WordPress Forms

WordPress tab — toggle Turnstile on wp-login, register, lost password, comments

Protect the WordPress core forms outside of WooCommerce — wp-login.php, registration, password reset, and comments.

Settings tab: wp-admin/admin.php?page=wkcft-settings&tab=wkcft_wordpress

Forms Covered

FormEnable OptionHook
Loginwkcft_wp_loginlogin_form
Registrationwkcft_wp_registerregister_form
Lost Passwordwkcft_wp_lost_passwordlostpassword_form
Commentswkcft_wp_commentpreprocess_comment

Enable Steps

  1. WooCommerce → Turnstile Settings → WordPress tab
  2. Tick the forms you want
  3. Save Changes
  4. Flush caching plugin
  5. Test each form

Field Reference

FieldOption KeyDefault
WP Loginwkcft_wp_loginno
WP Registrationwkcft_wp_registerno
WP Lost Passwordwkcft_wp_lost_passwordno
WP Commentswkcft_wp_commentno

Test Plan

WP Login

  1. Log out (or open incognito window)
  2. Visit /wp-login.php
  3. Widget appears below the password field
  4. Enter credentials and submit
  5. Login completes

Do not lock yourself out

Always have a second admin account or a recovery URL ready before enabling WP Login protection. If the widget ever breaks (e.g., Cloudflare outage), you can still get in.

WP Registration

Only visible if "Anyone can register" is on under Settings → General.

  1. Visit /wp-login.php?action=register
  2. Widget below email field
  3. Submit — account created (or password email sent)

WP Lost Password

  1. Click "Lost your password?" on the login page
  2. Widget below the email/username field
  3. Submit — reset email sent

WP Comments

  1. Open any post with comments enabled
  2. Scroll to comment form
  3. Widget appears above the submit button
  4. Post comment — submitted (pending approval if moderation is on)

Why Enable WP Login

Your /wp-login.php is one of the most-attacked endpoints on any WordPress site. Bots try thousands of username/password combinations per day.

Turnstile on wp-login:

  • Stops brute-force login attempts cold (no token = no validation)
  • Slashes your server load during attacks
  • Protects all admin accounts, not just WooCommerce ones

Interaction with WooCommerce Login

WordPress login (/wp-login.php) and WooCommerce login (/my-account/) are different forms. Enabling one does NOT protect the other.

LocationSetting
/wp-login.phpWordPress tab → WP Login
/my-account/WooCommerce tab → Login

Most stores enable both.

Comments Behavior

The comments hook is preprocess_comment which fires after the form submits but before insertion. When CAPTCHA fails:

  • Comment is rejected with your configured error message
  • Post reloads with the form data preserved (so commenters do not lose their text)

Widget auto-injects above the submit button via comment_form_submit_button filter.

Hiding on Author's Own Comments

If you post comments yourself as the admin, pair with:

That way, you never see the widget on your own site.

Recovery Note

If you protect wp-login.php and then hit a browser issue where Cloudflare cannot load:

  1. Use a different browser or incognito
  2. Or hit the Recovery URL first to clear any lockout
  3. Or temporarily turn off WP Login protection via the database:
UPDATE wp_options SET option_value='no' WHERE option_name='wkcft_wp_login';

Or WP-CLI:

wp option update wkcft_wp_login no

Hook Priority Order

On the login form, hooks fire in this order:

  1. WP renders username + password fields
  2. Plugin injects widget HTML (priority 10 on login_form)
  3. WP renders submit button
  4. Page loads

If your custom theme adds elements via the same hook with a lower priority, they will render after the widget. Adjust hook priority in your theme if needed.

Troubleshooting

ProblemFix
Widget missing on wp-loginCheck if a security plugin (Wordfence, iThemes Security) is overriding wp-login
Widget missing on commentsTheme uses wp_list_comments only — confirm it also calls comment_form()
"Failed validation" on every loginClear caching, confirm Secret Key on API tab
Locked out of wp-adminUse Recovery URL or disable via database — see above