Quick Start — Turnstile Live in 5 Minutes

Who this page is for

You installed (or are about to install) the plugin. You want to see Turnstile live on your checkout. This page takes you from zero to "bots blocked" in 5 minutes.

The Big Picture

StepTaskTime
1Create a free Cloudflare account1 min
2Add a Turnstile widget and copy Site Key + Secret Key1 min
3Install and activate the plugin1 min
4Run the onboarding wizard (paste keys, pick forms)1 min
5Test a form to see the widget30 sec
6Open Analytics to watch the first events30 sec
TotalAbout 5 min

Before You Start

  • [ ] WordPress 5.8 or higher
  • [ ] WooCommerce 8.0 or higher, active
  • [ ] PHP 7.4 or higher
  • [ ] You have admin or manage_woocommerce capability
  • [ ] An email for the Cloudflare account

Step-by-Step

1. Create a Cloudflare Account

Go to https://dash.cloudflare.com/sign-up and sign up. Free plan is fine — Turnstile is always free, no card needed.

2. Add a Turnstile Widget

In the Cloudflare dashboard:

  1. Click Turnstile in the left sidebar
  2. Click Add widget
  3. Name it — e.g., My WooCommerce Store
  4. Under Hostname Management, enter your store domain — e.g., yourstore.com
  5. Pick widget mode — Managed is a good default (covers bots only, non-intrusive)
  6. Click Create

You land on a page with two keys: Site Key and Secret Key. Keep this tab open.

Full walkthrough with screenshots: Get Turnstile Keys.

3. Install the Plugin

  1. In WordPress, go to Plugins → Add New → Upload Plugin
  2. Pick turnstile-captcha-for-woocommerce.zip
  3. Click Install Now, then Activate Plugin

Full install guide: Installation.

4. Run the Onboarding Wizard

After activation you land on a 3-step wizard at WooCommerce → Turnstile → Onboarding.

Step 1 — API Keys: Paste your Site Key and Secret Key from Cloudflare. Click Test Connection to verify. Click Next.

Step 2 — Pick Forms: Tick the forms you want to protect. At minimum:

  • [x] WooCommerce Checkout
  • [x] WooCommerce Login
  • [x] WooCommerce Registration
  • [x] WooCommerce Lost Password

Click Next.

Step 3 — Finish: Review summary. Click Finish.

You are done. The widget is now live on every form you ticked.

5. Test It

  1. Open your store's login page in a private/incognito window
  2. Below the form fields you will see the Turnstile widget
  3. Click in the checkbox (if the widget is in Managed mode, it clears automatically)
  4. Fill the form and submit

If you see a "Please complete the security check" error without clicking the widget, that means server validation is working — bots that do not load the widget get rejected.

6. Open Analytics

Go to WooCommerce → Webkul Addons → Analytics. After a few form submissions you will see:

  • Total checks today
  • Pass / fail counts
  • Trend chart (updates every 5 min)
  • Top forms
  • Top blocked IPs (once any fail)

Give it a few hours on a live site — bot hits start stacking up fast.

What to Do Next

I Want to...Go to
Change widget theme (dark mode)Design Studio
Skip CAPTCHA for my own IPConditional Rules
Different CAPTCHA on login vs checkoutPer-Form Config
Get weekly email reportEmail Digest
Slack alert when bots attackWebhooks
Use on a non-WooCommerce formShortcode
Protect Contact Form 7Third-Party Form Plugins
Change rate-limit thresholdRate Limiting

When Something Does Not Work

ProblemFix
Widget does not showCheck Site Key is correct. Clear caching plugin (WP Rocket, LiteSpeed, W3TC, Autoptimize)
"CAPTCHA failed" on every submitCheck Secret Key is correct. See Troubleshooting
Widget shows but form still submitswkcft_warn_only is on. Turn it off on the General tab
"Invalid sitekey" errorHostname in Cloudflare does not match your domain
Widget loads slowlySwitch Load Mode from instant to lazy on General tab