# How can I integrate Cloudflare Turnstile with Discourse?
**URL:** https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821
**Category:** Support
**Created:** [April 8, 2024, 4:46am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821 "2024-04-08T04:46:55Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@Pranav\_Kundaikar](https://meta.discourse.org/u/Pranav_Kundaikar)
#### Post date: [April 8, 2024, 4:46am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/1 "2024-04-08T04:46:56Z")
I was searching for any documentation/guide for integrating Cloudflare Turnstile with Discourse but not able to find it. Can any one help with this?
---
### Author:  [@Mr.X\_Mr.X](https://meta.discourse.org/u/Mr.X_Mr.X)
#### Post date: [April 8, 2024, 10:52pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/2 "2024-04-08T22:52:25Z")
Same question here. Very eager to find out
---
### Author:  [@ernestdefoe](https://meta.discourse.org/u/ernestdefoe)
#### Post date: [April 10, 2024, 2:04am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/3 "2024-04-10T02:04:09Z")
Yeah this is a much needed feature. I prefer Turnstile over all the other captcha services. Hopefully someone will create a plugin or something for this soon.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [April 10, 2024, 2:50am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/4 "2024-04-10T02:50:28Z")
Users must validate their email address in order to create an account. How does turnstile do anything but discourage users from creating an account?
What problem are you solving?
---
### Author:  [@ernestdefoe](https://meta.discourse.org/u/ernestdefoe)
#### Post date: [April 10, 2024, 2:19pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/5 "2024-04-10T14:19:27Z")
I guess you’re right.
---
### Author:  [@shawa](https://meta.discourse.org/u/shawa)
#### Post date: [July 1, 2024, 10:30am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/6 "2024-07-01T10:30:48Z")
> [@pfaffman](#):
>
> Users must validate their email address in order to create an account. How does turnstile do anything but discourage users from creating an account?
>
> What problem are you solving?
I am considering the possibility that if some automated programs crazily register users, it could consume the daily sending quota of the email server (which is integrated from a third party), leading to increased costs.
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [January 26, 2026, 2:26pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/7 "2026-01-26T14:26:26Z")
Is Cloudflare Turnstile currently supported by Discourse, or are there any plans to support it in the future?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 26, 2026, 2:52pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/8 "2026-01-26T14:52:23Z")
I believe you could integrate it with a theme component, but as I asked before, are you currently experiencing a problem that Turnstile will solve?
---
### Author:  [@copymonopoly](https://meta.discourse.org/u/copymonopoly)
#### Post date: [February 2, 2026, 7:48am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/9 "2026-02-02T07:48:06Z")
Thanks for your reply! I recently noticed Cloudflare verification when registering or posting on other forums, which made me curious whether Discourse can do the same.
---
### Author:  [@Lee\_Ars](https://meta.discourse.org/u/Lee_Ars)
#### Post date: [February 16, 2026, 2:59pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/10 "2026-02-16T14:59:07Z")
Seems like it’d solve the same problem hCaptcha solves, except that unlike hCaptcha’s free tier, Turnstile’s free tier offers a transparent/zero-friction mode, better analytics, and it’s integrated into the cloudflare stack and manageable from the CF dashboard, which is potentially valuable to self-hosters already utilizing CF (or anyone who wants a transparent captcha offering without forking over $99/month).
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 16, 2026, 3:17pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/11 "2026-02-16T15:17:59Z")
Do you have a bunch of examples of fake accounts getting set up? Since you have to validate your email address when creating an account, most sites don’t bother Wuthering captcha as it makes it harder for real users to register without any benefit.
---
### Author:  [@Lee\_Ars](https://meta.discourse.org/u/Lee_Ars)
#### Post date: [February 16, 2026, 8:39pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/12 "2026-02-16T20:39:41Z")
> [@pfaffman](#):
>
> Do you have a bunch of examples of fake accounts getting set up?
When I stood up my current discourse instance this past summer, I had about 100 spam accounts sign up within 24 hours, all with throwaway email domain accounts (all of which had functional SPF and DKIM). Turning on hCaptcha eliminated the problem entirely. I deployed discourse on an existing site to replace native WordPress comments that were absolutely swimming in abusive spam, and the spammers immediately shifted tactics to follow.
> [@pfaffman](#):
>
> most sites don’t bother Wuthering captcha as it makes it harder for real users to register without any benefit.
I can’t speak to “most sites,” other than to say that that your personal experience is not mine. The benefit for me is a massive, measurable decrease in spam sign-ups with hCaptcha. Validating e-mail accounts is not a barrier to spam sign-ups. I appreciate that hCaptcha has an official Discourse plugin, though I’d prefer to use Turnstile because of the added value.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 16, 2026, 9:18pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/13 "2026-02-16T21:18:55Z")
> [@Lee\_Ars](#):
>
> When I stood up my current discourse instance this past summer, I had about 100 spam accounts sign up within 24 hours, all with throwaway email domain accounts (all of which had functional SPF and DKIM). Turning on hCaptcha eliminated the problem entirely.
Wow. That’s crazy. Show’s what I know!
I think it should be possible with a theme component–if the Bad Actors are using the javascript front end and not the API (in which case Turnstile wouldn’t make a difference).
Anyway, I can’t quite tell how it works, but it’s possible that my [GitHub - literatecomputing/discourse-custom-components · GitHub](https://github.com/literatecomputing/discourse-custom-components) theme component would let you paste whatever it is that Cloudflare gives you into the component and have it render on some place on the signup form.
Edit: oh, but that’ll just put the captcha on the page, I guess, not require it to submit the form.
### What is required
There’s a client side piece: [Embed the widget · Cloudflare Turnstile docs](https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/)
And a server-side piece: [Validate the token · Cloudflare Turnstile docs](https://developers.cloudflare.com/turnstile/get-started/server-side-validation/)
You’d first need to add the client-side piece and see that the stuff from there gets submitted with the account-creation data. Then the server-side piece would validate that they indeed passed the test. I’m not quite sure how hard it would be, I’m guessing $500-2000 would get someone to do it in #Marketplace.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 19, 2026, 2:02pm UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/14 "2026-02-19T14:02:30Z")
Maybe with this:
[https://github.com/sydomo/discourse-cloudflare-turnstile.git](https://github.com/sydomo/discourse-cloudflare-turnstile.git)
It was included here: [阿里云邮件推送无法使用](https://meta.discourse.org/t/topic/396468)
---
### Author:  [@lilydjwg](https://meta.discourse.org/u/lilydjwg)
#### Post date: [August 26, 2026, 1:46am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/15 "2026-08-26T01:46:36Z")
I also prefer Turnstile than hCapture. I was greeted by the latter a lot in the past, and they were hard to solve, especially when a non-English language was used. Language and culture differences sometimes made it difficult to understand what was in the pictures and what answer was expected.
However I see that the hCapture plugin has support for Google’s reCaptcha? If that’s the case, maybe just `sed` the URL and it can be replaced by Turnstile?
---
### Author:  [@satonotdead](https://meta.discourse.org/u/satonotdead)
#### Post date: [August 26, 2026, 2:25am UTC](https://meta.discourse.org/t/how-can-i-integrate-cloudflare-turnstile-with-discourse/302821/16 "2026-08-26T02:25:28Z")
Just want to share that Cloudflare captchas should be the exit door for me. I do not want to prove I am not a bot acting like one. It triggers when one knows about fingerprinting and values their own privacy.
For the system’s basic functioning, it is not about being harmful but triggering when the user keeps their data private.
I found a better approach in Anubis. Open-sourced, more user-friendly, and without giving power to those who control almost all the useful traffic data in the world.