Turnstile Pass

Turnstile Pass integrates Cloudflare Turnstile with Craft CMS for frictionless spam protection. Turnstile is a free, privacy-preserving alternative to CAPTCHA that verifies visitors without puzzles or checkboxes.

Key features

• Automatic Contact Form integration — When the Contact Form plugin is installed, Turnstile Pass verifies every submission automatically. No server-side code required.
• Simple Twig API — Two calls: craft.turnstilePass.script() once per page, craft.turnstilePass.widget() inside each form.
• All widget modes — Works with Managed, Non-interactive, and Invisible modes. Invisible mode is recommended for standard contact forms.
• Server-side verification service — A reusable verify() method for custom form handlers beyond Contact Form.
• Environment variable support — Configure site and secret keys via environment variables or a PHP config file.

Quick start

composer require cdgrph/craft-turnstile-pass
php craft plugin/install turnstile-pass

Enter your Turnstile Site Key and Secret Key in Settings → Plugins → Turnstile Pass, then add the script and widget to your form template.

Requirements

• Craft CMS 5.0+
• PHP 8.2+
• A free Cloudflare account with a Turnstile widget