CloudflareTurnstile

2 hooks fired by CloudflareTurnstile: 2 filters and 0 actions across 2 call sites. 1 of the 2 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.

xpac_cloudflare_turnstile_request_timeout

Filter · 1 argument · 1 call site

apply_filters( 'xpac_cloudflare_turnstile_request_timeout', self::REQUEST_TIMEOUT )

Fired from:

• packages/CloudflareTurnstile/Addon.php:699

xpac_forms_enable_verification

Filter · 3 arguments · 1 call site

Filters whether an anti-spam provider runs its check for this submission.

Evaluated only after the form's own toggle for the provider is already on, because the call is the right operand of a short-circuiting &&. Returning true therefore cannot switch on a check the form has turned off; returning false skips the token verification, leaving the validation result exactly as the preceding filters left it.

Each provider passes its own slug as the third argument, so a callback can disable one without touching the others. The slugs in use are "cloudflare-captcha" (this call site), "google-recaptcha" and "akismet". Forms' built-in Honeypot check never fires this filter and so cannot be disabled through it.

The Forms Auto Submit plugin is the working example, and it treats this provider differently from Akismet: a form auto-submitted from URL parameters has no browser to render a widget in and therefore no token, so that plugin returns false for "cloudflare-captcha" and "google-recaptcha" while deliberately leaving "akismet" running.

apply_filters( 'xpac_forms_enable_verification', true, $submission, 'cloudflare-captcha' )

• $enable (bool) — Whether to run the provider's check. Default true.
• $submission (Submission) — The submission being validated.
• $provider (string) — Slug of the provider asking. Always "cloudflare-captcha" here.

Fired from:

• packages/CloudflareTurnstile/Addon.php:611