— go to the documentation home page
FormFlow documentation

Cloudflare Turnstile

Cloudflare Turnstile is a privacy-friendly bot check that protects your Elementor forms from spam and automated abuse — without annoying puzzle CAPTCHAs.

Available onProAgency

Documents version1.5.3

Last updated

On this page

What this does

Turnstile quietly verifies that a real person is submitting your form. It blocks the bots that flood forms with spam while staying invisible or effortless for genuine visitors.

Why it exists: open forms attract spam. Turnstile stops it with far less friction than traditional CAPTCHAs — and it’s free from Cloudflare.

Typical use cases

  • Cutting spam on contact and lead forms.
  • Protecting high‑traffic public forms.
  • Reducing junk alongside IP blocking.

What you need first

  • A Cloudflare account (free).
  • A Turnstile widget, which provides a Site Key and Secret Key.

Create a widget at Cloudflare → Turnstile.


How to set it up

  1. Enable Cloudflare Turnstile on FormFlow → Features (Security & Analytics group).
  2. Go to FormFlow → Security and open the Turnstile settings.
  3. Paste your Site Key and Secret Key.
  4. Choose which forms to protect and the widget theme, then save.
  5. Test by submitting a protected form.

Tips & Best Practices

  • Double‑check your keys. A mismatched Site/Secret Key is the usual cause of failures.

  • Match the theme (light/dark/auto) to your form’s design.

  • Combine with IP blocking for layered spam protection.

  • Test after enabling to confirm the widget appears and real submissions pass.


Frequently Asked Questions

Is Turnstile free?

No — the FormFlow Turnstile feature is Pro. Cloudflare Turnstile itself is free to use.

Do I need a Cloudflare account?

Yes — to create the Turnstile widget and get your keys (it’s free).

Will it annoy visitors like old CAPTCHAs?

No — Turnstile is designed to be invisible or a single effortless step for real users.

Where do I add my keys?

On the FormFlow → Security tab.

Which forms does it protect?

The forms you choose in the settings.

What if legitimate users fail the check?

Re‑verify your keys and domain in Cloudflare — see the Troubleshooting Guide.