Cloudflare recently introduced Turnstile, a privacy-focused alternative to CAPTCHA that is non-intrusive and free to use. The WordPress plugin community is gradually beginning to incorporate support for this new solution.
However, not all plugin developers are in a rush to add support for Turnstile, citing various concerns that may give others pause.
Cloudflare Turnstile
Turnstile is designed to prevent spammers from abusing forms such as contact forms, user registration forms, or login forms. Its main appeal lies in not collecting user information and being nearly invisible, thereby ensuring a seamless user experience.
One user who implemented Turnstile on their site reported that out of 127 visitors, only one was challenged by the system.
They tweeted:
out of 120 visits, only 1 needed to click a checkbox to verify being human
Turnstile’s privacy-centered approach is noteworthy because it neither collects nor stores user information. According to Cloudflare:
“In June, we announced an effort with Apple to use Private Access Tokens.
Visitors using operating systems that support these tokens can prove their humanity without completing a CAPTCHA or giving up personal data.
By collaborating with third parties like device manufacturers, we can validate a device without collecting, touching, or storing that data ourselves. Private Access Tokens are integrated directly into Turnstile.
Although Turnstile has to review some session data to validate users without challenging them, Private Access Tokens allow us to reduce data collection by asking Apple to validate the device for us.
Integration With WordPress
While Cloudflare did not initially mention a WordPress plugin for integrating Turnstile, TechCrunch reported that Cloudflare is developing plugins for major platforms like WordPress to simplify Turnstile’s deployment.
Some WordPress plugins have already started incorporating Turnstile. For example, the WS Form WordPress plugin added Turnstile support on October 4, 2022. Fluent Forms followed on October 7, 2022, even providing a tutorial on its use. The Site Reviews plugin, used by over 40,000 WordPress publishers, integrated Turnstile on October 11, 2022.
However, Contact Form 7, used by over 5 million WordPress publishers, has not yet added Turnstile support. A publisher seeking Turnstile support for Contact Form 7 noted that the integration would require modifications to the Contact Form 7 reCaptcha module files and templates.
A GitHub request for integrating Turnstile into Contact Form 7 revealed that the publisher is not interested in supporting Turnstile at this time. They stated:
“For now, I’m not interested in natively supporting Turnstile.
Cloudflare has not yet provided sufficient grounds that support Turnstile is better than reCAPTCHA in privacy terms.
Also, it’s still in the open beta stage.”
A respondent in the GitHub feature request emphasized the difference in privacy motivations between Google and Cloudflare:
“Google’s business is advertising, which benefits from user analytics. Cloudflare’s business is selling services, which means less conflict with user privacy. Mozilla’s partnership with Cloudflare is a testament to Cloudflare’s commitment to privacy.”
The publisher further suggested that Turnstile might be better utilized as an independent plugin rather than integrated into Contact Form 7 directly.
Turnstile is in Beta
The decision to not integrate Turnstile with Contact Form 7 due to its beta status is understandable. Beta products are essentially still in testing phases and may have unresolved issues.
Nevertheless, many are enthusiastic about using Turnstile due to Cloudflare’s reputation for privacy, security, and high-quality solutions.
A recent tweet highlighted:
Turnstile is another free alternative to reCAPTCHA
As more WordPress plugins integrate Turnstile, it may become a popular choice for preventing spam on WordPress websites.
Conclusion
Cloudflare’s Turnstile offers a promising, privacy-preserving alternative to traditional CAPTCHA methods. While some plugin developers are hesitant to adopt it immediately due to its beta status and other concerns, its integration within the WordPress plugin ecosystem is gradually expanding. This new tool may soon become a widely accepted option for enhancing user experience and security on websites.
