yes-corpo / cloudflare-turnstile-bundle

v1.1.1 2026-11-02 16:52 UTC

Requires

• php: ^8.1
• symfony/asset: ^6.4 || ^7.4 || ^8.0
• symfony/config: ^6.4 || ^7.4 || ^8.0
• symfony/dependency-injection: ^6.4 || ^7.4 || ^8.0
• symfony/form: ^6.4 || ^7.4 || ^8.0
• symfony/http-client: ^6.4 || ^7.4 || ^8.0
• symfony/http-client-contracts: ^3.0
• symfony/http-foundation: ^6.4 || ^7.4 || ^8.0
• symfony/http-kernel: ^6.4 || ^7.4 || ^8.0
• symfony/options-resolver: ^6.4 || ^7.4 || ^8.0
• symfony/twig-bridge: ^6.4 || ^7.4 || ^8.0
• symfony/validator: ^6.4 || ^7.4 || ^8.0

Requires (Dev)

• phpunit/phpunit: ^10.5 || ^11.0 || ^12.0
• symfony/framework-bundle: ^6.4 || ^7.4 || ^8.0
• symfony/translation: ^6.4 || ^7.4 || ^8.0
• symfony/twig-bundle: ^6.4 || ^7.4 || ^8.0

MIT

Published on Packagist.org on 2026-11-02 16:53 UTC

README

Protects Symfony forms with Cloudflare Turnstile: a TurnstileType form type renders the widget, and a Turnstile constraint verifies the token with Cloudflare when the form is submitted.

Symfony	PHP
6.4	8.1+
7.4	8.2+
8.x	8.4+

Installation

The bundle has no Flex recipe and both keys are required, so create the configuration first, otherwise the cache:clear run by composer require fails:

# config/packages/cloudflare_turnstile.yaml
cloudflare_turnstile:
    site_key: '%env(TURNSTILE_SITE_KEY)%'
    secret_key: '%env(TURNSTILE_SECRET_KEY)%'

# .env
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=

In development and tests, use the Cloudflare test keys.

Then install the bundle:

composer require yes-corpo/cloudflare-turnstile-bundle

Without Symfony Flex, enable the bundle in config/bundles.php:

YesCorpo\Bundle\CloudflareTurnstileBundle\CloudflareTurnstileBundle::class => ['all' => true],

Usage

use YesCorpo\Bundle\CloudflareTurnstileBundle\Form\Type\TurnstileType;

$builder->add('captcha', TurnstileType::class);

The form theme is registered automatically: {{ form_widget(form.captcha) }} renders the widget. The error is displayed by {{ form_errors(form) }}, see error bubbling.

Documentation

• Usage: form options, error messages, translations, how the verification works.
• Trolls: optional humorous fake CAPTCHAs shown before the real challenge.

Development

composer install
composer test