Cloudflare Turnstile Blocked on a Contact Form

A captcha that never draws is a hard symptom to place. The form looks normal, nothing errors in the console, and the visitor cannot submit. If your site runs SureCookie and a Cloudflare Turnstile check has stopped appearing, this article explains why and how to release it.

Reported by: Tim Jefferson

What Happened

Tim added Turnstile to contact forms on two sites, using the captcha option in a Kadence advanced form. On both sites SureCookie held the widget back, so the form could not be completed. His other sites used Turnstile without trouble, and on those Turnstile had been in place before SureCookie was installed.

He worked it out himself, releasing the matching entries under Detected and Managed Resources so they were no longer held for consent, then shared it in case others hit the same thing. They do, so here it is.

Why It Happened

The intuition most people start with is that SureCookie blocked Turnstile because it did not recognize it. It is the other way round. SureCookie holds a resource back only when that resource matches a rule it already has stored. Anything it has no rule for loads normally.

Turnstile matched a rule, and the rule said “wait for consent”.

SureCookie ships a built-in catalog of known services and classifies Cloudflare Turnstile as Essential, meaning it is never gated on consent. Turnstile joined the catalog as Essential in SureCookie 1.3.0. Three things can still hold it back. Work through them in this order.

• A category you set by hand – If the Category on that row was ever changed away from Essential, that per-resource override outranks the catalog and keeps the resource gated. Check this first.
• A stale service catalog – The catalog refreshes once a day through WordPress cron. Where cron does not run, for example when DISABLE_WP_CRON is set with no server cron in its place, the site can sit on an older classification list indefinitely.
• An older plugin version – Releases before 1.3.0 have no Turnstile entry at all.

Where the catalog does cover the domain it outranks the scanner, so no re-scan is needed to pick up the corrected classification.

Note: A captcha is two resources, not one. Turnstile loads a script and an embedded iframe from the same host, and each gets its own row. Releasing only one leaves the widget broken.

How It Was Fixed

1. Go to SureCookie → Tracking Manager, then open Scripts and Embeds in the left sidebar.
2. Confirm Block Scripts Until Consent is on. The resource list appears only while it is.
3. Find the rows for challenges.cloudflare.com under Detected and Managed Resources. Expect two, one of type Script and one of type Iframe.
4. Open the script row to bring up the Edit Resource drawer, then set Category to Essential.
5. Repeat for the iframe row, then save the page.

Setting the category back to Essential is the tidier fix, because it leaves a correct record rather than an exception stacked on a wrong classification. The alternative is Behavior set to Always load, which works but stops SureCookie managing that resource at all.

What This Means for Your Site

• Nothing unknown is blocked. Every held resource matched a stored rule. If something disappeared, look for the rule, not for a missing exception.
• Not every captcha is Essential. Turnstile and hCaptcha are. reCAPTCHA is classified Marketing and stays gated unless Google Consent Mode is enabled, so check the one you actually use.
• Adding a Known Service is about your cookie policy, not blocking. The Essential classification already applies on every site, and Turnstile declares no cookies, so adding it changes neither.
• Test the interactive parts first. Right after enabling Block Scripts Until Consent, submit a form, run a test checkout and try a login.

Troubleshooting

• The widget still does not appear – Check that both rows were released, script and iframe, and that the page was saved after editing the drawer.
• The row shows an old category such as Marketing – The stored scan record is not rewritten when the catalog updates, so the table can show an older category than the one in force. This is a display difference, not a blocking one.
• The confirmation said the service stays blocked before consent – That message is generic and does not describe an Essential service. Trust the Loads before consent notice shown before you confirm.
• Nothing changes after an update – The catalog refresh runs on WordPress cron. If your host disables it, set up a server cron job.

Next Steps

If other third-party tools look misclassified, review the full list on Scripts and Embeds and correct the categories there. See Managing Scripts and Embeds.