Simple CAPTCHA with Cloudflare Turnstile

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1153 searches this plugin appeared in over the last 90 days, 20 listed. 1070 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 3 months ago; a band this size takes about a year or more to cross, which places it about 25% of the way through.

At the current install trend, crossing 300K+ in roughly 121 days.

1. ★★★★★ Mobile PC Rescue

   4mo ago

   Turnstile is a great way of adding more protection to your website., thanks for this CloudFlare, I love it 🙂

   Read on wp.org ↗
2. ★★★★★ Miracle Matthew

   4mo ago

   This plugin is leagues ahead of other Turnstile, reCAPTCHA, and native CAPTCHA solutions. It is simple to use, highly effective, and quite simply the best option currently available.

   Read on wp.org ↗
3. ★★★★★ WebHostPro

   5mo ago

   A lot of security apps make it sound like there are a million different ways hackers get into WordPress. Most of the time, they are just trying to log in with credentials they found somewhere else. This blocks repeated login attempts, suspicious activity, and fake location tricks without slowing the site down. It is my #1 WordPress security app because it works, stays lightweight, and keeps things simple. This topic was modified 1 month ago by WebHostPro. Reason: typo

   Read on wp.org ↗
4. ★★★★★ wyverndryke

   5mo ago

   This plugin works really well with WordPress 7.0. Thank you sincerely for building it. I was stressed out because the official Cloudflare plugin didn’t seem to work right with my build, but yours works great! I’m giving you five stars, because it functions well. 🙂 Here are two tiny ways to improve. With Jetpack forms…* The “custom messages” (under Advanced Settings) do not seem to appear* The “disable submit button” function never actually enables the submit button after Cloudflare sends approval. Thanks again! I love this plugin.

   Read on wp.org ↗
5. ★★★★★ Navone Juan

   5mo ago

   Facil de usar, de configurar e integrar al sitio. Recomendado

   Read on wp.org ↗
6. ★★★★★ Shashank V.

   5mo ago

   a good plugin

   Read on wp.org ↗
7. ★★★★★ unionwebguy

   5mo ago

   This really shouldn’t be necessary to get Turnstile on Elementor forms but here we are! Fantastic plugin quick and easy setup.

   Read on wp.org ↗
8. ★★★★★ Ed Bernd Jr.

   5mo ago

   Every day dozens of fake purchases were being placed for inexpensive products on our website. They all would up Pending / Awaiting Payment, and I had to delete them all. This plugin stopped them cold. Very easy to implement and works like a charm. Thanks Elliot for another great plugin. Ed

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.41.1 Tweak: Added a view button to show the secret key in the settings page, which is hidden by default. Tweak: Made a few small changes to the settings page. Tweak: On the Ultimate Member login form, added a check to prevent 1.41.1
2. — Version 1.41.0 New: Added a new “Analytics” option which when enabled will start tracking some basic analytics data for Turnstile form submissions. This includes the number of successful and failed submissions, and the reasons for any 1.41.0
3. — Version 1.40.0 New: Added an option to enable Turnstile on the WooCommerce Account Details form. Tweak: Added a warning message to the “Logged In Users” whitelist option. Tweak: Added an additional check to prevent the Turnstile widget 1.40.0
4. — Version 1.39.1 Fix: Fixed a potential issue with the Turnstile check on login forms failing in certain cases when it runs multiple checks in the same request. 1.39.1
5. — Version 1.39.0 New: Added integration for the “SureForms” plugin. New: Added integration for the “Sunshine Photo Cart” plugin ( #70 ). Tweak: Adjusted the “Widget Label Text” alignment in some cases so it always shows above the widget. 1.39.0
6. — Version 1.38.4 Fix: Fixed Turnstile verification failures on WooCommerce checkout caused by payment gateway plugins (e.g. PayPal Commerce, Amazon Pay, Mollie) consuming the single-use token during pre-checkout AJAX validation requests. 1.38.4

All 6 disclosed vulnerabilities are patched in the current version (1.44.4). Sites still on an older version should update.

1. Patched Medium · 6.5 Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-09-09 CVE-2026-85116 Improper Control of Generation of Code Affects <= 1.42.1 Patched in 1.42.3
2. Patched Medium · 6.1 Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-09-08 CVE-2026-66632 Improper Control of Generation of Code Affects <= 1.42.1 Patched in 1.42.3
3. Patched Medium · 5.3 Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Captcha Bypass ↗
   2026-09-08 CVE-2026-66674 Guessable CAPTCHA Affects <= 1.42.1 Patched in 1.42.3
4. Patched Medium · 5.3 Simple CAPTCHA with Cloudflare Turnstile <= 1.41.0 - Unauthenticated CAPTCHA Bypass ↗
   2026-08-03 CVE-2026-15239 Guessable CAPTCHA Affects <= 1.41.0 Patched in 1.42.0
5. Patched Medium · 5.3 Simple CAPTCHA Alternative with Cloudflare Turnstile <= 1.38.0 - Broken Authorization ↗
   2026-05-08 CVE-2026-40799 Improper Authorization Affects <= 1.38.0 Patched in 1.38.1
6. Patched Medium · 6.4 Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2023-09-22 CVE-2023-5135 Improper Neutralization of Input During Web Page Generation Affects <= 1.23.1 Patched in 1.23.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 27 languages, 10 at 90% or more

Plus 3 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-30 100K+ → 200K+ up after 364 days in tier
2. 2025-07-31 90K+ → 100K+ up after 52 days in tier
3. 2025-06-09 80K+ → 90K+ up after 47 days in tier
4. 2025-04-23 70K+ → 80K+ up after 46 days in tier
5. 2025-03-08 60K+ → 70K+ up after 72 days in tier
6. 2024-12-26 50K+ → 60K+ up after 126 days in tier
7. 2024-08-22 40K+ → 50K+ up after 113 days in tier
8. 2024-05-01 30K+ → 40K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Simple CAPTCHA with Cloudflare Turnstile into a readme, a review or a deck. It updates itself.

Simple CAPTCHA with Cloudflare Turnstile: 200K+ active installs, 4.7★ (262 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/simple-cloudflare-turnstile