Setting Up Cloudflare Turnstile in AffiliateWP

Would you like to use Cloudflare Turnstile to help prevent spam on your affiliate registration and login forms? Cloudflare Turnstile is a free, puzzle-free CAPTCHA alternative that verifies users without displaying any visual challenges. It provides a seamless, privacy-friendly experience while helping protect your affiliate program from bots and abuse.

This tutorial will show you how to set up and use Cloudflare Turnstile in AffiliateWP.

Generating Cloudflare Turnstile Site Keys

Before configuring Cloudflare Turnstile in AffiliateWP, you’ll need to create a site key and secret key in your Cloudflare account.

Start by logging to your Cloudflare account. From the dashboard, click on the Turnstile menu in the left sidebar. Once you’re on the Turnstile page, click the Add widget button.

Next, enter a name in the Widget name field. This is for your internal reference and won’t be shown to visitors.

Under Hostname Management, click the Add Hostnames button.

A sidebar will appear. In the Add a custom hostname field, type your website’s domain name (for example, example.com) and click the Add button next to it.

Once the domain appears in the list, click the Add button at the bottom to confirm.

Choosing a Widget Mode

Scroll down to the Widget Mode section. Here, you can choose how Turnstile behaves on the frontend of your site.

• Managed (recommended): Automatically decides whether to show a challenge or silently validate the user.
• Non-interactive: Displays the Turnstile widget, but doesn’t require interaction.
• Invisible: Runs entirely in the background with no visible widget.

Keep the Managed option selected unless you have a specific reason to change it.

Once you’ve finished configuring the widget, click the Create button.

Cloudflare will generate a Site Key and a Secret Key for the widget you just created. Keep these available for the next step.

Configuring Turnstile in AffiliateWP

Return to your WordPress site and go to AffiliateWP » Settings. Click the Affiliates tab, then scroll to the Affiliate Registration & Login Security section.

Click the Turnstile option to select Cloudflare Turnstile as your CAPTCHA method.

This will reveal two fields: Turnstile Site Key and Turnstile Secret Key.

Copy the keys from your Cloudflare account and paste them into the corresponding fields in AffiliateWP.

When you’re done, scroll down and click Save Changes to apply the configuration.

Enabling CAPTCHA on the Affiliate Login Form

After selecting Turnstile, you’ll also see the option labeled Add CAPTCHA to Affiliate Login form.

Enabling this option adds Turnstile protection to the affiliate login form in addition to the registration form. This helps prevent credential-stuffing, brute-force attacks, and other automated login abuse.

Make sure to check the box and save your settings.

Testing Cloudflare Turnstile

Once setup is complete, it’s important to test that Turnstile is working as expected.

Visit your affiliate registration page and try submitting a test entry. If everything is configured correctly, Turnstile will silently verify the submission in the background or show a minimal widget, depending on your selected widget mode.

If you enabled CAPTCHA on the login form, test that as well by attempting to log in via the affiliate login page.

If the CAPTCHA does not appear or submissions fail, double-check the following:

• Site and Secret Keys are correctly copied and saved
• Your domain was added under Hostname Management in your Cloudflare widget
• Turnstile is selected in AffiliateWP » Settings

Frequently Asked Questions