CloudFlare Turnstile WHMCS

MayaCraft Turnstile for WHMCS

Stop bots, fake sign-ups, password guessing and card testing – without picture puzzles for your real customers.

WHY Bots hit every WHMCS: fake accounts, logins with stolen passwords, fraud orders that test stolen cards on your payment gateway. Cloudflare Turnstile tells humans and bots apart without making anybody click traffic lights. This addon puts it on the WHMCS forms that matter and, most importantly, checks it on the server before WHMCS does anything.

FEATURES

• 7 forms: client login, registration, checkout (new orders), password reset, contact form, new support tickets and domain search. Turn each one on or off.
• Server-side check: a form sent without a valid token is stopped before WHMCS logs anybody in, creates an account or places an order. Bots that post straight to WHMCS are stopped too.
• No reused tokens: every token is checked once, for its own form and the visitor's IP.
• Pick it as Captcha Type: adds "Cloudflare Turnstile" to the Captcha Type list in General Settings → Security. Paste the keys, tick the forms, save. WHMCS' own captcha switches off by itself.
• Friendly for real people: the check sits right above the submit button, the button waits until it is done and says why, and if something fails the visitor sees a clear message with their fields filled in again (never passwords or card data).
• Fits any theme: finds the right form by itself, dark themes get the dark widget, works on phones.
• 30+ languages: follows the client's WHMCS language. Messages included in English and Romanian.
• Statistics: passed and stopped attempts per form for 30 days, the latest stopped attempts with the reason, and a one-click check of your secret key.
• Your rules: skip logged-in clients, never check your own IPs, and choose what happens if your server can't reach Cloudflare.

REQUIREMENTS

• WHMCS 8.x
• PHP 7.4 – 8.3 with cURL
• A free Cloudflare account for the Turnstile keys (your site does not need Cloudflare's proxy or DNS)

INSTALLATION (2 MINUTES)

1. Cloudflare dashboard → Turnstile → Add widget → add your WHMCS domain and copy the site key and secret key.
2. Upload the "modules" folder to your WHMCS folder.
3. System Settings → Addon Modules → MayaCraft Turnstile → Activate.
4. System Settings → General Settings → Security → Captcha Type → Cloudflare Turnstile (MayaCraft) → paste the keys, choose the forms, Save. Full instructions in English and Romanian are included.

CLEAN AND SAFE

• No changes to WHMCS core files or templates. A standard addon module that removes cleanly.
• The secret key never reaches the browser.
• Readable PHP, no encoding.

SUPPORT Questions or problems? Send us a message here and include your WHMCS version and theme.

Cloudflare and Turnstile are trademarks of Cloudflare, Inc. WHMCS is a trademark of WHMCS Limited. This addon is made by MayaCraft and is not affiliated with or endorsed by them.