Do I need CheckoutWC Pro or Agency for native Turnstile support?
Yes. CheckoutWC’s Turnstile integration is available on Pro and Agency plans. If you’re on Basic, you can use a Turnstile plugin, but upgrading gives you the simplest, best-tested experience.
Is the Cloudflare Turnstile service free for WooCommerce?
Yes. Turnstile is completely free with no usage limits. You don’t need a paid Cloudflare plan to use it, though paid plans offer additional security features that complement Turnstile protection.
Where should I place the Turnstile widget on checkout?
Use Before Place Order Button. It verifies right before submission and strikes the best balance between security and conversion. Other positions are available, but they tend to add friction earlier in the flow.
Will Turnstile slow down my checkout?
No. CheckoutWC loads the widget asynchronously, so it doesn’t block rendering. For mobile, consider Compact size and Auto theme to match user preferences.
Can I show Turnstile only to guests?
Yes. Enable Guest Users Only to hide Turnstile for logged-in customers. This reduces friction for returning buyers while still protecting against anonymous bots.
Can I protect more than checkout (e.g., login, registration, order-pay)?
Yes. In Location Settings, toggle Turnstile for Checkout, Order Pay, Login, and Registration. Protecting login and registration helps cut account takeover attempts and spam signups.
Turnstile isn’t appearing, what should I check first?
- Confirm you’re on CheckoutWC Pro or Agency.
- Verify Turnstile is enabled in CheckoutWC and that your Site Key and Secret Key are correct.
- Make sure your domain is added in Cloudflare Turnstile.
- Clear any page and CDN cache.
- Temporarily disable other CAPTCHA plugins to avoid conflicts.
I see a conflict warning with another CAPTCHA plugin. What now?
Either disable the other CAPTCHA or exclude overlapping pages such as checkout, login, and registration so only one tool runs. Running two CAPTCHAs frustrates users and can block orders.
Does Turnstile work without Cloudflare’s CDN?
Yes. You can implement Turnstile on any WooCommerce store regardless of your hosting setup or CDN provider. You just need a free Cloudflare account to generate the API keys.
Will Turnstile break Apple Pay or Google Pay?
Not with proper implementation. CheckoutWC’s native integration is tested with all express payment methods. If you use a plugin, test express payments thoroughly because some implementations may interfere with these flows.
Should I disable guest checkout to stop WooCommerce spam orders?
No. Disabling guest checkout harms conversion rates. Use Turnstile and other protection layers instead to stop bots without forcing account creation.
Cloudflare Turnstile vs reCAPTCHA for WooCommerce: which is better?
Turnstile generally wins on user experience and privacy. Most legitimate customers never see a challenge, mobile experience is smoother, and no personal data is sent to third parties for behavioral analysis. reCAPTCHA tends to create more friction and abandonment.
What if the bot uses different IPs for every attempt?
IP-based blocking alone isn’t enough. Turnstile analyzes browser behavior and interaction patterns that are much harder for bots to fake, even when using rotating IP addresses.
