Setting Up Cloudflare Turnstile

Cloudflare Turnstile is a free, privacy-friendly alternative to traditional CAPTCHAs. It helps protect your B2BKing registration and quote request forms from bots and spam without forcing your visitors to solve annoying puzzles.

This guide will walk you through enabling Cloudflare Turnstile in B2BKing and generating the required API keys from your Cloudflare account.

Step 1: Enable Cloudflare Turnstile in B2BKing #

In your WordPress dashboard, go to B2BKing → Settings → Other and scroll down to the Bot & Spam Protection section.

From the dropdown, select Cloudflare Turnstile.

You'll see two fields appear: Site Key and Secret Key. You'll need to get these from your Cloudflare account. Keep this tab open and follow the steps below.

Step 2: Generate Your API Keys in Cloudflare #

To get your Site Key and Secret Key, you'll need a free Cloudflare account. If you don't have one yet, you can sign up at dash.cloudflare.com.

Create a Turnstile Widget #

1. Log in to your Cloudflare dashboard.
2. In the left sidebar, click Turnstile (it can be founder under "Protect & Connect", or by using the "Quick search...").
3. Click the Add widget button.

Configure the Widget #

Widget name — Enter a name to help you identify this widget (e.g., "B2BKing Forms" or your site name). This is for your own reference only and won't be visible to your visitors.

Hostname Management — Click + Add Hostnames, then type your domain name (e.g., yoursite.com) and click Add. Once it appears in the list, confirm by clicking the Add button at the bottom of the panel.

You can add multiple domains here if you plan to use the same keys across different sites.

Widget Mode — Choose how the Turnstile challenge behaves. The available options are:

• Managed (recommended) — Cloudflare automatically decides whether to verify the user silently or show an interactive challenge, based on the visitor's browser signals.
• Non-interactive — A widget appears on the page, but Cloudflare runs the challenge automatically without requiring any action from the user.
• Invisible — The challenge runs entirely in the background with no visible widget.

For most stores, the default Managed mode works well.

Get Your Keys #

Once you've configured everything, click the Create button.

Cloudflare will generate your Site Key and Secret Key. Copy both of these values - you'll need them in the next step.

Step 3: Add the Keys to B2BKing #

Go back to the B2BKing settings tab you left open earlier (B2BKing → Settings → Other → Bot & Spam Protection).

Paste your Site Key and Secret Key into their respective fields, then save your settings.

That's it. Cloudflare Turnstile is now active and will protect your B2BKing forms from bots and spam.

Configuring Captcha Behavior #

Under captcha settings, you'll find a couple of additional options to fine-tune how it behaves on your site.

Skip captcha for logged-in users — Enable this to bypass the Turnstile challenge for logged-in customers. Recommended for most B2B stores.

Apply captcha to — Choose which forms Turnstile protects by toggling Quote Requests and Registration on or off individually.

What About the Login Form?

Turnstile is applied to the registration and quote request forms only. Login attempts without the correct password are already rejected by WordPress, so adding a CAPTCHA there provides little extra security for most sites. If you do experience brute force login attempts, we recommend setting up a Cloudflare managed challenge rule targeting your My Account page URL. This blocks bots at the edge before they even reach your server, which is more effective than a form-level CAPTCHA.

Troubleshooting #

If Turnstile doesn't appear to be working after setup, double-check the following:

• Make sure you've entered both the Site Key and Secret Key correctly, with no extra spaces.
• Verify that the domain you added in Cloudflare matches your actual website domain.
• Clear any caching plugins or CDN cache on your site, then try again.
• If you're using a staging or development domain, make sure that domain is also added under Hostname Management in Cloudflare.

For further help, feel free to reach out to B2BKing support.