220
$5
Add to project

Product support

Get help in the plugin support forum.

Categories

Protect your forms from spam and bots without irritating your users with complex CAPTCHA puzzles. The Cloudflare Turnstile plugin seamlessly integrates Cloudflare's privacy-friendly, smart anti-bot challenge into October CMS.

Why Cloudflare Turnstile?

Cloudflare Turnstile is a free, privacy-focused replacement for reCAPTCHA. It automatically verifies real human visitors with non-interactive challenges, eliminating the need for users to solve annoying image selection tests or solve puzzle tiles.

Key Features

  • Zero-friction Protection: Provides smart, privacy-first bot protection without harassing legitimate visitors.
  • Automatic Renatio FormBuilder Integration: Seamlessly embeds into FormBuilder forms and verifies input prior to email dispatch.
  • Flexible Custom Component: Easily drop the [turnstile] component into any layout or page form.
  • PHP / AJAX Validation Rule: Offers a native turnstile validation rule for custom AJAX handlers and controllers ('cf-turnstile-response' => 'required|turnstile').
  • AJAX Auto-Reset: Automatically resets expired or failed tokens on October CMS AJAX framework validation errors (ajaxInvalid, ajaxError).
  • Backend Admin Bypass: Skip verification for logged-in backend administrators to speed up form testing.
  • IP Whitelisting: Bypass verification for specified IP addresses or CIDR ranges.
  • Custom Error Messages: Customize the user-facing validation error message directly in the backend settings.
  • Detailed Cloudflare Logging: Automatically logs Cloudflare API error codes to system logs for quick developer troubleshooting.
General

Installation via Command Line

php artisan plugin:install Stheme.Turnstile

Cloudflare Turnstile Documentation

1. Cloudflare Setup

  1. Log into your Cloudflare Dashboard and navigate to Turnstile.
  2. Click Add Site, enter your domain name, and choose your preferred widget mode (Managed, Non-interactive, or Invisible).
  3. Copy your Site Key (Public Key) and Secret Key (Private Key).

2. Backend Configuration

In your October CMS Backend, navigate to: Settings -> CMS -> Cloudflare Turnstile

General Settings

  • Enable Cloudflare Turnstile: Enable or disable protection globally.
  • Site Key: Enter your public Site Key from Cloudflare.
  • Secret Key: Enter your private Secret Key from Cloudflare.
  • Widget Theme: Choose between Auto (matches OS/browser dark mode), Light, or Dark.
  • Widget Size: Choose between Normal, Compact, or Flexible.

Behavior & Security Settings

  • Custom Validation Error Message: Override default error text shown when Turnstile validation fails.
  • Bypass for Backend Administrators: Enable to skip verification for logged-in backend admins.
  • Whitelisted IP Addresses: Enter IP addresses (one per line) that bypass verification.

3. Usage Options

Option A: Renatio FormBuilder (Automatic)

No code required! When the plugin is enabled and keys are configured, Turnstile automatically injects into FormBuilder forms before submission and verifies the token prior to sending emails.

Option B: CMS Component ([turnstile])

  1. Attach the [turnstile] component to your page or layout.
  2. Render the component inside your HTML <form> tag: 
    {% component 'turnstile' %}
1.0.1

Initial release of Cloudflare Turnstile plugin for October CMS

Jul 29, 2026

Version 1.0.1

  • Initial public release of Cloudflare Turnstile for October CMS.
  • Fully compatible with October CMS v3.x and v4.x.
  • No breaking changes or upgrading steps required.