1/**
 2 * Cloudflare Turnstile Integration for WordPress Login
 3 *
 4 * This code snippet integrates Cloudflare Turnstile into the WordPress login page,
 5 * adding a CAPTCHA-like challenge to protect against bots and automated login attempts.
 6 * The script enqueues the necessary Turnstile API script and adds custom CSS to ensure
 7 * the Turnstile widget fits the login form. It also verifies the Turnstile token during
 8 * login attempts to confirm the challenge was passed.
 9 *
10 * The Site Key and Secret Key are hardcoded in the functions below. To set up Turnstile for your site:
11 * - Sign up or log in to your Cloudflare account.
12 * - Navigate to the Turnstile section and set up Turnstile for your site.
13 * - Cloudflare will provide you with a Site Key and a Secret Key.
14 * - Replace the placeholder keys in the functions with the keys provided by Cloudflare.
15 *
16 * Note:
17 * The Secret Key is used for server-side token verification and must be kept private.
18 * Do not expose this key in any client-side code or public repositories.
19 *
20 * Author: Mark Harris
21 * URI: https://www.christchurchwebsolutions.co.uk
22 */
23 
24 
25// Enqueue Turnstile script on the WordPress login page
26function enqueue_turnstile_script_for_login()
27{
28    wp_enqueue_script(
29        "cloudflare-turnstile",
30        "https://challenges.cloudflare.com/turnstile/v0/api.js",
31        [],
32        null,
33        true
34    );
35    // Inline custom CSS to ensure Turnstile widget fits within the login box
36    wp_add_inline_style(
37        "login",
38        ".cf-turnstile { max-width: 100%; box-sizing: border-box; } .cf-turnstile iframe { width: 100% !important; }"
39    );
40}
41add_action("login_enqueue_scripts", "enqueue_turnstile_script_for_login");
42 
43// Add the Turnstile widget to the login form with hardcoded site key and theme
44function add_turnstile_to_wp_login_form()
45{
46    echo '<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY" data-theme="light"></div>';
47}
48add_action("login_form", "add_turnstile_to_wp_login_form");
49 
50// Implement the token verification function
51function verify_turnstile_token($token)
52{
53    $secret_key = "YOUR_SECRET_KEY";
54    $response = wp_remote_post(
55        "https://challenges.cloudflare.com/turnstile/v0/siteverify",
56        [
57            "body" => [
58                "secret" => $secret_key,
59                "response" => $token,
60            ],
61        ]
62    );
63 
64    if (is_wp_error($response)) {
65        return false;
66    }
67 
68    $body = wp_remote_retrieve_body($response);
69    $result = json_decode($body, true);
70 
71    return $result["success"] ?? false;
72}
73 
74// Verify Turnstile token on login attempt
75function verify_turnstile_on_login($user, $password)
76{
77    if (isset($_POST["cf-turnstile-response"])) {
78        $token = $_POST["cf-turnstile-response"];
79        $verify = verify_turnstile_token($token);
80 
81        if (!$verify) {
82            return new WP_Error(
83                "turnstile_failed",
84                __(
85                    "<strong>ERROR</strong>: Please pass the security challenge.",
86                    "textdomain"
87                )
88            );
89        }
90    }
91 
92    return $user;
93}
94add_filter("wp_authenticate_user", "verify_turnstile_on_login", 10, 2);