Open-source Cloudflare Turnstile CAPTCHA plugin for the CloudPanel login page. Invisible bot protection with automatic dark theme support and built-in auto updates.
CloudPanel is a free, modern server management panel built for developers and hosting providers. Unlike older control panels, it is designed specifically for cloud VPS and dedicated servers, handling PHP applications (with per-site PHP version switching), databases, SSL certificates, Nginx configuration, cron jobs, and file management from a clean web interface. Its lightweight footprint and zero licensing cost make it a popular choice for self-hosted infrastructure.
Like any publicly accessible admin panel, CloudPanel's login page is exposed to the internet and receives automated probing 24/7 - bots testing weak passwords, replaying leaked credentials, or working through common combinations. Standard rate limiting and IP banning help, but they are reactive measures that kick in only after an attack is already underway. Turnstile stops the attempt before it starts.
CloudPanel Turnstile adds Cloudflare Turnstile CAPTCHA to the CloudPanel login page. For virtually all legitimate users, the verification is completely silent: no puzzle, no image grid, no checkbox. The Turnstile widget analyses the request in the background and only genuinely suspicious traffic is shown a challenge. Automated scripts cannot pass it.
The plugin integrates cleanly with CloudPanel v2, automatically adapts to its dark colour scheme, and includes a built-in update mechanism so the protection stays current without manual intervention.
Cloudflare Turnstile does not set advertising cookies or build a cross-site tracking profile. Bot detection without the surveillance and cookie overhead of Google reCAPTCHA.
The Turnstile widget automatically adapts to CloudPanel's dark interface. The login page looks native, no jarring white boxes or mismatched styling.
The plugin ships with its own update mechanism. New versions install automatically; no need to track GitHub releases or re-run the install script after each fix.
Designed specifically for CloudPanel v2. Hooks into the existing authentication flow without patching core files. Removal is clean and leaves no residual configuration behind.
Bots cannot pass the Turnstile challenge, which means credential-stuffing and brute-force scripts cannot attempt a login at all. Works alongside existing firewall rules and rate limiting without conflict.
Full source on GitHub. Transparent, auditable code that can be reviewed before deployment. Community contributions and issue reports are welcome.