---
type: "Trust post"
title: "Set up Cloudflare Turnstile to block spam bots on WordPress"
docType: "How-to guide"
description: "Block spam bots on the WordPress login page, comments and contact forms with free Cloudflare Turnstile, as a replacement for Google reCAPTCHA."
resource: "https://cuongthach.com/docs/content-system/resources/website-tools/software/cloudflare-turnstile/"
markdown: "https://cuongthach.com/docs/content-system/resources/website-tools/software/cloudflare-turnstile/index.md"
tags:
  - "docs"
  - "en"
  - "content-system"
  - "How-to guide"
  - "Resources"
status: stable
generated:
  by: "process:cuongthach-okf-export"
  at: "2026-10-27T14:18:02Z"
---
# Set up Cloudflare Turnstile to block spam bots on WordPress

Cloudflare Turnstile is a free security service from Cloudflare. It replaces Google reCAPTCHA to block automated attacks from spam bots. On a WordPress website, you put Turnstile in three places:

- **The admin area**, including the sign-up and forgot password pages.
- **Comments**, the easiest place to attack, which hurts your reputation, SEO and website speed.
- **Form plugins** like Contact Form 7, to filter sign-up emails, save money and protect the health of your domain's email.

Every website gets spam bots, new or old. Bots post comments on their own, try to log in on their own and attack every page that has a form.

## Why does a WordPress website need to block spam bots?

![Why does a WordPress website need to block spam bots?](https://cuongthach.com/docs/_astro/illus-docs-turnstile-cong-xoay.en.nvoOob8f_ZTKTiY.svg "The send button opens only for real people")

**Comments take the worst of it.** If you do not block bots, the comment section fills with junk even on a new site. If you leave it for a long time, your site's data grows too big.

Spam bots usually leave ad links to other sites to get backlinks. Junk comments like that pull your site's SEO down. Bots also use the chance to try to hack your site through login forms, especially the admin login page.

Turnstile only opens the login button or the submit comment button after it confirms the user is a real person. Add a few other ways to stop bots and your site blocks a lot of spam.

## What do you need to get ready?

- **A free Cloudflare account**, because Turnstile is a part of Cloudflare.
- **Your website's domain**, to set as the widget's hostname.
- **A form plugin** if you also want to protect forms, for example [Contact Form 7](/docs/content-system/resources/website-tools/wordpress/contact-form-7).

## Set up Cloudflare Turnstile for WordPress

1. **Create a Turnstile widget**

   The widget is the check box that shows on your form, tied to your domain. Log in to Cloudflare and go to **Turnstile** > **Add widget**:

   - Name the widget anything you like.
   - Add your domain as the hostname. A widget takes at most 10 hostnames, so use each widget for 1 domain only. Any subdomains you add later can share it.
   - Leave the other settings as they are and save.

   :::note
   Keep the **Managed** mode as it is. It works better than the invisible mode.
   :::
2. **Save the site key and secret key**

   These two keys connect your website to the widget you just made. The plugin in step 3 needs both. When you finish creating the widget, Cloudflare shows the two keys right away. They look like this:

   ```text
   // the site key looks like this:
   xxxxxxxxxxABciuySeXAMX_Bo8
   ```

   ```text
   // the secret key looks like this
   xxxxxxxxxxciuz9aFNOaRY1I0VNJckam1J4
   ```

   Copy both before you leave the page.
3. **Install the Simple Cloudflare Turnstile plugin**

   Install and activate the free plugin [Simple Cloudflare Turnstile](https://wordpress.org/plugins/simple-cloudflare-turnstile/?ref=cuongthach.com), then enter the site key and secret key from step 2.

   Tick:

   - Disable the submit button, for better protection
   - WordPress login
   - WordPress registration
   - WordPress password reset
   - Comments, the most important one
   - Form plugins like Contact Form 7

   Leave the other settings as they are. Save your changes to finish the setup.

## How do you know Turnstile blocks spam bots?

On the plugin's settings page, click the button that tests the response. Green text that reports success means the site key and secret key are correct.

Then log out and open the WordPress login page. The Turnstile box shows on the form, and the login button only lights up after the box turns green. Open a post that has comments. The submit comment button is also off until Turnstile confirms you are a real person.

Source: https://cuongthach.com/docs/content-system/resources/website-tools/software/cloudflare-turnstile/index.mdx