The widget is only the first half of the protection
Turnstile produces a token in the browser. Your server must send that token to Cloudflare Siteverify and accept the form only after a valid response. If an integration stops at the component, a bot can bypass the page and call the form endpoint directly.
NexaForge implements the complete request path and keeps the secret key server-side. Success, timeout, duplicate token and upstream error behavior are all defined before the form goes live.
- ▸ Widget rendering and responsive placement in the existing design
- ▸ Token transport from the client to the protected endpoint
- ▸ Server-side POST to Siteverify with secret and response token
- ▸ Hostname and action checks where the flow uses them
- ▸ User-friendly retry behavior for expired or duplicate tokens
- ▸ Logging that helps debugging without storing reusable secrets
React, WordPress and custom backend integration
The implementation is adapted to the application rather than forced through one plugin. React and other single-page applications need lifecycle handling so a widget is not rendered twice or submitted with a stale token. WordPress needs the selected forms and authentication routes verified on the server, especially when caching or multiple plugins are involved.
Custom APIs can validate Turnstile before expensive work such as account creation, email delivery or payment preparation begins.
- ▸ React, Next.js, Vue and plain JavaScript forms
- ▸ WordPress contact, comment, login and registration flows
- ▸ Node.js, Go, Python, PHP and serverless API endpoints
- ▸ Contact, waitlist, password reset and support forms
- ▸ Login, registration, checkout and other multi-step workflows
Replace reCAPTCHA without weakening the backend
A migration is more than changing a script tag. The old client token, backend verification endpoint, environment variables, error mapping and monitoring all need to be replaced together. NexaForge maps the current behavior first, switches the validation path and keeps a rollback route during the release.
The final check confirms that direct API calls without a valid Turnstile result are rejected, not merely hidden behind a disabled button.
- ▸ Inventory every protected form and backend endpoint
- ▸ Separate production and staging site keys
- ▸ Remove obsolete reCAPTCHA secrets after the cutover
- ▸ Verify CSP, caching and consent-manager interactions
- ▸ Test keyboard access, mobile layout and slow-network retries
Turnstile not working? Debug the full request path
Common failures include a hostname that is not allowed for the widget, a secret from the wrong environment, a token submitted after its five-minute lifetime, a token reused after a retry, or a backend that never forwards the token at all.
Troubleshooting follows the request from widget render to browser payload, application logs and the Siteverify response. That prevents random front-end changes from hiding a server-side failure.
- ▸ Widget or script does not render
- ▸ Siteverify returns invalid-input-response or timeout-or-duplicate
- ▸ Form succeeds in staging but fails on the production hostname
- ▸ React re-renders create duplicate widgets or stale state
- ▸ Caching, CSP or proxy behavior blocks the challenge request
Scope and pricing
A standard contact or lead form is usually $99–199. Login, registration, payment or several API endpoints usually range from $299–499 because more backend paths, abuse cases and release checks are involved.
The estimate assumes the form and backend already exist. Rebuilding the form, account system or payment flow is quoted separately. Cloudflare account charges and third-party plugin licenses are not included.
- ▸ Included: client integration, server validation, testing and handover notes
- ▸ Optional: reCAPTCHA migration, analytics events and multiple environments
- ▸ Not assumed: redesigning unrelated forms or guaranteeing all automated abuse stops