How to Use Cloudflare Turnstile Together with a Contact Form 7 Confirmation Screen | No Conflicts, Fully Compatible

You want to add Cloudflare Turnstile to Contact Form 7 (CF7) for spam protection, while also adding a confirmation screen or multi-step flow to improve the UX. Many people hesitate to adopt this combination, worried that putting both into the same form will cause them to interfere with each other.

The short answer is: Turnstile and the confirmation screen / multi-step flow can be used together. This article explains why they’re compatible, shares the results of hands-on testing, and covers the setup pitfalls to watch out for.

Why It Feels Risky to Combine Them

Confirmation screens and multi-step flows insert a confirmation step or additional page transitions into Contact Form 7’s standard one-step “input → submit” flow. Turnstile, on the other hand, inserts a check for “are you human?” at submission time. Because both features insert processing around the submission, it’s easy to intuitively worry that they’ll compete for the same spot and break each other.

In practice, the two operate at different layers. The confirmation screen and multi-step flow handle screen transitions and data handoff, while Turnstile works as a single check within Contact Form 7’s validation chain. Because they operate at different layers, they don’t conflict as long as they’re set up correctly.

We Tested This on a Real Setup

Since “it should work in theory” isn’t enough to put minds at ease, we combined the two in a local environment and checked the actual behavior.

Here’s the setup we tested:

• Installed a Cloudflare Turnstile integration plugin on Contact Form 7
• Configured the confirmation screen and multi-step flow from the free version of Frontierline Forms on the same form
• Set up Turnstile using Cloudflare’s official test keys (verification keys that always pass)

Here are the test results:

• Single step + confirmation screen + Turnstile: The flow proceeded correctly from input to confirmation to submission to completion, and the submitted data was saved
• 4-step multi-step form + confirmation screen + Turnstile: Each step transitioned correctly and the final submission completed successfully
• Case where the honeypot was deliberately triggered: The submission was correctly blocked as fraudulent, and no data was saved

In none of these configurations did the presence of Turnstile break the confirmation screen or multi-step transitions.

• Note: the keys used here were Cloudflare’s official test keys. Because test keys always return a “pass” result, this test only confirms whether the flow runs through to the end without breaking — it does not measure how effectively Turnstile blocks actual spam (its protective strength). Please verify real-world blocking performance using your production site keys in your own environment.

A Common Pitfall: Nothing Is Inserted Until the Response Test Is Complete

The thing that tripped us up the most during testing was the behavior of the Turnstile integration plugin. Simply saving the site key and secret key isn’t enough for Turnstile to be inserted into the form. Until you complete the “response test” on the settings screen, the integration file itself isn’t loaded, and shortcodes like [cf7-simple-turnstile] remain on the form as literal text.

If you see the shortcode displayed as-is, or the widget doesn’t appear, run the response test on the settings screen after saving your keys. This makes it get inserted into the form correctly. The exact name varies depending on the integration plugin you use, but the extra step of testing and activating after registering your keys is common across these plugins.

Where to Place the Turnstile Widget

The Turnstile shortcode is easiest to manage when placed right before the submit button ([submit]).

In a multi-step form, placing it here means Turnstile appears within the final confirmation step. This creates a natural flow where the user checks their input and then passes verification right before submitting. For how to build the confirmation screen itself, see How to Add a Confirmation Screen to Contact Form 7; for splitting a form into multiple steps, see How to Build a Multi-Step Form with Contact Form 7.

Breaking Down the Spam-Protection Layers

When used together, spam protection runs in two separate layers in parallel:

• Turnstile: Joins Contact Form 7’s validation chain and checks whether the submitter is human at submission time
• The confirmation screen plugin’s honeypot: A layer built into the free version of Frontierline Forms that catches auto-filling bots

If either of these flags a submission as invalid, it stops the submission — so together they function as layered defense. The free version of Frontierline Forms uses a honeypot for spam protection, which operates at a different layer than Turnstile, so they don’t compete. In our testing too, with both enabled, only legitimate submissions were saved and fraudulent submissions were blocked.

Note that stronger spam protection (server-side measures such as rate limiting and keyword filtering) is available in the paid tier, but the testing in this article covers using the free version’s honeypot together with Turnstile.

Summary

You can use Turnstile together with a confirmation screen and multi-step flow in Contact Form 7. The two operate at different layers, and placing Turnstile right before the submit button lets it fit naturally within the confirmation step. When setting it up, keep in mind that simply saving your keys won’t insert the widget — it only becomes active once you complete the response test.

For more detailed setup steps for the confirmation-screen flow and the completion screen, see the documentation on Confirmation and Completion Screen Settings. If you’re migrating from add_confirm, see An Alternative When Contact Form 7’s add_confirm No Longer Works. If you’d like to discuss form implementation or spam-protection design, get help on WordPress.org.

Frequently Asked Questions

Q. Can Turnstile and the confirmation screen really be used at the same time?

Yes. Turnstile is a layer that adds verification at submission time, while the confirmation screen is a feature that handles screen transitions — their roles don’t overlap. We’ve confirmed on real setups that submissions complete successfully with Turnstile in place, both in a single-step form with a confirmation screen and in a 4-step multi-step form.

Q. The shortcode is displaying as plain text.

If you haven’t completed the “response test” after saving your site key and secret key in the Turnstile integration plugin, the integration file won’t load and the shortcode will remain as plain text. Running the response test on the settings screen will get it inserted into the form correctly.

Q. Doesn’t Turnstile conflict with the plugin’s spam protection?

No, they don’t conflict. The free version of Frontierline Forms uses a honeypot for spam protection, which operates at a different layer than Turnstile. If either one flags a submission as invalid, it stops the submission, so the two work in parallel as a layered defense.

Q. Are the confirmation screen and multi-step flow free to use?

Yes. The free version lets you use the confirmation screen, multi-step flow, and database storage of submission logs without any limits. There’s no need to rebuild your existing Contact Form 7 forms.