Version 1.44.5 – 31st October 2026
- 🔨 TweakThe “Sunshine Login” option is now always enabled while the “WordPress Login” option is enabled (unless it is set to only enable on wp-login.php), so the Sunshine login forms are protected too.
- 🔒 SecurityFixed an issue where the Turnstile check on the WordPress login and registration forms could be skipped on sites using Sunshine Photo Cart. (Reported by Mateusz Będziński via Patchstack)
- 🔒 SecurityFixed an issue where one solved Turnstile challenge on the Ultimate Member login form could be reused for multiple login attempts. (Reported by Mateusz Będziński via Patchstack)
Version 1.44.4 – 30th October 2026
- 🔒 SecurityImproved sanitisation in the Gravity Forms integration shortcode. (Reported by Osvaldo Noe Gonzalez Del Rio via Wordfence.)
Version 1.44.3 – 29th October 2026
- ⚙️ FixFixed WooCommerce and Easy Digital Downloads registration forms failing with “Please verify that you are human” on some sites, and new Easy Digital Downloads accounts not being logged in after registering when WordPress login protection is enabled.
Version 1.44.2 – 29th October 2026
- 🔒 SecurityFixed an issue where the Turnstile check on the WordPress login and registration forms could be skipped on sites using Easy Digital Downloads or WooCommerce, and where the “Clean Login” registration form was not verified. (Reported by Tai Nguyen via Patchstack)
Version 1.44.1 – 28th October 2026
- 🔒 SecurityTurnstile tokens longer than Cloudflare’s 2,048-character maximum, or not sent as text, are now rejected before they are sent to Cloudflare for verification.
- 🔒 SecurityFixed an issue where Contact Form 7 forms protected with the Turnstile form-tag could be submitted without solving Turnstile. (Reported by “mroccon” via Patchstack)
Version 1.44.0 – 29th September 2026
- ✨ NewAdded support for FluentAuth 3.0’s two-factor authentication, including passkeys and authenticator apps. The second step of the login previously failed with “There has an error when log you in” when Turnstile was enabled on the WordPress login form.
- 🔨 TweakImproved compatibility with “Delay JavaScript” in performance plugins such as LiteSpeed Cache and Perfmatters, which could stop the Turnstile widget from displaying on the WooCommerce block checkout, and could stop the Turnstile widget from displaying on Elementor forms and popups or from resetting after a failed submission.
- 🔨 TweakImproved support for stores with a classic (shortcode) checkout page while the main checkout page uses the Checkout block, where the Turnstile widget could fail to display.
- 🔨 TweakPayment methods set to skip Turnstile are now also skipped on the WooCommerce “Pay for order” page, as on the checkout.
- 🔨 TweakA Turnstile token used on the WooCommerce block checkout can no longer be re-used in another session while that order is still being processed.
- 🔨 TweakThe Turnstile widget is now displayed on every copy of a form that appears more than once on the same page, not just the first.
- 🔨 TweakImproved compatibility with LiteSpeed Cache ESI, so the Turnstile widget is displayed on the comment form for logged-in users and returning commenters.
- 🔨 TweakImproved compatibility with Easy Digital Downloads Pro, whose settings could previously not be enabled.
- 🔨 TweakImproved compatibility with Elementor forms added using a template (such as with the template shortcode, the Template widget or a Theme Builder template) when the Elementor “Autodetect pages with forms” option is selected, as Turnstile was not loaded on the page.
- 🔨 TweakTightened the FluentAuth integration, so its two-factor compatibility for FluentAuth 2.x can no longer be used to skip the Turnstile check on other login forms, such as the WooCommerce login form.
- 🔨 TweakThe “Analytics” tab now shows which form a failed submission came from, where most failed submissions were previously listed as “Unknown form”. Elementor forms are now also listed by name, and Kadence forms are grouped into one entry instead of a new entry for every submission.
- 🔨 TweakThe “Turnstile Debug Log” now shows which form each entry came from.
- ⚙️ FixFixed an issue where Android users could not type in the WooCommerce login, register or checkout forms on Divi sites, as the keyboard closed and the Turnstile widget disappeared when a field was tapped.
- ⚙️ FixFixed an issue where WooCommerce block checkout orders could be rejected with a Turnstile error after a failed attempt, such as when paying with PayPal.
- ⚙️ FixFixed an issue where WooCommerce block checkout orders were rejected with a Turnstile error for whitelisted visitors, and while the failsafe was active during a Cloudflare outage (including after completing the reCAPTCHA failsafe).
- ⚙️ FixFixed an issue where logged-in customers could not pay for an order on the WooCommerce “Pay for order” page when “Guest only” was enabled.
Version 1.43.2 – 17th September 2026
- ⚙️ FixFixed an issue where the Turnstile widget could be missing from the WooCommerce checkout with certain themes or custom checkouts.
Version 1.43.1 – 11th September 2026
- ⚙️ FixFixed an issue where the “Before Payment”, “After Payment” and “Before Pay Button” widget positions could place the Turnstile widget outside the WooCommerce block checkout, away from the form, on a checkout page whose saved content is missing the payment or place order blocks.
- ⚙️ FixFixed an issue where the Turnstile widget was added twice to a form inside an Elementor popup, which could leave the form unable to be submitted. Elementor rebuilds a popup from a copy of its markup each time it opens, so the widget is now added when the popup opens rather than before it.
Version 1.43.0 – 9th September 2026
- ✨ NewAdded support for Elementor’s new Atomic forms, using the same “Enable Elementor Forms” setting as classic Elementor Pro forms.
- ✨ NewAdded support for Wordfence 9.0.0’s Login Security passkeys, which were rejected with a missing challenge error when the WordPress login check was enabled.
- 🔨 TweakAdded the cfturnstile_is_partial_checkout_render filter, so other page builders can flag any extra renders of the checkout template.
- ⚙️ FixFixed an issue where WooCommerce orders on the Divi Builder’s Checkout, or paid with a card gateway such as Stripe or WooPayments could be rejected with a Turnstile error.
- ⚙️ FixFixed a WooCommerce checkout token remaining usable for up to two minutes when the request that used it ended unexpectedly, such as after a fatal error.
Version 1.42.3 – 7th September 2026
- ⚙️ FixFixed the Turnstile widget not being reset after a failed submission on forms that submit without a page reload, such as AJAX login forms and single page (SPA) themes.
- ⚙️ FixFixed the Turnstile widget not appearing on the WooCommerce checkout when the section chosen in the “Widget Position” setting was not part of the checkout. It now falls back to a position above the “Place Order” button.
- ⚙️ FixFixed the “After Payment” widget position removing the entire payment section, including the payment methods, from the WooCommerce block checkout.
- ⚙️ FixFixed the Turnstile widget not appearing on the WooCommerce app authorization screen (/wc-auth/). You are now sent to the WordPress login form to complete the challenge, then returned to the authorization screen.
- ⚙️ FixFixed the “cloudflare turnstile” button in the Contact Form 7 form editor inserting nothing when clicked.
- ⚙️ FixFixed the Turnstile error message not being shown on the Gravity Forms User Registration login form ([gravityform action=”login”]).
- 🔒 SecurityFixed vulnerabilities where the Turnstile check on the WooCommerce checkout and lost password form, and WordPress login and lost password forms could be potentially be bypassed.
- 🔒 SecurityFixed a vulnerability in the Contact Form 7 integration, where an unauthenticated visitor could run any shortcode registered on the site by submitting it as a field value. Reported by Jakub Herman via WPScan.
- 🔒 SecurityFixed a vulnerability where the Turnstile check on Gravity Forms could be bypassed by adding a page number to the request. The check is now only skipped on forms that really do have more than one page.
- 🔨 TweakThe Turnstile form-tag for Contact Form 7 is now [cf7_simple_turnstile]. Your existing [cf7-simple-turnstile] tags keep working and do not need to be changed.
Version 1.42.1 – 27th July 2026
- ⚙️ FixFixed an issue where the submit button could stay disabled after the Turnstile challenge was completed, when the “Disable Submit Button” option is enabled. On the login form this could lock you out of your site.
- ⚙️ FixFixed the submit button staying disabled after the widget was re-rendered, such as after an AJAX comment or on the Blocksy account modal.
- ⚙️ FixFixed the submit button staying disabled on Jetpack forms when the “Disable Submit Button” option is enabled.
- ⚙️ FixFixed WooCommerce checkout failing with a “please verify that you are human” error when using the GlobalPayments GPAPI gateway with 3D Secure enabled.
- ⚙️ FixFixed the Turnstile API script loading render-blocking, even with the “Defer Scripts” option enabled.
- 🔨 TweakChanging the API keys programmatically, such as with WP-CLI or a provisioning script, no longer switches Turnstile off on every form until the manual test is run.
- 🔨 TweakTightened the Forminator integration further, so a solved Turnstile challenge can no longer be re-used for up to 30 seconds.
Version 1.42.0 – 26th July 2026
- ✨ NewAdded support for CIDR ranges (IPv4 and IPv6) in the IP whitelist, e.g. 203.0.113.0/24 or 2001:db8::/32, so visitors can be whitelisted by subnet.
- ⚙️ FixFixed IP whitelist matching for IPv6 addresses written in a different format, and for IPv4-mapped IPv6 addresses such as ::ffff:203.0.113.5. A /0 range is now ignored.
- ⚙️ FixFixed an issue since 1.41 where the login widget could be reset while a two-factor prompt was open (e.g. Wordfence 2FA), causing the login to fail.
- ⚙️ FixTurnstile now always loads in explicit render mode, fixing the widget not appearing on slow connections, with a “delay JavaScript” optimization, or in AJAX-loaded forms such as comment forms and popups.
- ⚙️ FixFixed several WooCommerce issues, including the checkout script erroring when a “delay JavaScript” optimization runs it before jQuery, widgets not rendering on the block checkout, and the “Click here to login” toggle.
- ⚙️ FixFixed the Turnstile widget not appearing in the Blocksy theme’s header account modal, and the integration now also loads when a Blocksy child theme is active.
- ⚙️ FixFixed a conflict with FluentAuth’s email two-factor and magic login, where the second step could fail with a Turnstile error.
- ⚙️ FixFixed a conflict with Simple Membership where a member logging in was not also logged into their WordPress user account, breaking is_user_logged_in() checks, .htaccess protection and user synchronization.
- 🔒 SecurityFixed a vulnerability in the Forminator integration where a solved Turnstile challenge could potentially be reused to bypass verification, as the validation was cached against a form value instead of the single-use token. (Reported by Meher Sudhakar Abbireddi via WPScan.)
Version 1.41.1 – 22nd June 2026
- 🔨 TweakAdded a view button to show the secret key in the settings page, which is hidden by default.
- 🔨 TweakMade a few small changes to the settings page.
- 🔨 TweakOn the Ultimate Member login form, added a check to prevent further login validation if Turnstile failed.
- ⚙️ FixFixed an issue with the Ultimate Member login form since the last update.
Version 1.41.0 – 18th June 2026
- ✨ NewAdded a new “Analytics” option which when enabled will start tracking some basic analytics data for Turnstile form submissions. This includes the number of successful and failed submissions, and the reasons for any failures.
- Improvement: Added some new tabs to the settings page, with a “Settings” tab for all the main settings, a new “Analytics” tab for the new analytics feature and the debug logging, and an “Import” tab for the import/export feature.
- 🔨 TweakUpdated the verified transient check to work better with certain 2FA plugins.
- 🔨 TweakUpdated the Contact Form 7 integration to now show the correct error message when the Turnstile check fails.
- 🔨 TweakThe “Widget Label Text” is now hidden when “Interaction Only” is selected, and only displayed when the widget actually requires an interaction.
- 🔨 TweakAdded spacing below the widget when it shows in “Interaction Only” mode, which is hidden when the widget is not displayed.
- 🔨 TweakThe Turnstile widget now re-renders shortly after clicking the login button on the wp-login.php page, to ensure a fresh token is ready in case of a failed login.
- ⚙️ FixFixed an issue with Turnstile not rendering on the block checkout “pay for order” page in some cases.
- ⚙️ FixFixed the “Show Widget Label Text” option not displaying on Elementor forms.
- ⚙️ FixFixed the “Logged In Users” whitelist option not bypassing Turnstile on Contact Form 7 submissions.
- ⚙️ FixFixed the “Appearance Mode” setting not being applied to Elementor forms and the WooCommerce block checkout, causing the widget to always display even when “Interaction Only” was selected.
- OtherRenamed the plugin from “Simple CAPTCHA Alternative with Cloudflare Turnstile” to “Simple CAPTCHA with Cloudflare Turnstile”.
Version 1.40.0 – 29th May 2026
- ✨ NewAdded an option to enable Turnstile on the WooCommerce Account Details form.
- 🔨 TweakAdded a warning message to the “Logged In Users” whitelist option.
- 🔨 TweakAdded an additional check to prevent the Turnstile widget from rendering twice on WooCommerce checkout in rare cases.
- 🔨 TweakPrevent any kind of form submission (shortkeys etc) for the default login form when Turnstile is not completed, if the “Disable Submit Button” option is enabled.
- 🔨 TweakPrevent any kind of form submission (shortkeys etc) for Elementor forms when Turnstile is not completed #84.
- 🔨 TweakForce-render inline script now loads via wp_add_inline_script in the footer, fixing rendering issues in some cases when “Defer Scripts” is disabled.
- ⚙️ FixFixed widget size setting (Flexible/Compact) not being applied to Elementor forms.
- ⚙️ FixFixed a mobile performance issue in some cases. Replaced the fixed 200ms setTimeout fallback which could cause scroll-locking and double-rendering.
- ⚙️ FixPerformance plugin compatibility hooks now register correctly regardless of which performance plugin is active.
- ⚙️ FixImproved WooCommerce checkout login form Turnstile rendering, which was not working for some themes.
- ⚙️ FixFixed a JS error on WooCommerce classic checkout when the Blocks checkout store isn’t registered.
- ⚙️ FixFixed duplicate Turnstile widget on Paid Memberships Pro login page.
- ⚙️ FixFixed a JS error with wpDiscuz integration when Perfmatters plugin was active.
Version 1.39.1 – 1st May 2026
- ⚙️ FixFixed a potential issue with the Turnstile check on login forms failing in certain cases when it runs multiple checks in the same request.
Version 1.39.0 – 20th April 2026
- ✨ NewAdded integration for the “SureForms” plugin.
- ✨ NewAdded integration for the “Sunshine Photo Cart” plugin (#70).
- 🔨 TweakAdjusted the “Widget Label Text” alignment in some cases so it always shows above the widget.
Version 1.38.4 – 17th April 2026
- ⚙️ FixFixed Turnstile verification failures on WooCommerce checkout caused by payment gateway plugins (e.g. PayPal Commerce, Amazon Pay, Mollie) consuming the single-use token during pre-checkout AJAX validation requests.
- ⚙️ FixFixed a fatal error occurring on pages where WooCommerce has been selectively disabled (e.g. via Plugin Organizer).
Version 1.38.3 – 17th April 2026
- 🔨 TweakMade some tweaks to the WooCommerce checkout duplicate submission check, with a longer expiration for the transient, and improved the auto re-render for Turnstile on payment error in certain cases.
- 🔨 TweakSmall tweak to the Contact Form 7 integration code with a basic static duplication check.
Version 1.38.2 – 16th April 2026
- 🔨 TweakAdded the transient based duplicate submission check to WooCommerce checkout, to prevent potential duplicate submission check failing issues since the last update.
- 🔨 TweakAdded improved support for Gravity Forms multi-page forms, to prevent the duplicate submission check from failing on page 2 and beyond.
