Turnstile on WordPress Comment Form

Resolved huppbrian
(@huppbrian)

1 year ago
I recently put my website – https://huppbrian.us – onto Cloudflare and implemented Turnstile CAPTCHA on all the website forms in the AIOS plugin Brute Force settings. I have been running AIOS on the site for years, and also have the Litespeed caching plugin running. It took a little tweaking to make all of these things play nicely together that I won’t go into here.

All of the CAPTCHAs worked fine except the WordPress comment form. Although I had enabled the Turnstile CAPTCHA on all the WordPress forms in the AIOS Brute Force tab, the Turnstile widget never showed up on the comment form. If I tried to enter a comment, I received the following:

Error: You entered an incorrect CAPTCHA answer, please go back and try again.

I thought the issue might be with Litespeed so I tried making an exception to caching the comment form PHP in the Litespeed settings, as I had previously done with the login form. That didn’t work, so I temporarily deactivated Litespeed. That didn’t help either.

After messing with the issue for a little while, I finally ended up disabling the CAPTCHA on all the forms in the AIOS settings and installed the Simple Cloudflare Turnstile plugin from Elliot Sowersby / RelyWP. I enabled the Turnstile CAPTCHA on all my forms (including my Forminator contact form) in the settings of the Simple Cloudflare Turnstile plugin, and all the CAPTCHAs are now working fine.

Note – If you visit the site, you won’t see the CAPTCHA widget anywhere. That’s because after I got everything working, I set the widget visibility setting to “Interactive only” so the widget will only show up if Turnstile decides to ask for a response from the visitor.

So I don’t need any help with this issue because I have a viable workaround. But I thought it might be helpful to create a support topic so that the AIOS team is aware of the issue, and other AIOS users who might encounter it will be aware of my experience so they can implement the same workaround if desired.
- This topic was modified 1 year ago by huppbrian.
The page I need help with: [log in to see the link]

Viewing 11 replies - 1 through 11 (of 11 total)

Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

1 year ago

Hi @huppbrian,

Thanks for raising the issue. I will create an internal ticket, as the Turnstile CAPTCHA doesn’t seem to be working on the comment form.

It’s not a general issue. I’ve just checked one of the live sites, and the comment form is displaying the Turnstile CAPTCHA.

https://snipboard.io/lDoTV6.jpg

Do you know if it shows any JavaScript error?

Regards

Thread Starter huppbrian
(@huppbrian)

1 year ago

Sorry, I don’t know whether there were any Javascript errors, and since I have the workaround in place, I’m reticent to “re-break” the site to find that answer. In retrospect, I suppose I could have turned on the AIOS debug logging before implementing the workaround, but I didn’t. I want to help any way I can. I suppose I could temporarily deactivate the workaround plugin and re-enable the CAPTCHAs in AIOS.

It might be helpful to know that before I put the site on Turnstile I was using the AIOS built-in arithmetic problem CAPTCHA on all my forms including the comment form and that was working fine.

Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

1 year ago

Hi @huppbrian,

If you could temporarily deactivate the workaround plugin and re-enable the CAPTCHAs in AIOS and check if there is any JavaScript error it will be good.

Ok, if maths captcha was working fine, then turnstile captcha should also work.

Regards

Thread Starter huppbrian
(@huppbrian)

1 year ago

Sorry to ask such a dumb question, but how do I check for Javascript errors?

Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

1 year ago

Hi @huppbrian

Dev Tools > Console tab in the Browser shows the JavaScript error, if any.

https://snipboard.io/eyl0rt.jpg

Regards
Thread Starter huppbrian
(@huppbrian)

1 year ago
Sorry it took so long.

I get a 500 error. Here’s the info from the log. I don’t know whether it makes a difference, but notice I’m using Firefox. I get the same issue with Edge.
```
POST
https://huppbrian.us/wp-comments-post.php
[HTTP/2 500 635ms]

POST
https://huppbrian.us/wp-comments-post.php
Status
500
VersionHTTP/2
Transferred3.41 kB (2.53 kB size)
Referrer Policystrict-origin-when-cross-origin
Request PriorityHighest
DNS ResolutionDNS over HTTPS

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-cache-status
DYNAMIC
cf-ray
94a4c72aacfbbcfd-ATL
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Wed, 04 Jun 2025 04:44:58 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
panel
hpanel
platform
hostinger
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=FYhslCvdaXmxv8OqJz1y6GFbaMkw8E%2Bo4kSrPN54su1YwmV34BFmjnJtXRVtA6mSWCWEt4qM4wniNiIWGHkydlotaDYwp8PQKazVlA%3D%3D"}]}
server
cloudflare
vary
Accept-Encoding
x-dns-prefetch-control
on
X-Firefox-Spdy
h2
x-litespeed-cache-control
no-cache
x-litespeed-tag
194_HTTP.500
x-powered-by
PHP/8.2.27
x-turbo-charged-by
LiteSpeed

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Encoding
gzip, deflate, br, zstd
Accept-Language
en-US,en;q=0.5
Cache-Control
no-cache
Connection
keep-alive
Content-Length
238
Content-Type
application/x-www-form-urlencoded
Cookie
_lscache_vary=6a32618bcfd576c6fc3205206ae4733b; cookielawinfo-checkbox-necessary=yes; litespeed_qc_hide_banner=1748548414; t1xolzkv=er2romvcy353; jyd01qrc=s0ig3k7exc40; qngnwu9p=qw1f9lk3s6pd; 3k2yvav0=eo07akcexgzl; wordpress_test_cookie=WP%20Cookie%20check; PHPSESSID=ihi70o98vt8703vlvbff982dse; session_id=cad981ddef2de3228e9442c853ea087a; email_id=tsc%40huppbrian.us
Host
huppbrian.us
Origin
https://huppbrian.us
Pragma
no-cache
Priority
u=0, i
Referer
https://huppbrian.us/bible-study/genesis-291-3024-jacobs-wives-children/
Sec-Fetch-Dest
document
Sec-Fetch-Mode
navigate
Sec-Fetch-Site
same-origin
Sec-Fetch-User
?1
Sec-GPC
1
TE
trailers
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
```
Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

1 year ago
Hi @huppbrian

It seems the Cloudflare captcha call returns a 500 error due to some issue.

They have a report URL seems but if I open it shows a 405 error code.
```
https://a.nel.cloudflare.com/report/v4?s=FYhslCvdaXmxv8OqJz1y6GFbaMkw8E%2Bo4kSrPN54su1YwmV34BFmjnJtXRVtA6mSWCWEt4qM4wniNiIWGHkydlotaDYwp8PQKazVlA%3D%3D"
```
You should contact the hosting provider first for this issue.
Thread Starter huppbrian
(@huppbrian)

1 year ago

Well like I said in the initial post, I have a satisfactory workaround that meets my needs. The only reason I opened up the string in the first place is to raise the flag in case someone else has a similar issue. So I’m not planning to pursue it any further.

Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

1 year ago

Hi @huppbrian,

Ok.

Regards

Gary
(@barnettgs)

1 year ago

I had exactly the same issue with this when I got the Contact Form 7 error while trying to submit all forms.

At first, I thought it was down to an incorrect field or form on the contact form. In the end, it turns out to be AIOS’s Turnstile causing this issue so I resolved it by installing the Simple Cloudflare Turnstile plugin and turning off Turnstile in AIOS.

Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

1 year ago

Hi @barnettgs,

Thank you for bringing this issue to our attention. I will update the internal ticket accordingly so that our team can investigate and address it.

Regards

Viewing 11 replies - 1 through 11 (of 11 total)

The topic ‘Turnstile on WordPress Comment Form’ is closed to new replies.