New: Widget now auto-aligns with the form’s submit button by default (left/right/center-aware, with padding) — can be disabled in settings.
New: Floating “Protected by Cloudflare Turnstile” badge, site-wide, with configurable bottom-left/bottom-right position (off by default).
New: Support for protecting Elementor pop-up forms, with a separate toggle from standard (non-pop-up) Elementor forms. Pop-up form protection did not exist in 1.0.0.
Fix: Turnstile widgets inside Elementor pop-up forms could be rendered while the pop-up was still hidden and permanently marked as already-rendered, so the widget never visually appeared even after the pop-up was opened. The widget now waits until the pop-up is actually visible before rendering.
Fix: The widget was not reliably positioned on the opposite side of the form’s submit button (e.g. it did not stay left-aligned when the button was right-aligned), because the alignment styling only affected the widget’s own internal contents rather than its position relative to the button. The widget now correctly seats on the opposite side of the button.
Fix: The bundled minified frontend script was a stale build that was missing recent event logic used to re-run button alignment after a widget renders dynamically (e.g. inside an AJAX-loaded pop-up). The minified build has been refreshed to match the current source.
Tweak: Added trademark attribution notice to the settings page.
Tweak: Renamed the settings page header to “Empex Cloudflare Turnstile for WordPress” for clarity.
1.0.0
Initial release
Core WordPress form protection: Login, Registration, Password Reset, Comments
WooCommerce integration: Classic Checkout, Blocks Checkout, Account forms
Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Elementor Pro support
MemberPress, Ultimate Member, Paid Memberships Pro, BuddyPress, wpDiscuz support
Easy Digital Downloads, Formidable, Forminator, Kadence, SureForms, Jetpack Forms
Ninja Forms, Everest Forms, JetFormBuilder, weForms, Empex Form Builder support
Admin settings with first-run onboarding wizard
Clean widget fit on narrow login/register/lost-password forms (standard widget seated inside the login card)
Token replay prevention with SHA-256 transients
Rate limiting (configurable per IP) including failed attempts
