Integrating Cloudflare Turnstile with Gravity Forms is a popular move for those looking to ditch the “click all the buses” puzzles of reCAPTCHA in favor of a more seamless, privacy-friendly experience.
This is EXACTLY the same product as distributed by the developer. Sales Page
1. Official Gravity Forms Turnstile Add-On
This is the most stable and integrated method. It treats Turnstile as a native “Advanced Field” within the form editor.
| Feature | Specification |
| Minimum Requirements | WordPress 5.0+, PHP 7.4+, Gravity Forms (any license) |
| Widget Modes | Supports Managed, Non-interactive, and Invisible |
| Visual Customization | Light, Dark, or “Auto” (system-based) themes |
| Field Sizing | Normal (300px), Compact (150px), or Flexible (100% width) |
| Placement | Added via the “Advanced Fields” toolbox in the Form Editor |
| Validation | Handles server-side siteverify automatically |
Pro Tip: For multi-page forms, always place the Turnstile field on the final page of the form to ensure the token doesn’t expire before the user hits “Submit.”
2. Third-Party Plugin Options
If you aren’t using the official add-on, plugins like Simple Cloudflare Turnstile or BWG CF Turnstile offer similar functionality but sometimes with broader “global” settings.
-
Global Enable: These often allow you to toggle Turnstile for all Gravity Forms at once without editing individual forms.
-
Submit Button Control: Many third-party plugins include an option to disable the submit button until the Turnstile check is successfully completed.
-
Custom Error Messages: Easier access to override the “Verification failed” text globally.
3. Setup Specifications (Cloudflare Dashboard)
Regardless of the plugin, you must configure the widget in your Cloudflare dashboard first.
-
Hostname: Add your domain (e.g.,
example.com). You can use one widget for multiple domains. -
Widget Mode: * Managed (Recommended): Cloudflare decides if the user needs to check a box based on risk.
-
Invisible: No visible widget; runs entirely in the background.
-
-
Keys: You will be issued a Site Key (Public) and a Secret Key (Private).
Note: Never share your Secret Key or include it in client-side code.
Troubleshooting Common Issues
-
“Domain Not Authorized”: This usually happens if you are testing on a staging site or a
wwwvs.non-wwwversion of the URL that wasn’t added to the Cloudflare dashboard. -
Token Expiry: Turnstile tokens expire after 300 seconds (5 minutes). If a user takes a long time to fill out a form, they may need to refresh the challenge.
- Categories: WordPress Plugins
- Tags: Gravity Forms
