need to obtain a site key and a secret key from Cloudflare. If you don’t have a Cloudflare account yet, create one first. Create a widget for your sites or select an existing one, then copy the site key and secret key for later use. You can ignore the client-side and server-side integration codes, as Contact Form 7 does for you.
After that, move to your WordPress site dashboard. Go to Contact > Integration, then select Setup integration in the Turnstile section. Paste the site key and secret key there.
That’s all. Now, all of your contact forms automatically have the Turnstile widget and are protected from bot attacks.
Controlling the widget rendering
By default, the Turnstile widget is placed at the top of a form. If you want to move it, insert a [turnstile] form-tag into the form template.
In addition, you can specify the following options in a [turnstile] form-tag:
action— Specifies thedata-actionattribute value.appearance— Specifies thedata-appearanceattribute value.language— Specifies thedata-languageattribute value.size— Specifies thedata-sizeattribute value.tabindex— Specifies thedata-tabindexattribute value.theme— Specifies thedata-themeattribute value.
Example: [turnstile size:compact language:en]