PHPackages                             vuillaume-agency/symfony-turnstile - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. vuillaume-agency/symfony-turnstile

ActiveLibrary[Security](/categories/security)

vuillaume-agency/symfony-turnstile
==================================

Symfony bundle for Cloudflare Turnstile - a privacy-friendly, GDPR-compliant CAPTCHA alternative. Drop-in reCAPTCHA replacement with zero user friction.

v1.1.1(3mo ago)41.3k↓23.8%1MITPHPPHP >=8.2CI passing

Since Jan 7Pushed 3mo ago1 watchersCompare

[ Source](https://github.com/vuillaume-agency/symfony-turnstile)[ Packagist](https://packagist.org/packages/vuillaume-agency/symfony-turnstile)[ RSS](/packages/vuillaume-agency-symfony-turnstile/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (2)Dependencies (12)Versions (12)Used By (0)

Symfony Turnstile Bundle
========================

[](#symfony-turnstile-bundle)

[![CI](https://github.com/vuillaume-agency/symfony-turnstile/actions/workflows/ci.yml/badge.svg)](https://github.com/vuillaume-agency/symfony-turnstile/actions/workflows/ci.yml)[![Minimum PHP Version](https://camo.githubusercontent.com/e013d25225712daef79077a26c4a666153efa97434544fe6ad4641b529dd549e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253345253344253230382e322d677265656e)](https://php.net/)[![Minimum Symfony Version](https://camo.githubusercontent.com/672e947434ef8987cdff73073747a39f44501ffb3bf4b385531ef43bcacff8e2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f73796d666f6e792d253345253344253230372e342d677265656e)](https://symfony.com)[![License](https://camo.githubusercontent.com/b8cadaa967891081f8f165695470689986c028821dd8a040132f6e661795dc0d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c7565)](LICENSE)

A Symfony bundle to integrate [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/) on your forms. Turnstile is a privacy-preserving alternative to CAPTCHA that doesn't require user interaction.

Features
--------

[](#features)

- **Zero user friction** — No puzzles, no clicking on traffic lights
- **GDPR-friendly** — No cookie consent required, privacy-first design
- **22 languages included** — All major European languages supported
- **Symfony 8 ready** — Full support for Symfony 7.4 LTS and 8.x
- **Customizable messages** — Override error messages via form options or translations
- **Easy theming** — Light, dark, or auto theme support
- **Fully tested** — PHPUnit tests and PHPStan static analysis

Quick Start
-----------

[](#quick-start)

```
composer require vuillaume-agency/symfony-turnstile
```

```
# .env
TURNSTILE_KEY="your-site-key"
TURNSTILE_SECRET="your-secret-key"
```

```
// In your form
->add('captcha', TurnstileType::class)
```

Get your free keys at [Cloudflare Dashboard](https://dash.cloudflare.com/?to=/:account/turnstile).

Why Turnstile over reCAPTCHA?
-----------------------------

[](#why-turnstile-over-recaptcha)

FeatureTurnstilereCAPTCHAUsually invisible (no puzzles)YesYes (v3 only)GDPR compliant by designYesNo (requires consent)Uses cookiesNoYesData used for advertisingNoUnclearScript size~30KB~80KBFree unlimitedYesYes (with limits)### GDPR considerations

[](#gdpr-considerations)

For European websites, reCAPTCHA poses significant compliance challenges:

- **Cookies**: reCAPTCHA sets cookies that require user consent under GDPR
- **Data transfer**: User data is sent to Google servers in the US
- **Consent required**: Must obtain explicit consent before loading reCAPTCHA
- **Fines**: French DPA (CNIL) has fined companies for improper reCAPTCHA implementation

Turnstile is designed with privacy in mind:

- **No cookies**: Doesn't set any cookies, no consent banner needed
- **Minimal data**: Only collects what's necessary for bot detection (IP, TLS fingerprint)
- **No advertising**: Cloudflare explicitly prohibits using collected data for ads or tracking
- **GDPR-ready**: Can be used without additional consent mechanisms

About this fork
---------------

[](#about-this-fork)

Originally a fork of [pixelopen/cloudflare-turnstile-bundle](https://github.com/Pixel-Open/cloudflare-turnstile-bundle) by Pixel Développement.

**What's new:**

- Symfony 7.4 LTS and 8.x support
- 22 languages for error messages
- Customizable error messages via form options
- `disable_submit_until_verified` option to prevent premature form submission
- PHP 8.2+ with modern features (readonly, constructor promotion)
- Active maintenance and community contributions welcome

Requirements
------------

[](#requirements)

RequirementVersionPHP>= 8.2Symfony>= 7.4Installation
------------

[](#installation)

### Step 1: Install the package

[](#step-1-install-the-package)

```
composer require vuillaume-agency/symfony-turnstile
```

### Step 2: Register the bundle

[](#step-2-register-the-bundle)

Add the bundle to your `config/bundles.php`:

```
return [
    // ...
    VuillaumeAgency\TurnstileBundle\VuillaumeAgencyTurnstileBundle::class => ['all' => true],
];
```

### Step 3: Add your Cloudflare credentials

[](#step-3-add-your-cloudflare-credentials)

Get your keys from the [Cloudflare Dashboard](https://dash.cloudflare.com/?to=/:account/turnstile) and add them to your `.env` file:

```
TURNSTILE_KEY="your-site-key"
TURNSTILE_SECRET="your-secret-key"
```

That's it! The bundle automatically reads from these environment variables.

### Optional: Custom configuration

[](#optional-custom-configuration)

If you need to customize the bundle, create `config/packages/vuillaume_agency_turnstile.yaml`:

```
vuillaume_agency_turnstile:
    key: '%env(TURNSTILE_KEY)%'      # Default: reads from TURNSTILE_KEY env var
    secret: '%env(TURNSTILE_SECRET)%' # Default: reads from TURNSTILE_SECRET env var
    enable: true                      # Default: true
    disable_submit_until_verified: false  # Default: false
```

OptionTypeDefaultDescription`key`string`%env(TURNSTILE_KEY)%`Your Turnstile site key (public)`secret`string`%env(TURNSTILE_SECRET)%`Your Turnstile secret key (private)`enable`boolean`true`Enable/disable validation`disable_submit_until_verified`boolean`false`Disable submit buttons until Turnstile verification completesUsage
-----

[](#usage)

### Adding Turnstile to a form

[](#adding-turnstile-to-a-form)

Use `TurnstileType` in your form builder:

```