Get Turnstile Keys from Cloudflare

Turnstile is free and unlimited on Cloudflare. You do not need to move your DNS or buy any paid plan. You just need two keys.

Time required

3 minutes. No credit card needed.

What You Will Get

KeyWhat It Looks LikeWhere It GoesSafe to Share?
Site KeyStarts with 0x4AAA...Paste into WooCommerce → Turnstile Settings → API Settings → Site KeyYes — goes on the frontend
Secret KeyStarts with 0x4AAA...Paste into WooCommerce → Turnstile Settings → API Settings → Secret KeyNo — never commit to git or share publicly

Step 1 — Sign Up for Cloudflare

  1. Open https://dash.cloudflare.com/sign-up in a new tab
  2. Enter your email and a password
  3. Click Sign Up
  4. Verify your email (check inbox for the confirmation)

You now have a Cloudflare account on the Free plan. That is all you need — Turnstile is free forever on every plan.

Step 2 — Open the Turnstile Dashboard

  1. In the Cloudflare dashboard left sidebar, click Turnstile
  2. You land on the Turnstile widgets overview
  3. Click Add widget

Step 3 — Configure the Widget

Fill in these fields:

FieldWhat to Enter
Widget nameAny friendly name, e.g., My WooCommerce Store
Hostname ManagementYour store domain — e.g., yourstore.com. You can list multiple domains, one per line. Include both yourstore.com and www.yourstore.com if you use both
Widget ModeManaged (recommended) — Cloudflare decides when to show an interactive challenge. Most visitors see nothing

Three Widget Modes Explained

ModeBehaviorGood For
ManagedCloudflare picks — invisible for most, interactive for suspiciousDefault. Use this unless you have a reason
Non-interactiveAlways invisible. Runs silently in the backgroundHighest UX, slightly lower protection
InvisibleAlways runs a challenge, but without user interactionExtra protection without a checkbox

You can change mode any time from the widget settings page.

Click Create.

Step 4 — Copy Your Keys

After creating, Cloudflare shows the two keys on one page.

  1. Site Key — Click Copy next to it. Keep it in a safe place (a password manager or a notes app is fine)
  2. Secret Key — Click Copy next to this one too. Treat it like a password — never paste it into a public place

Both keys are long strings that look like:

0x4AAAAAAABB-CC-DDDDDDDDDDD

Step 5 — Paste Them Into the Plugin

  1. Go to your WordPress admin
  2. WooCommerce → Turnstile Settings → API Settings tab
  3. Paste the Site Key into Site Key
  4. Paste the Secret Key into Secret Key
  5. Click Save Changes
  6. Click Test Connection — you should see "API keys are valid"

Full tab reference: API Settings.

If You Need to Find Your Keys Again

  1. In Cloudflare dashboard, click Turnstile
  2. Click your widget name in the list
  3. Scroll to Site Key and Secret Key
  4. Site Key is always visible. Secret Key is masked — click Rotate secret key to generate a fresh one (this invalidates the old one)

Using Multiple Stores

You can run the same widget across multiple stores by adding all hostnames to the one widget. Or you can create one widget per store — your call.

One widget for staging + production

Add both staging.yourstore.com and yourstore.com to the same widget. You then use the same keys in both environments and Cloudflare accepts challenges from both.

Widget Analytics in Cloudflare

Cloudflare also shows its own stats for each widget:

  1. Dashboard → Turnstile → your widget
  2. Click Analytics
  3. See interactive vs non-interactive challenges, pass rates, and top sources

The plugin's own Analytics page shows the same events but from your server's point of view (which is more accurate for measuring form-level impact).

Widget Rotation (Advanced)

If you suspect your Secret Key leaked:

  1. Cloudflare dashboard → Turnstile → your widget
  2. Click Rotate secret key
  3. Copy the new Secret Key
  4. Paste into plugin → API Settings → Secret Key → Save

There is no downtime — existing tokens finish processing with the old key and new ones use the new key.

The Site Key does not rotate (it is public, not a secret).

Troubleshooting

ProblemFix
"Invalid sitekey" in browser consoleYour domain is not listed in Cloudflare Turnstile widget's Hostname Management
"invalid-input-secret" in plugin logsSecret Key was typed/copied wrong. Copy again, paste, save
"missing-input-secret" in plugin logsSecret Key field is empty. Paste and save
Widget visible on local dev but not productionAdd production hostname to the Cloudflare widget config
"timeout-or-duplicate"Page was cached and re-used an old token. Clear caching plugin