Cloudflare Turnstile
Cloudflare Turnstile is a privacy-friendly bot check that protects your login and registration forms from spam and automated attacks, with no puzzles.
On this page
What this does
Turnstile quietly verifies that a real person is submitting your login or registration form. It blocks bots that try to spam registrations or brute‑force logins, while staying invisible or effortless for genuine customers.
Why it exists: open login/registration forms attract bots. Turnstile stops them without the friction of traditional CAPTCHAs, and it’s free from Cloudflare.
What you need first
- A Cloudflare account (free).
- A Turnstile widget, which gives you a Site Key and a Secret Key.
Create a widget at Cloudflare → Turnstile.
How to set it up
Step 1 — Open Security settings
Go to SubscriptionFlow → Settings → Security and find the Cloudflare Turnstile box.
Step 2 — Enable and add your keys
- Tick Enable Cloudflare Turnstile.
- Paste your Site Key and Secret Key.
Step 3 — Choose what to protect
- Protect the Login form
- Protect the Register form
Step 4 — Pick a theme
Choose Auto, Light, or Dark to match your site.
Step 5 — Save
Click Save Security Settings.
Tips & Best Practices
-
Protect the registration form first if spam sign‑ups are your main problem.
-
Use the “Auto” theme so the widget adapts to light/dark automatically, or match it to your login page.
-
Double‑check your keys. A mismatched Site/Secret Key is the usual reason the check fails.
-
Test after enabling. Try registering/logging in from an incognito window to confirm the widget appears and submissions succeed.
Frequently Asked Questions
Is Turnstile available on the Free plan?
No — it’s a Pro security feature.
Do I need a Cloudflare account?
Yes, but it’s free. You just create a Turnstile widget to get your Site and Secret keys.
Will it annoy my customers like old CAPTCHAs?
No. Turnstile is designed to be invisible or a single, effortless step for real users.
Where do I put my keys?
In Settings → Security → Cloudflare Turnstile — the Site Key and Secret Key fields.
Can I protect only the registration form?
Yes — enable protection for the login and/or register form independently.
Does Turnstile work with the Elementor login widget?
Yes — when enabled, it applies to the SubscriptionFlow login/registration experience, including the Elementor Login widget.
What if the check fails for real users?
Re‑verify your keys and domain in Cloudflare. See the Troubleshooting Guide.
Was this article helpful?
Something missing or unclear? Tell the @Rank support team and we will fix the page.
For product help beyond the documentation, visit at-rank.com.