Protect your MyBB Forum with Cloudflare Turnstile

This plugin replaces traditional CAPTCHAs with Cloudflare Turnstile, a privacy-friendly solution that validates human visitors without intrusive puzzles or checkbox challenges. Unlike legacy systems (like reCAPTCHA), Turnstile uses non-intrusive browser validation and adaptive risk scoring to distinguish humans from bots reducing friction for legitimate users while maintaining robust security, and of course Turnstile is FREE

Login popup with fields for username, password, and a remember me option. Success message verified by Cloudflare.
  1. Enhanced User Experience:
    • No more “click the traffic lights” or distorted text challenges.
    • Most users pass verification automatically (especially with “Managed” or “Invisible” modes).
  2. Superior Bot Protection:
    • Leverages Cloudflare’s global threat intelligence to block sophisticated bots.
    • Adapts to emerging threats in real time without requiring updates.
  3. Privacy-Focused:
    • No data collection from users (GDPR/compliance-friendly).
    • No tracking or behavioral analysis (unlike some alternatives).
  4. Built-in Analytics:
    • Track CAPTCHA performance (impressions, failures) directly in your MyBB Admin CP.

Why Choose Turnstile?

Ideal for forums prioritizing both security and usability, Turnstile eliminates the trade-off between keeping bots out and letting users in.

Plugin Availability

This plugin is officially available through the MyBB Extend Portal. You can download it directly from there or from the Enterrahost website.

Prerequisites

  1. MyBB 1.8.x installed
  2. PHP with cURL support enabled
  3. Cloudflare account (free tier sufficient)

Obtaining Cloudflare Turnstile Keys

Step 1: Access Turnstile Dashboard

  1. Log in to your Cloudflare account
  2. Navigate to Turnstile under the Websites section
  3. Click “Add Site”

Step 2: Configure Your Site

  • Site name: Your forum name (e.g., “MyBB Forum”)
  • Domain: Your forum’s domain (e.g., forum.example.com)
  • Widget Type: Select one of three options:
    1. Managed (Recommended for most users)
    2. Non-interactive (No user interaction required)
    3. Invisible (Completely hidden challenge)
Cloudflare Turnstile settings page showing widget mode options, site key, and pre-clearance choice for security challenges.

Step 3: Get Your Keys

After setup, you’ll receive:

  • Site Key (Public)
  • Secret Key (Private)

Keep these keys secure – you’ll need them for plugin configuration.

Plugin Installation

Method 1: Via MyBB Extend

  1. Go to Admin CP > Plugins
  2. Click “Browse Plugins”
  3. Search for “Cloudflare Turnstile”
  4. Click “Install”

Method 2: Manual Installation

  1. Download the plugin ZIP file
  2. Upload contents to /inc/plugins/ directory
  3. Go to Admin CP > Plugins
  4. Find “Cloudflare Turnstile” and click “Activate”

Configuration

Basic Settings

  1. Navigate to Admin CP > Configuration > Settings > Cloudflare Turnstile
  2. Enter your Site Key and Secret Key
  3. Select theme preference:
    • Light
    • Dark
    • Auto (matches user’s system preference)
Screenshot of MyBB Cloudflare Turnstile settings page with fields for Site Key, Secret Key, and theme options.

CAPTCHA Activation

Enable Turnstile for:

  • User Registration
  • Login Page
  • Login Popup

Analytics Dashboard

The plugin provides comprehensive tracking accessible via:

  1. Admin CP > Tools > Statistics
  2. Scroll to “Cloudflare Turnstile Stats”

Metrics Tracked:

  • Impressions: How often CAPTCHA is displayed
  • Successes: Verified interactions
  • Failures: Rejected attempts
MyBB Cloudflare Turnstile statistics dashboard showing graphs for impressions, successes, and failures over 30 days.

Data Visualization

  • 30-day trend graph
  • 24-hour activity breakdown
  • Success/failure ratios

Troubleshooting

Common Issues

  1. CAPTCHA not appearing:
    • Verify keys are correct
    • Check if enabled for specific actions
    • Ensure no template conflicts
  2. Verification failures:
    • Confirm server time is synchronized
    • Check for JavaScript errors
    • Test with different widget types

Support

For additional assistance: