Nexus Cloudflare Turnstile

Technical summary

Additional NEXUS plugin that protects login against bots with Cloudflare Turnstile without intrusive user challenges. PluginManager hooks inject the widget and validate its token server-side through the siteverify API; lab environments receive an automatic bypass so development and tests remain accessible.

Executed scope

• Login form integration through two PluginManager filters:

- before_login (priority 5): requires the cf-turnstile-response token and invalidates the login if verification fails. - login_form_after_fields: injects a styled container (#turnstile-container), the #turnstile-widget with data-sitekey, the hidden input cf-turnstile-response and the Turnstile scripts (api.js with render=explicit and the global onloadTurnstileCallback).

• Explicit widget rendering with a light theme; the submit button stays disabled until the token is obtained (blocks requests without a challenge).
• Server-side verification turnstile_verify_token(): curl POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with secret, response and remoteip (10s timeout), with error-codes and non-200 HTTP handling.
• Automatic bypass on lab hosts via nx_is_lab_host() — Turnstile never blocks development environments.
• Settings persisted in admin_configs (plugin.cloudflare-turnstile key): site_key, secret_key, enabled and protected_pages (default ['login']), with partial merge on save and required-key validation when enabling.
• In-panel configuration modal (Alpine.js): Configured/Not configured badge, site key preview, site/secret key fields and the official "How to get the keys" link.
• 4 registered API actions: turnstile_save_config, turnstile_get_config (exposes secret_key_masked in first8...last4 format), turnstile_verify and turnstile_sitekey.
• Lean architecture: plugin.php (hooks + actions), backend.php (110 lines), modals.php (modal UI) and assets/turnstile.js (client-side widget rendering) — no dedicated tables.

Stack and tooling

• PHP 8 (no framework)
• MySQL 8 (settings in admin_configs; no dedicated tables)
• Alpine.js + Tailwind CSS
• cURL (Cloudflare siteverify verification)
• Cloudflare Turnstile (client-side widget + server-side verification API)
• NEXUS plugin system (PluginManager — filters and modals)

Operational tags

• Cloudflare
• Turnstile
• CAPTCHA
• Security

Operational outcome

• Hardened NEXUS login against bots and automated brute-force attacks without degrading user experience (Turnstile's invisible/managed challenge).
• 100% hook-based plugin integration — the NEXUS core needed no changes and the protection can be toggled from the panel.
• Automatic lab-host bypass ensures development and tests are never blocked by the CAPTCHA.