1. Project Overview

Remco (Dynateq) operates an online auction platform at executieverkoop-online.nl using the Ultimate Auction Pro. Cloudflare Turnstile has already been installed on the site, however it is not currently integrated with the theme’s custom AJAX registration popup. The popup uses a dedicated AJAX endpoint that bypasses the standard WordPress registration flow — meaning Turnstile’s token is not being passed or validated during registration submissions.

This proposal covers the targeted integration of the already-installed Cloudflare Turnstile CAPTCHA directly into the theme’s AJAX registration popup — ensuring the Turnstile widget loads correctly within the popup, the token is passed with the AJAX registration request, and the token is validated server-side before any user account is created.

The four core development areas are:

  • CAPTCHA Widget Load in AJAX Popup — ensure Turnstile loads and renders correctly every time the registration popup opens
  • Token Pass on AJAX Submission — Turnstile token included in the AJAX registration request submitted to the server
  • Server-Side Token Validation — token verified against Cloudflare’s API before user account creation proceeds
  • Error Handling & Testing — clear error messages on CAPTCHA failure; full end-to-end compatibility test with existing theme and WooCommerce
  1. Assumptions
    • Cloudflare Turnstile is already installed on executieverkoop-online.nl — the Turnstile Site Key and Secret Key are already configured in the site
    • The Turnstile widget is currently not integrated with the theme’s AJAX registration popup — this is the specific gap being addressed in this engagement
    • Ultimate Auction Pro is installed, active, and on a supported version at the time development begins
    • WordPress and WooCommerce are on supported and up-to-date versions at the time development begins
    • A staging environment will be provided by Remco for development and testing before changes are applied to the live site
    • Remco will provide temporary admin access to the staging site to allow the development team to inspect and implement the integration
    • Any incompatibilities arising from future updates to WordPress, WooCommerce, Ultimate Auction Pro, or Cloudflare Turnstile after project delivery are outside the scope of this engagement
    • Go-live deployment to the production site is Remco’s responsibility unless a separate deployment agreement is made
  1. Customer Requirements(Scope of work)
    1. CAPTCHA Loads Correctly in AJAX Registration Popup
    • Cloudflare Turnstile CAPTCHA must load and render correctly within the theme’s custom AJAX registration popup
    • Turnstile must initialise each time the popup opens — including if the popup is closed and reopened in the same session
    • CAPTCHA must operate invisibly — no user interaction required; the challenge runs silently in the background
    • Turnstile widget must not break the existing popup layout, fields, or styling
    1. Token Passed During AJAX Registration Request
    • When the user submits the registration form inside the popup, the Cloudflare Turnstile token must be included in the AJAX request
    • If the token has not yet been generated at the time of submission, the request must wait until the token is ready before proceeding
    • The token must be passed correctly to the server alongside all existing registration form fields
    1. Server-Side Token Validation
    • On each AJAX registration submission, the Turnstile token must be validated against Cloudflare’s server-side verification API before any user account is created
    • If Cloudflare returns a valid response, registration proceeds as normal
    • If Cloudflare returns an invalid response, registration is blocked immediately — no user account is created
    1. Error Messages on CAPTCHA Failure
    • When CAPTCHA verification fails, a clear and user-friendly error message must be displayed inside the registration popup
    • The error message must prompt the user to try again
    • The Turnstile widget must reset after a failed attempt so a new token can be generated on retry
    1. Compatibility with Existing Theme and WooCommerce
    • All existing registration popup behaviour must remain unchanged — field validation, welcome email, auto-login, and redirect must all continue to work as before
    • WooCommerce order flow and all other site functionality must be completely unaffected
    • Standard WordPress registration page must remain unaffected
  1. Technical Approach

4.1  Root Cause — Why Turnstile Is Not Currently Working in the Popup

  • The theme’s registration popup submits via a custom AJAX action (wp_ajax_nopriv handler) — it does not use the standard WordPress registration page or its associated hooks
  • Standard Turnstile plugin integrations hook into the WordPress registration page — they do not cover the theme’s custom AJAX endpoint
  • Additionally, AJAX popups that load dynamically require special handling to ensure Turnstile’s JavaScript initialises correctly each time the popup opens — a standard page-load integration is not sufficient
  • The fix requires two targeted changes: client-side (ensure Turnstile renders in the popup on every open) and server-side (verify the token in the theme’s AJAX handler before account creation)

4.2  Client-Side — Widget Initialisation in AJAX Popup

  • Cloudflare Turnstile JavaScript is confirmed enqueued on pages where the registration popup appears
  • Turnstile widget is explicitly rendered inside the popup container using turnstile.render() targeting the popup’s form element
  • On popup close and reopen, the existing Turnstile widget instance is removed and a new one rendered — ensuring a fresh token is always available
  • Form submission is held if the Turnstile challenge is still processing — proceeds once the cf-turnstile-response token is available
  • Turnstile widget is reset after a failed submission so a new token is generated on retry

4.3  AJAX Request — Token Inclusion

  • The existing AJAX registration form submit handler is extended to read the cf-turnstile-response token from the Turnstile widget
  • Token is appended to the AJAX request data alongside all existing registration form fields
  • No changes to any other field, validation logic, or submission behaviour

4.4  Server-Side — Token Validation in AJAX Handler

  • The theme’s existing AJAX registration handler is extended to read the Turnstile token from the incoming request
  • Before any registration logic runs, the token is sent to Cloudflare’s Turnstile siteverify API endpoint via a server-side HTTP request
  • On Cloudflare success response: registration logic continues as normal — no change to any existing behaviour
  • On Cloudflare failure response: registration is blocked; a clear error message is returned to the popup; no user account is created
  • Edge cases handled: missing token, expired token, Cloudflare API timeout — all treated as verification failure and blocked
  • The Secret Key is never exposed client-side — all API calls are made server-side only

4.5  Error Handling

  • On CAPTCHA verification failure: error message displayed inside the registration popup — “CAPTCHA verification failed. Please try again.”
  • Turnstile widget resets automatically after failure so a fresh token is generated on the next attempt
  • All existing form validation error messages remain unchanged and continue to display as before
  1. Effort — Design & Development

5.1  Inspect & Confirm Integration Points

  • Review the theme’s AJAX registration popup implementation on the staging site
  • Confirm the AJAX action name, form structure, and existing Turnstile installation
  • Identify the exact client-side and server-side files to be modified
  • Confirm no third-party customisations conflict with the planned integration approach

Estimated effort: 1 hour

5.2  Client-Side — Turnstile Widget in AJAX Popup

  • Ensure Turnstile JavaScript is correctly enqueued on pages where the popup appears
  • Implement turnstile.render() targeting the popup form container on popup open
  • Handle popup close and reopen: remove existing widget instance and render a fresh one
  • Hold AJAX submission until Turnstile token is available; append token to AJAX request data
  • Reset Turnstile widget after failed submission so a new token can be generated
  • Test: widget loads correctly on popup open; resets correctly on close/reopen and on error

Estimated effort: 2 hours

5.3  Server-Side — Token Validation in AJAX Handler

  • Extend the theme’s existing AJAX registration handler to read the Turnstile token
  • Add server-side call to Cloudflare Turnstile siteverify API using the existing Secret Key
  • On success: allow registration to proceed as normal — no change to existing logic
  • On failure: block registration and return error message to popup
  • Handle edge cases: missing token, timeout, API error — all blocked with appropriate message
  • Test: valid token allows registration; missing or invalid token blocks registration with correct error

Estimated effort: 2 hours

5.4  Error Messages & User Feedback

  • Implement clear error message display inside the popup on CAPTCHA failure
  • Ensure error message is styled consistently with existing popup error messages
  • Confirm Turnstile widget resets and allows retry after failure
  • Test: error message appears correctly on failure; widget resets; user can retry and succeed

Estimated effort: 1 hour

5.5  End-to-End Compatibility Testing

  • Test full registration flow with a real user on the staging site: popup opens, Turnstile runs silently, registration completes
  • Test CAPTCHA failure: submit without token or with invalid token — registration blocked, error shown
  • Test popup close and reopen: Turnstile reinitialises correctly each time
  • Verify all existing registration behaviour unchanged: field validation, welcome email, auto-login, redirect
  • Verify WooCommerce functionality and all other site features are completely unaffected

Estimated effort: 2 hours

 

  1. Effort Snapshot

 

Deliverable Hours
Inspect & Confirm Integration Points 1
Client-Side — Turnstile Widget in AJAX Popup 2
Server-Side — Token Validation in AJAX Handler 2
Error Messages & User Feedback 1
End-to-End Compatibility Testing 2
TOTAL ESTIMATED HOURS 8

 

Note: Cloudflare Turnstile is already installed on the site. This engagement covers only the targeted integration with the theme’s AJAX registration popup — no new CAPTCHA service setup is required. All existing site functionality, registration behaviour, and WooCommerce flow remain completely unchanged.

 

  1. Deliverables

The following deliverables will be provided as part of this engagement:

  • Turnstile widget in AJAX popup — Cloudflare Turnstile renders correctly inside the registration popup on every open, including after close and reopen in the same session; operates invisibly with no user interaction required
  • Token passed on AJAX submission — Turnstile token included in every AJAX registration request; submission held until token is ready if the challenge is still processing
  • Server-side token validation — token verified against Cloudflare’s siteverify API in the theme’s AJAX handler before any user account is created; invalid or missing tokens blocked immediately
  • Error messages on CAPTCHA failure — clear user-facing error message displayed inside the popup on verification failure; Turnstile widget resets to allow retry
  • Full compatibility — all existing registration behaviour unchanged (field validation, welcome email, auto-login, redirect); WooCommerce and all other site functionality completely unaffected
  • Delivery — updated theme files delivered as a ZIP for self-installation, or deployed directly on the staging site for testing before go-live

 

  1. Commercials & Payment

Project Cost

Total Estimated Effort: 8 hours

Hourly Rate: USD 45 / hour

Total Cost : USD 360