Cloudflare Turnstile reCaptcha Plugin

Question: What does Cloudflare Turnstile ReCaptcha Plugin do?

Answer: It protects Osclass forms against spam and bots using Cloudflare Turnstile. The widget verifies visitors in the background and every form submission is checked on the server side, so spam is stopped before it reaches your database or mailbox.

Question: Which Osclass forms can be protected by this plugin?

Answer: Registration, login, new comment, item contact, send to a friend, web contact and new item form. Each form has its own switch in plugin settings, so you protect only the forms you need.

Question: Is Cloudflare Turnstile free to use?

Answer: Yes. Turnstile is a free Cloudflare service. You only need a free Cloudflare account to create a widget and get your Site Key and Secret Key.

Question: Do I need to modify my theme to use this plugin?

Answer: Themes that use standard Osclass hooks work out of the box. For custom forms you can place the widget manually with a single hook line and protect the form using custom hook pairs defined in plugin settings.

Question: How is Turnstile different from Google reCAPTCHA?

Answer: Turnstile verifies visitors without image puzzles or text challenges, so most real users pass without any interaction. It is privacy-friendly, free and does not slow down the checkout of your forms.

Question: Can I protect custom forms added by my theme or other plugins?

Answer: Yes. In plugin settings you define hook pairs - a display hook that shows the widget and a verify hook that checks the submission. You can also call the verify function directly in your processing code.

Question: Does the plugin keep a record of spam attempts?

Answer: Yes. Every verification is stored in a database log with form name, result, error codes, visitor IP address, hostname and date. The backoffice shows a searchable log with pagination and a bar chart for the last 30 days.

Question: Are old log records removed automatically?

Answer: Yes. A daily cron task removes records older than the configured retention period. Default retention is 12 months and can be changed in plugin settings.

Question: How can I check that the widget is placed correctly in my forms?

Answer: Enable Debug mode in plugin settings. The widget placeholder is highlighted with a red border and admin sees a diagnostic message on each front-end form telling whether the form contains the widget.

Question: Can I test my keys before going live?

Answer: Yes. The backoffice includes a test panel where you can verify your keys directly. Cloudflare test keys for pass, fail and interactive scenarios are supported.

Question: Can I hide the Turnstile widget for logged-in users?

Answer: Yes. There is an option to skip the widget and verification for logged-in web users. Logged-in admin users are not affected, so admin can always check widget placement.

Question: Which widget modes and styles are supported?

Answer: Widget mode (Managed, Non-Interactive or Invisible) is selected in your Cloudflare dashboard. In plugin settings you choose widget theme (auto, light or dark) and widget size (normal or compact).

Question: Does the plugin work together with built-in Osclass ReCaptcha?

Answer: You should disable built-in Osclass ReCaptcha in Settings > Spam and Protection to avoid two captcha widgets in the same form. The plugin then handles all enabled forms by itself.

Question: Does the plugin slow down my website?

Answer: No. The Turnstile script is loaded asynchronously and only on pages where the widget is shown. Server-side verification runs only when a protected form is submitted.