Turnstile with WordPress and the Divi theme:

Protecting your WordPress website from spam and automated abuse is essential — but traditional CAPTCHA systems often frustrate real users and slow down your site. Cloudflare’s Turnstile offers a modern, privacy-first alternative that automatically distinguishes humans from bots without intrusive image puzzles or data tracking.

In this guide, we’ll walk through the complete process of integrating Cloudflare Turnstile with WordPress, specifically using the Divi theme. You’ll learn how to obtain your site and secret keys, configure validation in WordPress forms, and seamlessly embed Turnstile within Divi’s visual builder — all while keeping performance fast and user experience effortless.

By the end, you’ll have a secure, lightweight, and user-friendly verification layer that enhances both security and accessibility on your Divi-powered WordPress site.
You can of course use other themes that DIVI. More about that further down this article.

Setting up Maian Responder with CloudFlare Turnstile (Invisible)

Benefits of Cloudflare Turnstile

Privacy-friendly:
Turnstile doesn’t track users or use cookies — no data sent to Google.

Frictionless for users:
Usually invisible, with no “click all the traffic lights” puzzles.

Lightweight & fast:
Smaller script size → faster page loads.

Free with no usage limits:
No enterprise tiers or quotas — full features for all users.

Easy integration:
Simple API compatible with existing CAPTCHA flows.

Works without JavaScript or cookies (gracefully degrades):
Better accessibility and performance for all users.

To make things a little harder for myself—and to show that this method works — I chose a cross-domain setup. This means the signup form is on one URL (my main site, e.g., davidholywood.com), but the processing and validation are handled by Maian Responder hosted on a separate domain.

I use an old domain, make-it-count.dk, for hosting my Maian Responder instances. I run several subdomains for different projects, structured like this:

test.make-it-count.dk (The specific subdomain processing the form)

dfwd.make-it-count.dk

thepassionblogger.make-it-count.dk

etc…

(If you have the paid version of Maian Responder, you don’t actually have to run multiple installations. Maian Responder can easily handle multiple campaigns internally. Btw, I use the paid version, but the free version works fine if you have fewer than 1000 subscribers and only need one campaign with a set of automated emails.)

Cloudflare Turnstile Setup: Connecting the Domains
First, I logged into Cloudflare to get the security keys and settings configured.

From the Cloudflare menu, I chose Application Security / Turnstile. I then clicked Add site to create a new widget, which I named “Make-it-count”.

The next part is absolutely vital for a cross-domain setup like ours. We are using one form domain (davidholywood.com) and one validation domain (test.make-it-count.dk), so we must link them to a single widget.

The Hostname Allowed List
After you create the widget, go into its settings. Find the section called “Hostname management” (or just “Hostnames”). This is your allowed list.

You MUST add both domains here:

The domain hosting the form: davidholywood.com

The domain hosting the processing script: test.make-it-count.dk

This tells Cloudflare that both domains are authorized to use this specific Site Key and Secret Key pair. If you try to create two separate widgets, the keys will not work together. Using one widget with two hostnames is the correct approach.

Retrieving and Fixing the Code
On this same settings page, you will retrieve your Site Key (for the HTML form) and your Secret Key (for the PHP validation script). You’ll also see links to the Client-side integration code and Server-side integration code.

The code provided on these documentation pages is often set up for basic, single-domain integration and can be confusing. Even as an experienced developer, I ran into issues, which is why I wrote this article—to provide a reliable, working solution.

1. Server-Side Integration (The Fix)
Let’s start with the server part, which requires editing the signup.php file from the Maian Responder root directory. Unfortunately, the server-side code provided by the Cloudflare documentation can be buggy or incomplete for our specific needs.

Here is the part of the code we will focus on for the validation logic. This is the section that requires correction to ensure the validation check passes:

// Usage
$secret_key = ‘your-secret-key’;
$token = $_POST[‘cf-turnstile-response’] ?? ”;
$remoteip = $\_SERVER[‘HTTP_CF_CONNECTING_IP’] ??
$\_SERVER[‘HTTP_X_FORWARDED_FOR’] ??
$\_SERVER[‘REMOTE_ADDR’];

$\_SERVER won’t work. It is a blatant error. In my code I change $\_SERVER to $_SERVER (no slash) because a \ in a variable is invalid synthax and WILL fail.

Here is the correct code where I also inserted a DIE if the validation fails. No need to run the rest of the code if a bot signed up:

And here you can see where in the signup.php you need to insert it – MAKE SURE YOU CREATE A BACKUP OF SIGNUP.PHP BEFORE YOU START EDITING – JUST IN CASE!

Now we need to look at the client side code.

Every single mail system you sign up for has a code snippet for your sign up page. You simply copy it and paste it to your sign up page. In maian responder we simply click on CAMPAIGNS/Managing campaigns (assuming you have made a campaign).

Select Get HTML Code from the POST METHOD. NOT the GET Method or the AJAX METHOD.

It looks something like this:

<div>

<h2>How To Start Your Blogging Adventure Signup Form</h2>

<form method=”post” action=”https://test.make-it-count.dk/signup.php”>

<label>Enter First Name:</label>
<input type=”text” name=”nm” value=””><br><br>

<label>Enter Last Name:</label>
<input type=”text” name=”nm2″ value=””><br><br>

<label>Enter Email Address:</label>
<input type=”text” name=”em” value=””><br><br>

<input type=”hidden” name=”cid” value=”1″>
<input type=”hidden” name=”mthd” value=”post”>
<button type=”submit”>Submit</button>

</form>

</div>

And here is my code:

<h2>Test Signup Form</h2>
<form method=”post” action=”https://test.make-it-count.dk/signup.php”>

<label>Enter First Name:</label>
<input type=”text” name=”nm” value=”” />

<label>Enter Last Name:</label>
<input type=”text” name=”nm2″ value=”” />

<label>Enter Email Address:</label>
<input type=”text” name=”em” value=”” />

<input type=”hidden” name=”cid” value=”1″ />
<input type=”hidden” name=”mthd” value=”post” />

<div id=”my-turnstile-widget”></div>

<button type=”submit”>Submit</button>

</form>

In your code you need to enter the url of your responder instead of mine: https://test.make-it-count.dk/signup.php.

In future versions of Maian Responder it will be possible to combine first name and last name into one. I will add more about this when it is published. The lines witn nm and nm2 (name & name2).

In this line: <input type=”hidden” name=”cid” value=”1″ /> 

the number refers to your campaing number. It needs to match the campaign you are setting up, but if you copied the code from the correct campaign you are safe to go.

The major difference is this line: <div id=”my-turnstile-widget”></div>

This is what makes Turnstile work on your page (the client side).

Last thing to do is to include the script code on your page. Dont load it generally on all pages. Only this one whare your clients sign up.

In the DIVI Theme Builder you can setup a template for anything. In this case my page is named sign-up so I select to create a template for this page only by (from the DIVI/Themebuilder), Add New Template/Build New Template and from there select the sign-up page – or what ever you named it.

You can add the code in the header, the body or the footer. It is supposed to work in the header, but it didn’t for me. I didn’t investigate why but I think it failed because it wasn’t loaded and ready when I called it. It worked for me when I put it in the footer. So if the signup fails, try to switch.

<script>
function onloadTurnstileCallback() {
turnstile.render(‘#my-turnstile-widget’, {
sitekey: ‘ENTER YOUR SITE KEY HERE’, // Your site key
// This callback is what generates the token field needed by your PHP
callback: function(token) {
console.log(`Token generated: ${token}`);
},
});
}
</script>

<script src=”https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback” async defer></script>

Remember to enter your Site Key from Cloudflare Turnstile here.