Open-source Cloudflare Turnstile CAPTCHA plugin for the DirectAdmin control panel login page. Invisible bot protection with no core file modifications required.
DirectAdmin is a web hosting control panel: a browser-based interface that server administrators and hosting companies use to manage websites, domains, email accounts, databases, and SSL certificates on a Linux server. It is a popular alternative to cPanel, widely found on VPS providers and managed hosting environments.
Like any admin interface exposed to the internet, the DirectAdmin login page is a constant target for automated attacks. Credential-stuffing bots and brute-force scripts probe login pages around the clock, testing thousands of username/password combinations drawn from large leaked credential databases.
DirectAdmin Turnstile is an open-source plugin that stops these attacks by adding Cloudflare Turnstile CAPTCHA to the login page. Unlike the image-puzzle CAPTCHAs of old, Turnstile analyses browser signals silently in the background; most legitimate users never see any challenge at all. Automated scripts, on the other hand, are blocked before they can attempt a single login.
The plugin hooks into DirectAdmin's custom template system and does not touch any core DirectAdmin files. Updates to DirectAdmin do not break it, and uninstalling is just as easy as the initial setup.
Turnstile validates browsers passively using signals like interaction patterns and browser environment context. Legitimate users pass through without doing anything. Bots are stopped at the door.
A single install script handles the entire setup: template injection, configuration, and file placement. No manual editing of DirectAdmin internals, no core file modifications. Safe across DirectAdmin updates.
Even with a full list of leaked credentials, an attacker cannot submit login attempts without first passing the Turnstile challenge. Works naturally alongside fail2ban for a layered defence.
Turnstile is free for any request volume. A site key and secret key are obtained from the Cloudflare dashboard in minutes, no billing setup required.
The Turnstile token generated in the browser is verified against Cloudflare's API server-side before authentication proceeds. Bypassing the frontend widget alone is not sufficient.
The full source is on GitHub and open to inspection. Contributions and issue reports are welcome.
Any DirectAdmin server accessible from the internet is a candidate: a personal VPS, a dedicated server, or a shared hosting environment serving multiple clients. The plugin is particularly useful for hosting providers protecting dozens or hundreds of client accounts from brute-force attempts without affecting the login flow for legitimate users.