Integrating Cloudflare Turnstile with Gravity Forms is a popular move for those looking to ditch the “click all the buses” puzzles of reCAPTCHA in favor of a more seamless, privacy-friendly experience.
This is EXACTLY the same product as distributed by the developer. Sales Page
This is the most stable and integrated method. It treats Turnstile as a native “Advanced Field” within the form editor.
| Feature | Specification |
| Minimum Requirements | WordPress 5.0+, PHP 7.4+, Gravity Forms (any license) |
| Widget Modes | Supports Managed, Non-interactive, and Invisible |
| Visual Customization | Light, Dark, or “Auto” (system-based) themes |
| Field Sizing | Normal (300px), Compact (150px), or Flexible (100% width) |
| Placement | Added via the “Advanced Fields” toolbox in the Form Editor |
| Validation | Handles server-side siteverify automatically |
Pro Tip: For multi-page forms, always place the Turnstile field on the final page of the form to ensure the token doesn’t expire before the user hits “Submit.”
If you aren’t using the official add-on, plugins like Simple Cloudflare Turnstile or BWG CF Turnstile offer similar functionality but sometimes with broader “global” settings.
Global Enable: These often allow you to toggle Turnstile for all Gravity Forms at once without editing individual forms.
Submit Button Control: Many third-party plugins include an option to disable the submit button until the Turnstile check is successfully completed.
Custom Error Messages: Easier access to override the “Verification failed” text globally.
Regardless of the plugin, you must configure the widget in your Cloudflare dashboard first.
Hostname: Add your domain (e.g., example.com). You can use one widget for multiple domains.
Widget Mode: * Managed (Recommended): Cloudflare decides if the user needs to check a box based on risk.
Invisible: No visible widget; runs entirely in the background.
Keys: You will be issued a Site Key (Public) and a Secret Key (Private).
Note: Never share your Secret Key or include it in client-side code.
“Domain Not Authorized”: This usually happens if you are testing on a staging site or a www vs. non-www version of the URL that wasn’t added to the Cloudflare dashboard.
Token Expiry: Turnstile tokens expire after 300 seconds (5 minutes). If a user takes a long time to fill out a form, they may need to refresh the challenge.
