Login bot check: protect your WordPress login and forms

The login bot check adds a quick browser check to the login page and the forms on your WordPress site. Bots that try to guess passwords, create fake accounts or flood your forms with spam are stopped; real visitors almost never see anything, because the check runs in the background.

The check is Cloudflare Turnstile. It works on WordPress sites hosted on our servers.

How do I switch it on?

Open Sites, choose the site, open the Security section and find Login bot check. Turn on Bot check on the login page and forms. The change takes a few seconds; the card shows each step and then the date it last confirmed the check on your site.

Turning it off removes the check from every form again.

Which forms are protected?

Under Forms to protect, tick the places you want the check on and choose Save forms:

• the login page, the registration page and the lost password page
• WordPress comments
• forms from Contact Form 7, WPForms, Elementor, Everest Forms, Fluent Forms, Formidable Forms, Forminator, HappyForms, Kadence, Mailchimp for WordPress, MetForm, Ninja Forms, Otter and Spectra

A form plugin that is not installed on your site is skipped, so you can tick it in advance. You need at least one place ticked.

Can I use my own Cloudflare keys?

Yes. By default the check uses our own Turnstile keys and you do not need a Cloudflare account. To use a widget from your own Cloudflare account instead:

1. In your Cloudflare dashboard, open Turnstile and create a widget for your site's domain.
2. Copy its sitekey and secret key (both start with 0x).
3. In Your own Cloudflare keys on the card, paste both and choose Use my keys.

We check the secret key with Cloudflare before saving it, store it encrypted and never show it again. Cloudflare's public test keys are not accepted, because they let every visitor through. Your keys go onto your site the next time the check is on.

To stop, choose Use our keys instead. Your keys are removed once ours are on your site.

If your own secret key goes missing, the card tells you so: paste your keys again, or go back to ours.

How do I change the secret key?

When the check uses our keys, choose New secret key at any time. We give the check on this site a new secret and put it on your site in the same step; the card shows when the key was last changed. When you use your own keys, rotate the secret in your own Cloudflare account and paste the new one here.

Can the check be switched on without me?

Yes, in two cases, to protect your site and our shared mail sending:

• Spam on your forms. If your site sends five or more messages in a day that our mail filter holds as spam, we switch the check on for your comments and contact forms (never the login page) and e-mail you to say so.
• New WordPress sites. For the first three days after a WordPress site is created, if it has a contact form plugin, we switch the check on for those forms.

We never do this on a site where you have already turned the check on or off yourself: your choice always stands. You can turn it off, or change the forms, on the card at any time.