Version 1.43.2 – 17th September 2026
- ⚙️ FixFixed an issue since 1.42.3 where the Turnstile widget could be missing from the WooCommerce checkout while the order was still rejected for a missing challenge, leaving the checkout impossible to complete. A theme, page builder or template that renders the checkout more than once could use the widget up on a copy that is never shown. Each checkout form now gets its own widget, and the block checkout checks its own markup for one before deciding it is not needed.
Version 1.43.1 – 11th September 2026
- ⚙️ FixFixed an issue since 1.42.3 where the “Before Payment”, “After Payment” and “Before Pay Button” widget positions could place the Turnstile widget outside the WooCommerce block checkout, away from the form, on a checkout page whose saved content is missing the payment or place order blocks. The widget is now always placed inside the checkout, above the payment section.
- ⚙️ FixFixed an issue since 1.38.0 where the Turnstile widget was added twice to a form inside an Elementor popup, which could leave the form unable to be submitted. Elementor rebuilds a popup from a copy of its markup each time it opens, so the widget is now added when the popup opens rather than before it.
Version 1.43.0 – 9th September 2026
- ✨ NewAdded support for Elementor’s new Atomic forms, using the same “Enable Elementor Forms” setting as classic Elementor Pro forms.
- ✨ NewAdded support for Wordfence 9.0.0’s Login Security passkeys, which were rejected with a missing challenge error when the WordPress login check was enabled.
- 🔨 TweakAdded the cfturnstile_is_partial_checkout_render filter, so other page builders can flag any extra renders of the checkout template.
- ⚙️ FixFixed an issue since 1.42.3 where WooCommerce orders paid with a card gateway such as Stripe or WooPayments could be rejected with a Turnstile error.
- ⚙️ FixFixed an issue since 1.42.3 where every order on a WooCommerce checkout built with the Divi Builder’s Checkout modules was rejected with a Turnstile error.
- ⚙️ FixFixed a WooCommerce checkout token remaining usable for up to two minutes when the request that used it ended unexpectedly, such as after a fatal error.
Version 1.42.3 – 7th September 2026
- ⚙️ FixFixed the Turnstile widget not being reset after a failed submission on forms that submit without a page reload, such as AJAX login forms and single page (SPA) themes.
- ⚙️ FixFixed the Turnstile widget not appearing on the WooCommerce checkout when the section chosen in the “Widget Position” setting was not part of the checkout. It now falls back to a position above the “Place Order” button.
- ⚙️ FixFixed the “After Payment” widget position removing the entire payment section, including the payment methods, from the WooCommerce block checkout.
- ⚙️ FixFixed the Turnstile widget not appearing on the WooCommerce app authorization screen (/wc-auth/). You are now sent to the WordPress login form to complete the challenge, then returned to the authorization screen.
- ⚙️ FixFixed the “cloudflare turnstile” button in the Contact Form 7 form editor inserting nothing when clicked.
- ⚙️ FixFixed the Turnstile error message not being shown on the Gravity Forms User Registration login form ([gravityform action=”login”]).
- 🔒 SecurityFixed vulnerabilities where the Turnstile check on the WooCommerce checkout and lost password form, and WordPress login and lost password forms could be potentially be bypassed.
- 🔒 SecurityFixed a vulnerability in the Contact Form 7 integration, where an unauthenticated visitor could run any shortcode registered on the site by submitting it as a field value. Reported by Jakub Herman via WPScan.
- 🔒 SecurityFixed a vulnerability where the Turnstile check on Gravity Forms could be bypassed by adding a page number to the request. The check is now only skipped on forms that really do have more than one page.
- 🔨 TweakThe Turnstile form-tag for Contact Form 7 is now [cf7_simple_turnstile]. Your existing [cf7-simple-turnstile] tags keep working and do not need to be changed.
Version 1.42.1 – 27th July 2026
- ⚙️ FixFixed an issue since 1.42.0 where the submit button could stay disabled after the Turnstile challenge was completed, when the “Disable Submit Button” option is enabled. On the login form this could lock you out of your site.
- ⚙️ FixFixed the submit button staying disabled after the widget was re-rendered, such as after an AJAX comment or on the Blocksy account modal.
- ⚙️ FixFixed the submit button staying disabled on Jetpack forms when the “Disable Submit Button” option is enabled.
- ⚙️ FixFixed WooCommerce checkout failing with a “please verify that you are human” error when using the GlobalPayments GPAPI gateway with 3D Secure enabled.
- ⚙️ FixFixed the Turnstile API script loading render-blocking, even with the “Defer Scripts” option enabled.
- 🔨 TweakChanging the API keys programmatically, such as with WP-CLI or a provisioning script, no longer switches Turnstile off on every form until the manual test is run.
- 🔨 TweakTightened the Forminator integration further, so a solved Turnstile challenge can no longer be re-used for up to 30 seconds.
Version 1.42.0 – 26th July 2026
- ✨ NewAdded support for CIDR ranges (IPv4 and IPv6) in the IP whitelist, e.g. 203.0.113.0/24 or 2001:db8::/32, so visitors can be whitelisted by subnet.
- ⚙️ FixFixed IP whitelist matching for IPv6 addresses written in a different format, and for IPv4-mapped IPv6 addresses such as ::ffff:203.0.113.5. A /0 range is now ignored.
- ⚙️ FixFixed an issue since 1.41 where the login widget could be reset while a two-factor prompt was open (e.g. Wordfence 2FA), causing the login to fail.
- ⚙️ FixTurnstile now always loads in explicit render mode, fixing the widget not appearing on slow connections, with a “delay JavaScript” optimization, or in AJAX-loaded forms such as comment forms and popups.
- ⚙️ FixFixed several WooCommerce issues, including the checkout script erroring when a “delay JavaScript” optimization runs it before jQuery, widgets not rendering on the block checkout, and the “Click here to login” toggle.
- ⚙️ FixFixed the Turnstile widget not appearing in the Blocksy theme’s header account modal, and the integration now also loads when a Blocksy child theme is active.
- ⚙️ FixFixed a conflict with FluentAuth’s email two-factor and magic login, where the second step could fail with a Turnstile error.
- ⚙️ FixFixed a conflict with Simple Membership where a member logging in was not also logged into their WordPress user account, breaking is_user_logged_in() checks, .htaccess protection and user synchronization.
- 🔒 SecurityFixed a vulnerability in the Forminator integration where a solved Turnstile challenge could potentially be reused to bypass verification, as the validation was cached against a form value instead of the single-use token. (Reported by Meher Sudhakar Abbireddi via WPScan.)
Version 1.41.1 – 22nd June 2026
- 🔨 TweakAdded a view button to show the secret key in the settings page, which is hidden by default.
- 🔨 TweakMade a few small changes to the settings page.
- 🔨 TweakOn the Ultimate Member login form, added a check to prevent further login validation if Turnstile failed.
- ⚙️ FixFixed an issue with the Ultimate Member login form since the last update.
Version 1.41.0 – 18th June 2026
- ✨ NewAdded a new “Analytics” option which when enabled will start tracking some basic analytics data for Turnstile form submissions. This includes the number of successful and failed submissions, and the reasons for any failures.
- Improvement: Added some new tabs to the settings page, with a “Settings” tab for all the main settings, a new “Analytics” tab for the new analytics feature and the debug logging, and an “Import” tab for the import/export feature.
- 🔨 TweakUpdated the verified transient check to work better with certain 2FA plugins.
- 🔨 TweakUpdated the Contact Form 7 integration to now show the correct error message when the Turnstile check fails.
- 🔨 TweakThe “Widget Label Text” is now hidden when “Interaction Only” is selected, and only displayed when the widget actually requires an interaction.
- 🔨 TweakAdded spacing below the widget when it shows in “Interaction Only” mode, which is hidden when the widget is not displayed.
- 🔨 TweakThe Turnstile widget now re-renders shortly after clicking the login button on the wp-login.php page, to ensure a fresh token is ready in case of a failed login.
- ⚙️ FixFixed an issue with Turnstile not rendering on the block checkout “pay for order” page in some cases.
- ⚙️ FixFixed the “Show Widget Label Text” option not displaying on Elementor forms.
- ⚙️ FixFixed the “Logged In Users” whitelist option not bypassing Turnstile on Contact Form 7 submissions.
- ⚙️ FixFixed the “Appearance Mode” setting not being applied to Elementor forms and the WooCommerce block checkout, causing the widget to always display even when “Interaction Only” was selected.
- OtherRenamed the plugin from “Simple CAPTCHA Alternative with Cloudflare Turnstile” to “Simple CAPTCHA with Cloudflare Turnstile”.
Version 1.40.0 – 29th May 2026
- ✨ NewAdded an option to enable Turnstile on the WooCommerce Account Details form.
- 🔨 TweakAdded a warning message to the “Logged In Users” whitelist option.
- 🔨 TweakAdded an additional check to prevent the Turnstile widget from rendering twice on WooCommerce checkout in rare cases.
- 🔨 TweakPrevent any kind of form submission (shortkeys etc) for the default login form when Turnstile is not completed, if the “Disable Submit Button” option is enabled.
- 🔨 TweakPrevent any kind of form submission (shortkeys etc) for Elementor forms when Turnstile is not completed #84.
- 🔨 TweakForce-render inline script now loads via wp_add_inline_script in the footer, fixing rendering issues in some cases when “Defer Scripts” is disabled.
- ⚙️ FixFixed widget size setting (Flexible/Compact) not being applied to Elementor forms.
- ⚙️ FixFixed a mobile performance issue in some cases. Replaced the fixed 200ms setTimeout fallback which could cause scroll-locking and double-rendering.
- ⚙️ FixPerformance plugin compatibility hooks now register correctly regardless of which performance plugin is active.
- ⚙️ FixImproved WooCommerce checkout login form Turnstile rendering, which was not working for some themes.
- ⚙️ FixFixed a JS error on WooCommerce classic checkout when the Blocks checkout store isn’t registered.
- ⚙️ FixFixed duplicate Turnstile widget on Paid Memberships Pro login page.
- ⚙️ FixFixed a JS error with wpDiscuz integration when Perfmatters plugin was active.
Version 1.39.1 – 1st May 2026
- ⚙️ FixFixed a potential issue with the Turnstile check on login forms failing in certain cases when it runs multiple checks in the same request.
Version 1.39.0 – 20th April 2026
- ✨ NewAdded integration for the “SureForms” plugin.
- ✨ NewAdded integration for the “Sunshine Photo Cart” plugin (#70).
- 🔨 TweakAdjusted the “Widget Label Text” alignment in some cases so it always shows above the widget.
Version 1.38.4 – 17th April 2026
- ⚙️ FixFixed Turnstile verification failures on WooCommerce checkout caused by payment gateway plugins (e.g. PayPal Commerce, Amazon Pay, Mollie) consuming the single-use token during pre-checkout AJAX validation requests.
- ⚙️ FixFixed a fatal error occurring on pages where WooCommerce has been selectively disabled (e.g. via Plugin Organizer).
Version 1.38.3 – 17th April 2026
- 🔨 TweakMade some tweaks to the WooCommerce checkout duplicate submission check, with a longer expiration for the transient, and improved the auto re-render for Turnstile on payment error in certain cases.
- 🔨 TweakSmall tweak to the Contact Form 7 integration code with a basic static duplication check.
Version 1.38.2 – 16th April 2026
- 🔨 TweakAdded the transient based duplicate submission check to WooCommerce checkout, to prevent potential duplicate submission check failing issues since the last update.
- 🔨 TweakAdded improved support for Gravity Forms multi-page forms, to prevent the duplicate submission check from failing on page 2 and beyond.
Version 1.38.1 – 13th April 2026
- 🔨 TweakReplaced all PHP session usage with WordPress transients for the duplicate submission checks, to prevent full-page caching from being broken by the PHPSESSID cookie and Cache-Control headers.
- 🔨 TweakAn invalid-input-secret error from Cloudflare no longer disables Turnstile on all forms. Instead, the admin is notified and a soft re-test prompt is displayed on the settings page.
- 🔒 SecurityFixed a broken authentication vulnerability on WooCommerce checkout potentially allowing one successful Turnstile submission to be reused for multiple checks. (Reported by David Marín via Patchstack.)
Version 1.38.0 – 6th April 2026
- ✨ NewAdded a “Refresh Timeout” option to the advanced settings.
- 🚀 PerfThe Cloudflare health check (used by failover mode) is now cached for 2 minutes, preventing repeated HTTP requests on every form render.
- 🔨 TweakAdded missing WooCommerce ‘cart_checkout_blocks’ and ‘product_block_editor’ feature compatibility declarations.
- ⚙️ FixFixed a text domain typo in the WooCommerce Store API integration.
- ⚙️ FixImproved the WP Discuz integration to properly validate and block submissions when the Turnstile check fails, and now honors the whitelist.
- ⚙️ FixFixed an issue with Turnstile not loading on Elementor popup forms in some cases.
- ⚙️ FixThe disable submit option should now work correctly on Elementor forms.
- ⚙️ FixThe disable submit option should now work correctly on Contact Form 7 forms.
- ⚙️ FixFix for WooCommerce block checkout sometimes rendering the Turnstile widget twice.
- ⚙️ FixFixed a “Invalid type for container” JavaScript error with the wpDiscuz integration.
- ⚙️ FixFixed the right alignment styling for bbpress.
- ⚙️ FixFixed an issue where Turnstile widgets would repeatedly render when a browser tab is left open for extended periods.
- ⚙️ FixFixed an issue where CF7 forms would show “One or more fields have an error” when SCT is active but the form doesn’t use the SCT turnstile shortcode.
- ⚙️ FixFixed an issue with scripts not being enqueued properly in some cases.
- 🛠️ DevFixed the missing prefix for the add_data_attribute function.
- 🛠️ DevChanged all include() calls to include_once() to prevent fatal errors if the plugin file is loaded more than once.
- 🛠️ DevFixed cfturnstile_check() returning false instead of array( ‘success’ => false ) when API keys are not set.
- 🔒 SecurityMade a few small precautionary security enhancements (missing ABSPATH check, and sanitized REQUEST_URI).
Version 1.37.0 – 12th January 2026
- Improvement: Improved the Elementor integration to work better in more cases, and with Elementor popups.
- Improvement: Added an alignment option for the Elementor integration.
- 🔨 TweakRemoved the “Integration Method” option for Elementor forms. It will now load globally but has an option to choose where scripts are loaded.
- 🔨 TweakSmall tweaks to the settings page.
- 🔨 TweakAdded a copy button for the debug log.
- ⚙️ FixFixed a new issue some websites were experiencing with WooCommerce block checkout not working with Turnstile.
- ⚙️ FixFixed an error “attempt to read property success on null” showing in some cases.
- ⚙️ FixFixed the widget label not showing in some cases, on the comments form.
- ⚙️ FixFixed WooCommerce checkout in some cases not re-rendering Turnstile after payment errors. It should now re-render correctly in all cases to prevent Turnstile errors.
- ⚙️ FixFixed an issue with Forminator forms when using file upload fields.
Version 1.36.1 – 31st December 2025
- ⚙️ FixFixed an issue with the disable submit feature not working in some cases.
Version 1.36.0 – 30th December 2025
- ✨ NewAdded new “Failsafe Mode” option in the advanced settings.
- ✨ NewAdded the ability to enable and set a custom “widget label text” that is shown above the Turnstile widget.
- ✨ NewAdded an option to enable “Resource Hint (Preconnect)” in the advanced settings.
- 🔨 TweakImproved the code for getting the user IP address for the Turnstile verification request. Helps with certain server setups and proxy services.
- 🔨 TweakChanged Turnstile default render to “auto” instead of “explicit”.
- 🔨 TweakRemoved the user ID check on WordPress login Turnstile check, so it still runs if the username is invalid.
- 🔨 TweakAdded “header” info to the debug log entries.
- ⚙️ FixFixed an issue with Kadence Forms integration in some cases.
Version 1.35.0 – 27th October 2025
- ✨ NewImprovement to Elementor integration to work better with Elementor element caching.
- ✨ NewAdded new “Integration Method” for the Elementor integration. The “Load Scripts Globally” option may work better for certain types of caching.
- 🔨 TweakUpdated the Elementor JS code from using jQuery to vanilla JS.
- 🔨 TweakAdded an option in the “Advanced Settings” to toggle “Performance Plugin Compatibility”.
- 🔨 TweakUltimate Member forms now have a unique fixed ID instead of a random one each time.
- 🔨 TweakFor WooCommerce checkout, added an alternative check for duplicate execution within a single request.
- 🔨 TweakMade some changes to the settings page, updated the setup guide link, and updated donation/sponsor details.
- ⚙️ FixFixed an issue with Turnstile being ignored by certain payment methods like PayPal express, in some cases.
- ⚙️ FixFixed an issue when the “WordPress Login” option is enabled, but “WooCommerce Login” is disabled, the WooCommerce login still gave a verification failed error.
