WAIT: Cloudflare Turnstile in auto-mode

Hello everyone, I’m not sure if anyone has noticed. When Cloudflare Turnstile is enabled on one form, it affects all forms on the page, preventing users from interacting until Turnstile validates.

I asked ChatGPT if there might be an issue, and I got this:

Cloudflare Turnstile has two modes:

  1. Auto-render mode (default)
    Turnstile scans the DOM and attaches itself to every form unless properly scoped.
    If your page has:
    • more than one form, or
    • dynamic forms (AJAX, Bricks Forms, JetFormBuilder),
    Turnstile may try to validate all of them or block submission if the token is missing.
  2. Explicit render mode
    You manually call turnstile.render() only on the required container.
    This avoids any contamination of other forms.

Without ?render=explicit, Cloudflare will automatically hook into:
• all
• all Turnstile widgets
• hooks like onSubmit

That can block ALL forms from submitting unless they include a Turnstile token.

Am I the only one experiencing this behavior?

P.S.: It happens since the new Turnstile validation was implemented, so it is not due to today’s outage.

1 Like

Hi @MartinWB,

so just to be on the same page, to replicate this, I would need two forms on the page. Only one should have a turnstile, the other not.
And to replicate it, I should try to submit the first one (without turnstile) before the turnstile on the second one validates?

Matej

Yes that is correct…

I created a newsletter form in my footer with a turnstile. However, this slows down every page from loading, and lazy loading from bricks is lagging on slower networks. I’ve switched to Google reCAPTCHA for now, and the issues are resolved. I can also quickly manipulate forms without any problems. I hope you can replicate this and will try to find a fix for this issue.

Hi @MartinWB,

sorry for late response. I was testing this issue now and I can’t replicate it. I have two forms; in the first one, I’ve enabled Turnstile, and on second one, I didn’t.

I’ve entered the testing API keys for “failed” (Test your Turnstile implementation · Cloudflare Turnstile docs), so that validating for the first form always fails.

I was still able to submit the second one. Even before the validation results come back.

Not sure what I’m missing?
Matej