Fix: When an alignment class (Left/Right/Center/Auto) is active, the widget wrapper is a flex row, and the “please complete verification” message is appended as a sibling of the widget inside that same row. With no flex-wrap set, both items shrank to fit one line — crushing the message text into an unreadable vertical sliver and squeezing the widget along with it, most visible on the WordPress login card where the Normal-size widget leaves very little row space to begin with. The wrapper now wraps its flex children, and the message is given a full-width basis so it always drops to its own line beneath the widget instead of sharing space with it.
2.0.2
Fix: The widget wrapper had no width rule, so in flex-wrap form layouts (e.g. Elementor’s fields container) it shrank to the width of the Turnstile box itself instead of claiming its own row. This left room for the submit button to slot onto the same line, causing the widget and button to collide regardless of the Static Alignment setting or the button’s own position. The wrapper now always occupies the full width of its row, guaranteeing the button is pushed to its own line beneath it.
Change: Removed the separate “Auto-Alignment” toggle and the “None” Static Alignment option. Alignment is now a single “Alignment” setting with four choices — Left, Right, Center, or Auto (match submit button position) — since the collision the toggle used to prevent is now handled unconditionally by the layout fix above. Existing sites are migrated automatically: sites with Auto-Alignment on keep Auto; sites with it off keep their chosen side (or move from the retired “None” to “Left”).
2.0.1
New: “Static Alignment” setting (left/right/center) lets the widget be positioned deliberately with zero JavaScript when Auto-Alignment is disabled, rendered server-side.
Fix: When Auto-Alignment was disabled, the widget wrapper had no fallback horizontal spacing, so it could sit flush against the submit button in flex/inline form layouts. The wrapper now always keeps a minimum horizontal margin regardless of the Auto-Alignment setting.
Fix: Forms picked up by the Universal Form Engine (the generic JS-based scanner used for form markup not covered by a specific integration) never received any alignment class, so the new Static Alignment setting had no effect on them. The Universal Form Engine now applies the same alignment logic as the PHP-rendered widgets.
Fix: The left/right Static Alignment classes kept the base wrapper margin on the outer edge, leaving an unwanted gap between the widget and the form’s edge even when explicitly flush-aligned. The aligned classes now sit flush against their target edge.
Tweak: The Auto-Alignment script is no longer enqueued at all when Auto-Alignment is disabled in settings.
2.0.0
New: Widget now auto-aligns with the form’s submit button by default (left/right/center-aware, with padding) — can be disabled in settings.
New: Floating “Protected by Cloudflare Turnstile” badge, site-wide, with configurable bottom-left/bottom-right position (off by default).
New: Support for protecting Elementor pop-up forms, with a separate toggle from standard (non-pop-up) Elementor forms. Pop-up form protection did not exist in 1.0.0.
Fix: Turnstile widgets inside Elementor pop-up forms could be rendered while the pop-up was still hidden and permanently marked as already-rendered, so the widget never visually appeared even after the pop-up was opened. The widget now waits until the pop-up is actually visible before rendering.
Fix: The widget was not reliably positioned on the opposite side of the form’s submit button (e.g. it did not stay left-aligned when the button was right-aligned), because the alignment styling only affected the widget’s own internal contents rather than its position relative to the button. The widget now correctly seats on the opposite side of the button.
Fix: The bundled minified frontend script was a stale build that was missing recent event logic used to re-run button alignment after a widget renders dynamically (e.g. inside an AJAX-loaded pop-up). The minified build has been refreshed to match the current source.
Tweak: Added trademark attribution notice to the settings page.
Tweak: Renamed the settings page header to “Empex Cloudflare Turnstile for WordPress” for clarity.
1.0.0
Initial release
Core WordPress form protection: Login, Registration, Password Reset, Comments
WooCommerce integration: Classic Checkout, Blocks Checkout, Account forms
Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Elementor Pro support
MemberPress, Ultimate Member, Paid Memberships Pro, BuddyPress, wpDiscuz support
Easy Digital Downloads, Formidable, Forminator, Kadence, SureForms, Jetpack Forms
Ninja Forms, Everest Forms, JetFormBuilder, weForms, Empex Form Builder support
Admin settings with first-run onboarding wizard
Clean widget fit on narrow login/register/lost-password forms (standard widget seated inside the login card)
Token replay prevention with SHA-256 transients
Rate limiting (configurable per IP) including failed attempts
