CWeb Form Protection with Turnstile for Elementor Forms

1. 01Upload the plugin to /wp-content/plugins/ or install it from the Plugins screen.
2. 02Activate it.
3. 03Go to Settings → CWeb Form Protection and enter your Cloudflare site key and secret key .
4. 04(Elementor) Edit a form, add the Cloudflare Turnstile field where you want the widget, then save.
5. 05(WordPress forms) Enable the toggles for login, registration, lost password and/or comments.
6. 06(WooCommerce) Enable the toggles under WooCommerce forms for the checkout, login, registration and/or account-details forms.

Does it protect every Elementor form automatically?

By default, no — and that is the point. You add the Turnstile field only to the forms you want to protect, and forms without the field are left untouched. If you prefer, turn on Settings → CWeb Form Protection → Elementor Pro forms → “All Elementor Pro forms” to protect every Elementor Pro form automatically, without adding the field to each one.

Does it work without Elementor Pro?

The Elementor field needs Elementor Pro (Forms is a Pro module). The WordPress login, registration, lost password and comment integrations work on any WordPress site.

Which WooCommerce forms are protected?

Under Settings → CWeb Form Protection → WooCommerce forms you can protect the classic checkout, the login form (My account and the checkout “returning customer” login), the registration form and the account-details form — each with its own toggle. The lost-password form uses the existing “Lost password form” toggle, and product reviews use the “Comment form” toggle.

This version protects the classic (shortcode) checkout . The newer WooCommerce Checkout Block (the Gutenberg block) is not covered yet, and the Pay for order and Add payment method forms are out of scope. Account creation during checkout is protected by the Checkout toggle (not the Registration toggle).

Is the secret key safe?

Yes. The secret key is stored server-side, is never printed in the page, and is never sent to the browser. The settings screen never displays it back.

I already use “Simple Cloudflare Turnstile”. Do I have to recreate my keys?

No. If that plugin’s settings are present, the Settings → CWeb Form Protection page shows an “Import keys & settings” button that copies your site key, secret key, appearance options and form toggles over. Your existing Cloudflare keys keep working — nothing is regenerated, and the other plugin is left untouched.

What happens if Cloudflare can’t be reached?

Missing or invalid tokens are always rejected. If Cloudflare’s verification endpoint is unreachable (network error or timeout), the “If Cloudflare is unreachable” setting decides whether to block (default, more secure) or allow (more available) the submission.