About this plugin
Protect your Divi-powered WordPress site with Cloudflare Turnstile.
Tech Dragon Divi Turnstile Nexus brings Turnstile protection to supported Divi forms, WordPress account and comment workflows, and WooCommerce customer and checkout flows. Instead of treating every visual form or Divi module as a separate transaction, Nexus integrates with the platform that actually processes the submission.
The Free edition includes the protection integrations. You do not need Pro to protect supported forms or enable server-side Turnstile verification. Pro adds centralized visibility, verification statistics, and precise management controls for sites with more forms and protection surfaces to oversee.
Protection included in Free
Native Divi 4 and Divi 5 integration
- Divi Contact Form.
- Divi Email Optin using a supported server-side provider path.
- Turnstile enablement for individual supported Divi forms through Divi’s Spam Protection settings.
- Form-specific widget and token handling that preserves Divi’s native submission, validation, and feedback behavior.
WordPress protection
- Login.
- Registration.
- Lost-password requests.
- Interactive comments, including supported Divi Comments presentations.
WooCommerce protection
- Customer login, registration, and lost-password requests.
- Product reviews, including supported Divi Woo review presentations.
- Classic Checkout and Checkout Block / Store API checkout.
- Supported Divi Woo checkout layouts inherit the WooCommerce Checkout protection surface rather than adding separate checks for each layout module.
Global settings and site-wide protection
- Configure and verify Cloudflare Turnstile credentials in one place.
- Enable Core Protection for supported WordPress and WooCommerce transactions.
- If WooCommerce is installed or reactivated later, explicitly enable its protection in Nexus Control Center.
- Choose global widget theme, size, and language settings.
- Control optional, conditional Cloudflare preconnect.
- Access basic compatibility information and redacted support diagnostics.
Existing Divi Contact Form and Email Optin modules remain individually configured in Divi. The global Core Protection setting does not override their per-form selections.
Why use Nexus?
- Server-side verification: Cloudflare Siteverify validates submitted tokens before the supported transaction is accepted.
- Native submission ownership: WordPress, WooCommerce, and Divi continue to handle their own account, checkout, form, and feedback lifecycles.
- Form and surface isolation: A token for one protected form or transaction cannot simply be claimed by another.
- Fail-closed behavior: Missing, invalid, expired, reused, or mismatched tokens are rejected for protected transactions.
- Careful privacy defaults: Nexus does not send the visitor’s IP address in the optional Siteverify remoteip field, and does not collect submitted form content for verification statistics.
- No duplicate protection engines: Supported Divi Login, Comments, and WooCommerce presentation modules inherit the underlying WordPress or WooCommerce transaction protection.
Go further with Nexus Pro
Nexus Pro is for administrators managing protection across multiple forms and site workflows. It adds a centralized Protection Surfaces management experience while using the same Core protection integrations as Free.
- Discover supported Divi forms and view their protection status and locations.
- Review WordPress and WooCommerce protection surfaces in one place.
- Search, filter, and sort supported forms and surfaces.
- Apply supported per-surface protection settings and presentation overrides.
- Enable or disable selected eligible forms and surfaces through centralized and bulk controls.
- Identify items that need attention without making unsafe changes to ambiguous forms.
- See successful Turnstile verification counts and reset counters when needed.
A Turnstile verification is a protected submission attempt for which Cloudflare’s server-side verification succeeded. It is not a count of completed checkouts, emails delivered, leads, blocked bots, or conversions.
Pro is a separately offered paid edition. Free remains functional without a Pro license, including its supported protection integrations.
dev/.
Compatibility and important boundaries
- Supported Divi versions: Divi 4.27.4 or later in the Divi 4 series, and native Divi 5.x. Divi 4 modules embedded in Divi 5 are not the supported native Divi 5 integration path.
- Divi Email Optin protection requires a supported server-side provider flow. Browser-only FeedBurner submissions are not protected.
- WooCommerce Checkout protection covers the supported classic and Checkout Block / Store API transaction paths. A third-party express wallet or payment method that bypasses those authoritative checkout paths is not automatically protected.
- Payment callbacks, redirects, webhooks, and separate 3D Secure steps are not challenged as new checkouts after the authoritative checkout submission.
- A compatible custom login URL can work when it preserves WordPress’s native login lifecycle. Independent passwordless or magic-link login systems and separate second-factor screens are not automatically covered.
- WooCommerce Pay for Order, account-profile editing, Add to Cart, cart updates, coupon actions, and shipping calculators are not protected surfaces in this release.
- Arbitrary Contact Form 7, Gravity Forms, or other third-party form submissions are not automatically protected because they appear in a Divi layout.
- Nexus protects supported interactive comment and review submissions, not arbitrary REST/XML-RPC comment creation enabled through custom code or third-party plugins.
Site owners should test their live form, account, payment gateway, optimization, and caching configurations before relying on protection in production.
External service and privacy
This plugin uses Cloudflare Turnstile, an external anti-bot service provided by Cloudflare, Inc. A Cloudflare Turnstile site key and secret key are required. Cloudflare’s own service terms and privacy documentation apply.
com. Cloudflare may process browser, network, and device signals, including IP-related information, as described in its own policies.
com/turnstile/v0/siteverify. Nexus does not add the visitor’s IP address through the optional remoteip parameter or send submitted form fields to Siteverify.
The built-in credential verification test also uses Cloudflare Turnstile.
- Turnstile documentation: https://developers.cloudflare.com/turnstile/
- Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
- Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
- Cloudflare website terms: https://www.cloudflare.com/website-terms/
Freemius: optional connection, updates, and licensing
, for optional account connection, product updates and notifications, upgrades, and management of paid licenses. Free users see an optional Freemius connection screen and can select Skip without sharing their information with Freemius. The supported Free protection features remain available if they skip.
If a site administrator opts in, Freemius may receive that administrator’s name and email address, website URL, plugin version and activation status, WordPress and PHP versions, site language, and optionally the site’s installed plugins and themes, according to the permissions selected. Freemius uses this information to provide the connected service, product communications, compatibility information, and related account functions.
Paid purchases and Pro license activation use Freemius for payment, account and licensing services. Those transactions involve additional purchase, account and billing information under Freemius’s terms. The Free opt-in and skip options are distinct from paid license activation.
- Freemius data practices: https://freemius.com/privacy/data-practices/
- Freemius terms of service: https://freemius.com/terms/
Tech Dragon Divi Turnstile Nexus is an independent third-party plugin. It is not affiliated with or endorsed by Elegant Themes or Cloudflare.