Adding Cloudflare Turnstile to a WordPress contact form

Getting the keys

1. Log in to the Cloudflare dashboard and open Turnstile.
2. Add a widget, enter your site's domain, and choose the managed mode unless you have a reason not to.
3. Copy the site key (public, used in the page) and the secret key (private, used by your server).

What happens when a visitor sends the form

The Turnstile script, loaded from challenges.cloudflare.com, runs in the visitor's browser and produces a token. Your server sends that token and your secret to Cloudflare, which answers pass or fail. Each token can be used once, so a copied token doesn't work twice.

In Mailbag Contact Form

Under Mailbag → Settings → Spam, choose Cloudflare Turnstile and paste the two keys. The secret is shown masked afterwards, with only its last four characters visible. The Turnstile script loads only on pages with a form, never across your whole site.

• Pass — the entry is saved and the notification sent.
• Fail — the visitor is asked to confirm they're human and press Send again, and nothing is saved.
• Cloudflare doesn't answer — the entry is still accepted, marked as unverified, so an outage at Cloudflare never costs you a customer. The honeypot, time trap and address limit keep working.
• Cloudflare rejects your secret — that's a setup problem, not the visitor's fault. Entries are accepted without the check, and a notice on Mailbag's screens tells you to fix the key.

These are the same rules Mailbag uses for hCaptcha and reCAPTCHA v3; see when the CAPTCHA is down for why it fails open.

Coming from Contact Form 7

If your Contact Form 7 site already uses a CAPTCHA service, Mailbag's importer can take its keys over when you import the forms — only if you say yes to it.