Any news on CloudFlare Turnstile baked in support?

[Web Host Pro]

Google and that other Captcha is a mess with WHMCS. Any news on WHMCS adding Turnstile support. I tried a plugin but the website was broken so I couldn't buy it. 

Edited August 2 by Web Host Pro

[arz host]

I’m in the same boat. Google reCAPTCHA has become frustrating,and the other CAPTCHA options aren’t much better with WHMCS.I tried finding a Turnstile plugin, but the developer’s website was broken, so I couldn’t even buy it.

[Waqas Ahmed Waseer]

@Web Host Pro, as far as the current docs go, there's still no native Turnstile option. The 9.1 Captcha Protection page lists the built-in captcha types as the default 6-character image code, reCAPTCHA v2 (checkbox and invisible), reCAPTCHA v3, hCaptcha and Invisible hCaptcha, so Turnstile only comes in through a third-party module or your own hooks for now.

Before buying anything, I'd try the native options properly, because a lot of the "captcha is a mess" pain I've seen on WHMCS installs comes from the setup around it rather than the captcha itself:

1. Switch to reCAPTCHA v3 or Invisible hCaptcha and tune the score threshold. WHMCS's own docs recommend reCAPTCHA v3 or hCaptcha over the older types, and with an invisible type most real customers never see a challenge. Start a bit lenient and tighten it if spam orders get through.

2. Only protect the forms that actually get abused. Under Captcha for Select Forms, tick checkout, registration, login, contact and tickets as needed, and set Captcha Form Protection to "Enabled for Unauthenticated Visitors Only" so logged-in clients aren't challenged at all.

3. If the site is behind Cloudflare, make sure Rocket Loader and script minification are off for the WHMCS hostname. WHMCS calls these out as incompatible, and Rocket Loader rewrites how page scripts load, which can stop the captcha widget from rendering or submitting properly. That looks exactly like "captcha is broken".

4. Also behind Cloudflare: add Cloudflare's ranges as trusted proxies under the same Security tab, otherwise every login, order and fraud check sees a Cloudflare IP instead of the visitor.

If you still want Turnstile, there are a couple of modules for it on the WHMCS Marketplace now. When picking one, I'd check three things: that it verifies the token server-side (siteverify) and doesn't just render the widget, that it covers checkout and not only login and registration, and that it lists your exact WHMCS 9.x version and your template, since these modules hook into the order form and client area templates and are the first thing to break after an upgrade. Test it on a staging copy first.

Either way, if you add Turnstile, set the native Captcha Type back to off for the same forms so customers don't get two challenges stacked on top of each other.