Get Plugin

Docs Stop WordPress form spam without CAPTCHAs

Protect forms with Cloudflare Turnstile

Add invisible bot protection to WordPress forms with Cloudflare Turnstile—no puzzle CAPTCHA for real visitors.

The problem

You want stronger bot blocking than a honeypot alone, but you refuse to force visitors through image puzzles.

The solution

Sobi Forms supports Cloudflare Turnstile in invisible mode. The widget runs in the background on form pages. Tokens are verified on submit via Cloudflare siteverify.

How to set it up

  1. In the Cloudflare dashboard, create a Turnstile widget.
  2. Choose Invisible mode (required for Sobi Forms).
  3. Copy the Site key and Secret key.
  4. In WordPress, open Sobi Forms → Settings → Spam protection.
  5. Paste the keys under Cloudflare Turnstile, verify them, then enable the integration.
  6. Save settings.

Optional: define SOBIFORMS_TURNSTILE_SECRET in wp-config.php instead of storing the secret in the database.

What happens on failure

  • Token rejected or missing — the submission is dropped: nothing saved, no email, no webhook. The visitor still sees a discreet success (stealth).
  • Cloudflare unreachable — Sobi Forms fails open so legitimate visitors are not blocked by an outage.

Privacy note

Turnstile may collect browser telemetry. Mention Cloudflare Turnstile in your Privacy Policy when enabled.