Cloudflare Turnstile
(for phpBB)
A phpBB 3.3.x extension that integrates Cloudflare Turnstile as a registration and login CAPTCHA provider, for modern bot protection.
Current Version:
1.1.4
( File Size: 35 KB )
Features
Registration and login protection are independent — enable either, both, or neither based on your needs.
- Registration Protection: Turnstile as a selectable CAPTCHA in ACP → Spambot countermeasures
- Login Protection: Optional Turnstile on login with three modes:
- Off
- Always require Turnstile
- After failed login threshold (uses phpBB’s built-in tracking)
- Widget Types: Visible or Invisible mode
- Fail-Safe Options: Configurable behaviour when Cloudflare API is unreachable or errors:
- Fail-closed: Block submission (secure, may deny legitimate users)
- Fail-open: Allow submission (may allow bots through)
- Logging: API errors logged to phpBB admin log
- Update Notifications: Automatic update checks with ACP notices and optional email alerts (since this is a security-focused extension, staying current matters)
- Multi-language Support: English, German, French, Spanish, and Italian
Requirements
- phpBB 3.3.0 or newer (up to 4.0.0)
- PHP 7.4.0 or newer
- Cloudflare account with Turnstile site key and secret key
Installing
- Extract the ZIP contents into your phpBB
ext/directory - Your folder structure should be:
ext/icecorp/turnstile/ - Go to ACP → Customise → Manage extensions
- Find Cloudflare Turnstile and click Enable
Configuring
Get Cloudflare Turnstile Keys
- Log into your Cloudflare Dashboard
- Go to Turnstile
- Add a new site or use an existing one
- Copy your Site Key and Secret Key
Configure the Extension
Via ACP → Customise → Extensions → Cloudflare Turnstile:
- Site Key: Your Cloudflare Turnstile site key
- Secret Key: Your Cloudflare Turnstile secret key (keep confidential)
- Widget Type: Visible (users see widget) or Invisible (runs in background)
- API Failure Behaviour: Fail closed (secure) or Fail open (available)
- Login Protection: Off / Always / After failed attempt threshold
- Enable Update Checking: Turn automatic version checks on/off (checks every 24 hours)
- Email Notifications: Send email to board admin when updates are available
Enable for Registration
- Go to ACP → General → Board configuration → Spambot countermeasures
- Select Cloudflare Turnstile as the spambot countermeasures plugin
- Click Submit
Updating
- Go to ACP → Customise → Manage extensions
- Disable Cloudflare Turnstile
- Delete the
ext/icecorp/turnstile/folder via FTP/File Manager - Extract the new ZIP contents into your phpBB
ext/directory - Your folder structure should be:
ext/icecorp/turnstile/ - Enable the extension
- Purge the cache
Uninstalling
Important: You must change the CAPTCHA setting before disabling the extension.
- Go to ACP → General → Board configuration → Spambot countermeasures
- Change the plugin to a different option (e.g., “No CAPTCHA” or “Q&A”)
- Click Submit
- Go to ACP → Customise → Manage extensions
- Click Disable for Cloudflare Turnstile
- Click Delete data to remove all extension data
- Delete the
ext/icecorp/turnstile/folder via FTP/File Manager
Troubleshooting
Locked out of login?
If you have Login Protection set to “Always” and API Failure Behaviour set to “Fail closed” (the default), you can get locked out if your Turnstile keys become invalid or Cloudflare’s API is unreachable.
To recover, run one of these SQL queries via phpMyAdmin or command line:
Disable login protection:
UPDATE phpbb_config SET config_value = '0' WHERE config_name = 'icecorp_turnstile_login_mode';
Or switch to fail-open mode:
UPDATE phpbb_config SET config_value = '1' WHERE config_name = 'icecorp_turnstile_fail_mode';
(Adjust phpbb_ prefix if your database uses a different table prefix.)
Support
phpBB.com Extensions in Development: [3.3][BETA] Cloudflare Turnstile
Changelog available in above phpBB.com link.
Feel free to reach out with feedback and questions using the form below.