CloudflareTurnstile

3 hooks fired by CloudflareTurnstile: 3 filters and 0 actions across 3 call sites. 3 of the 3 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.

xpac_cloudflare_turnstile_allowed_hostnames

Filter · 1 argument · 1 call site

Filters the hostnames a successful siteverify verdict may name.

Cloudflare reports the host the widget was solved on, and the default set is this site's own two URLs, so a verdict solved anywhere else is refused. A site reachable at more than one host — an apex and a www, or a CDN or reverse proxy whose hostname differs from home_url() — has to name the others here. Without that every submission from the second host is refused as "verification_mismatch", and the only signal is a line in the error log.

Entries may be bare hostnames or full URLs; both are reduced to a lowercased host with any trailing dot stripped. An empty list refuses everything, which is the safe direction: this check fails closed, never open.

apply_filters( 'xpac_cloudflare_turnstile_allowed_hostnames', [home_url('/'), site_url('/')] )

• $hosts (string[]) — Hostnames or URLs whose tokens are accepted.

Fired from:

• packages/CloudflareTurnstile/Addon.php:1396

xpac_cloudflare_turnstile_request_timeout

Filter · 1 argument · 1 call site

Filters how long, in seconds, to wait for Cloudflare to verify a token.

This runs inside the visitor's submission, so the value is a latency budget rather than a tolerance: the visitor waits for it, twice if the first attempt fails, before the form can answer at all.

Clamped to 1-10 seconds. Raising it makes a slow Cloudflare feel like a slow form; lowering it makes a submission more likely to be refused for a network problem the visitor did not cause.

apply_filters( 'xpac_cloudflare_turnstile_request_timeout', self::REQUEST_TIMEOUT )

• $timeout (int) — Seconds to wait. Default 5.

Fired from:

• packages/CloudflareTurnstile/Addon.php:1307

xpac_forms_enable_verification

Filter · 3 arguments · 1 call site

Filters whether an anti-spam provider runs its check for this submission.

Evaluated only after the form's own toggle for the provider is already on, because the call is the right operand of a short-circuiting &&. Returning true therefore cannot switch on a check the form has turned off; returning false skips the token verification, leaving the validation result exactly as the preceding filters left it.

Each provider passes its own slug as the third argument, so a callback can disable one without touching the others. The slugs in use are "cloudflare-captcha" (this call site), "google-recaptcha" and "akismet". Forms' built-in Honeypot check never fires this filter and so cannot be disabled through it.

The Forms Auto Submit plugin is the working example, and it treats this provider differently from Akismet: a form auto-submitted from URL parameters has no browser to render a widget in and therefore no token, so that plugin returns false for "cloudflare-captcha" and "google-recaptcha" while deliberately leaving "akismet" running.

apply_filters( 'xpac_forms_enable_verification', true, $submission, 'cloudflare-captcha' )

• $enable (bool) — Whether to run the provider's check. Default true.
• $submission (Submission) — The submission being validated.
• $provider (string) — Slug of the provider asking. Always "cloudflare-captcha" here.

Fired from:

• packages/CloudflareTurnstile/Addon.php:1216