Moving away from Google ReCAPTCHA
Whether it is contact forms getting flooded with nonsense or bots trying their luck with fake submissions, it is something that never quite goes away. For years many of us leaned on Google reCAPTCHA to keep things under control. It did the job, mostly. However things have changed.
With Google now charging for reCAPTCHA in many use cases, and increasing concerns around privacy and user experience, we have started moving our client websites over to Cloudflare Turnstile. It is free, privacy friendly, and refreshingly simple to use.
In this post we will walk through why we are making the switch, what we have done during migration, and how you can set up Turnstile on your own WordPress website using Contact Form 7 and WPForms.
Why move away from reCAPTCHA
There are a few key reasons behind the shift.
First, cost. What was once a free and easy solution now comes with usage limits and potential charges. For agencies managing multiple sites this quickly adds up.
Second, user experience. Many users find traditional CAPTCHA challenges frustrating. Clicking traffic lights or deciphering distorted text is not exactly a smooth journey.
Third, privacy. reCAPTCHA relies heavily on tracking behaviour and gathering data. With increasing awareness around data protection, this is not always ideal.
Turnstile takes a different approach. It verifies users quietly in the background without requiring interaction in most cases. That means fewer barriers for real users and fewer headaches for site owners.
What is Cloudflare Turnstile
Cloudflare Turnstile is a smart verification tool that replaces traditional CAPTCHA systems. Instead of asking users to prove they are human through challenges, it uses non intrusive checks to determine legitimacy.
For visitors, it often appears as a simple checkbox or even nothing at all. For website owners, it provides strong protection against spam and abuse.
Better still, it is completely free to use and does not rely on invasive tracking.
Our migration process
Across our WordPress projects we followed a consistent approach when moving from reCAPTCHA to Turnstile.
We started by auditing each site to identify where reCAPTCHA was being used. In most cases this was within contact forms, login pages, and occasionally comment sections.
Next, we removed existing reCAPTCHA integrations. This usually involved disabling plugins or removing API keys from form settings.
We then created Turnstile site keys within Cloudflare. This step is straightforward and only takes a few minutes.
Finally, we integrated Turnstile with the relevant form plugins and tested thoroughly to ensure spam protection was working without affecting genuine submissions.
The result has been a smoother user experience and reliable spam prevention without additional cost.
Setting up Cloudflare Turnstile
Before connecting Turnstile to WordPress, you will need to create your site keys.
Log in to your Cloudflare dashboard and navigate to the Turnstile section. Add a new site and enter your domain. You will then receive a site key and a secret key. Keep these safe as you will need them shortly.
Once you have your keys, you are ready to connect Turnstile to your forms.
Using Turnstile with Contact Form 7
If you are using Contact Form 7, the process is simple.
Install a Turnstile integration plugin from the WordPress plugin directory. There are several reliable options available that specifically support Contact Form 7.
Once installed, head to the plugin settings and enter your Turnstile site key and secret key.
After that, open your Contact Form 7 form editor. You will usually see a new Turnstile tag or option available. Add this to your form where you would like the verification to appear.
Save your form and test it. In most cases you will see a clean and minimal verification element instead of a traditional CAPTCHA.
Spam protection should now be active without disrupting the user experience.
Using Turnstile with WPForms
If you prefer WPForms, the setup is just as straightforward.
WPForms includes built in support for Turnstile in recent versions, which makes integration even easier.
Start by going to WPForms settings within your WordPress dashboard. Look for the CAPTCHA or spam protection section and select Turnstile.
Enter your site key and secret key provided by Cloudflare.
Next, edit the form you want to protect. In the form settings, enable Turnstile for that specific form.
Save your changes and run a test submission. You should see Turnstile working quietly in the background or as a simple checkbox depending on your configuration.
Things to watch out for
While the setup is generally smooth, there are a few things worth keeping in mind.
Make sure any caching plugins or optimisation tools are not interfering with scripts. If Turnstile does not appear correctly, clearing cache often resolves the issue.
Check that your domain is correctly configured in Cloudflare. A mismatch can prevent verification from working.
Always test forms after setup. Try both successful submissions and intentional spam attempts to confirm everything is functioning as expected.
A better experience for everyone
Switching to Cloudflare Turnstile has been a positive move across all the WordPress websites we manage. It reduces friction for users, removes ongoing costs, and aligns better with modern expectations around privacy.
For businesses relying on contact forms, this small change can make a noticeable difference. Fewer lost enquiries, less spam, and a cleaner experience all round.
If you are still using reCAPTCHA, now is a good time to consider making the switch. The setup is quick, the benefits are immediate, and your users will thank you for it.
