How to add Cloudflare Turnstile spam protection with Hatch
Turn on Cloudflare Turnstile for the WordPress sign-in page, comments and frontend forms in Hatch, and what happens if Cloudflare cannot be reached.
Last updated October 29, 2026
Cloudflare Turnstile checks that a visitor is human, usually without a puzzle. Hatch can use it on the WordPress sign-in page, the comment form and forms sent from your frontend. It is off until you add your keys.
Get your Turnstile keys
- In the Cloudflare dashboard, open Turnstile and add a site.
- Copy the site key and the secret key.
Enter the keys in Hatch
Open Hatch, Content and find the third-party keys section. Enter the keys once. The Security tab shows a Keys missing badge until you do.
Choose where to use it
On the Security tab, under Bot and spam protection:
- Protect the WordPress sign-in page adds a Turnstile check to the sign-in form.
- Protect the WordPress comment form adds it to the comment form built into WordPress. Most sites leave this off because comments are posted from the frontend, which you protect in the Content tab.
What data goes to Cloudflare
Your server sends the visitor’s Turnstile response token, their IP address when available, and your secret key to Cloudflare to verify. The visitor’s browser loads the Turnstile script from challenges.cloudflare.com on pages with a protected form. See Hatch privacy and third-party services.
If Cloudflare cannot be reached
Hatch lets the request through rather than locking visitors out, and shows an admin notice.