Cloudflare Turnstile: Visible or Invisible

Cloudflare Turnstile is a free CAPTCHA alternative that checks visitors in the background and rarely asks them to do anything. You do not need to use Cloudflare for your site’s DNS to use it. In WC Account Portal you can show the small Turnstile box on the form, or keep it invisible until Cloudflare needs the visitor to click.

Get your Turnstile keys#

1. Log in to the Cloudflare dashboard (dash.cloudflare.com) and open Turnstile.
2. Add a new widget. Give it a name and add your store’s domain as a hostname (plus any staging domain).
3. Choose the widget mode: Managed (recommended), Non-interactive or Invisible. See “Cloudflare’s widget mode” below for how this works with the portal setting.
4. Create the widget and copy the Site Key and the Secret Key.

Set it up in the portal#

1. Go to WooCommerce > Account Portal > CAPTCHA / Spam.
2. Under Provider, choose Cloudflare Turnstile.
3. Paste the keys into Site Key and Secret Key.
4. Under Turnstile widget, choose Shown or Invisible.
5. Under Apply to, tick the forms to protect.
6. Click Save Settings.
7. Log out and test each protected form at /my-account/ and in the account drawer.

Turnstile widget: Shown or Invisible#

Option	What it does
Shown (default)	The Cloudflare box is always on the form, so customers see that the form is protected.
Invisible	Nothing shows on the form. Cloudflare checks visitors in the background and only shows its box when it needs someone to click it.

With Invisible, the space for the widget collapses, so the form looks exactly as it does without a CAPTCHA. If Cloudflare decides it needs the visitor to click, the box appears in that space.

Cloudflare’s widget mode#

Cloudflare also sets a mode for each widget in its dashboard (Managed, Non-interactive or Invisible). The portal setting decides whether the box has a place on the form; Cloudflare’s mode decides whether the visitor ever has to interact.

Cloudflare mode	Portal: Shown	Portal: Invisible
Managed	Box always visible; sometimes asks for a click	Hidden; appears only when Cloudflare needs a click
Non-interactive	Box always visible; never asks for a click	Hidden
Invisible	Never shows	Never shows

With Invisible set in Cloudflare, the box never shows, whatever is chosen in the portal.

Light and dark mode#

Turnstile follows the portal: light when the visitor sees the portal in light mode, dark in dark mode. With Auto (follows the device) it uses the visitor’s device setting. The colours are set when the page loads.

Waiting for the token#

Turnstile needs a moment to finish its check. If a customer sends a form before the check is done (common with Invisible), the portal holds the form and sends it as soon as Turnstile is ready, for up to 8 seconds. This works on the My Account forms and in the account drawer. After 8 seconds it sends the form anyway, and the customer sees what went wrong. This avoids “CAPTCHA verification failed” for customers who type quickly or use a password manager.

How the check works#

• Your server sends the Turnstile token to Cloudflare with your secret key and the visitor’s IP address.
• If Cloudflare says no, the form shows CAPTCHA verification failed. Please try again. In the drawer, a form that still has no Turnstile token after the 8-second wait shows Please complete the CAPTCHA verification.
• If your server cannot reach Cloudflare, the request is let through by default. See “If the provider is down” in Setting Up CAPTCHA: An Overview for the wap_captcha_fail_open filter.

Troubleshooting#

Problem	Likely cause
The box shows an error instead of a tick	The domain is not in the widget’s hostnames in the Cloudflare dashboard, or the site key is wrong.
Every attempt fails	The Secret Key is missing, wrong or from a different widget.
The box never appears, even with Shown	The widget’s mode is Invisible in the Cloudflare dashboard. That is fine: the check still runs.
No check at checkout or on wp-login.php	Expected. The portal’s CAPTCHA only protects the My Account forms and the account drawer.

Related#

• Setting Up CAPTCHA: An Overview
• hCaptcha
• reCAPTCHA v3 (Invisible) and the Minimum Score
• Login Page Layouts