diff --git a/.env.example b/.env.example
index 7b919f2e8..ddce08124 100644
--- a/.env.example
+++ b/.env.example
@@ -28,3 +28,5 @@ CONVERTKIT_API_SIGNED_SUBSCRIBER_ID=
 CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS=
 CONVERTKIT_API_RECAPTCHA_SITE_KEY=
 CONVERTKIT_API_RECAPTCHA_SECRET_KEY=
+CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY=
+CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY=
diff --git a/.github/workflows/_run-tests.yml b/.github/workflows/_run-tests.yml
index 934923c06..c6c0b9579 100644
--- a/.github/workflows/_run-tests.yml
+++ b/.github/workflows/_run-tests.yml
@@ -75,6 +75,8 @@ jobs:
       CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS: ${{ secrets.CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS }}
       CONVERTKIT_API_RECAPTCHA_SITE_KEY: ${{ secrets.CONVERTKIT_API_RECAPTCHA_SITE_KEY }}
       CONVERTKIT_API_RECAPTCHA_SECRET_KEY: ${{ secrets.CONVERTKIT_API_RECAPTCHA_SECRET_KEY }}
+      CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY: ${{ secrets.CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY }}
+      CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY: ${{ secrets.CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY }}
 
     steps:
       - name: Define Test Group Name
@@ -291,6 +293,8 @@ jobs:
           CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS=${{ env.CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS }}
           CONVERTKIT_API_RECAPTCHA_SITE_KEY=${{ env.CONVERTKIT_API_RECAPTCHA_SITE_KEY }}
           CONVERTKIT_API_RECAPTCHA_SECRET_KEY=${{ env.CONVERTKIT_API_RECAPTCHA_SECRET_KEY }}
+          CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY=${{ env.CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY }}
+          CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY=${{ env.CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY }}
           ENVEOF
 
       # Installs wp-browser, Codeception, PHP CodeSniffer and anything else needed to run tests.
diff --git a/admin/section/class-convertkit-admin-section-general.php b/admin/section/class-convertkit-admin-section-general.php
index dc10bbb5b..95d4af4da 100644
--- a/admin/section/class-convertkit-admin-section-general.php
+++ b/admin/section/class-convertkit-admin-section-general.php
@@ -59,22 +59,22 @@ public function __construct() {
 
 		// Define settings sections.
 		$this->settings_sections = array(
-			'general'   => array(
+			'general'         => array(
 				'title'    => $this->title,
 				'callback' => array( $this, 'print_section_info' ),
 				'wrap'     => true,
 			),
-			'site-wide' => array(
+			'site-wide'       => array(
 				'title'    => __( 'Non-inline Forms', 'convertkit' ),
 				'callback' => array( $this, 'print_section_info_site_wide' ),
 				'wrap'     => true,
 			),
-			'recaptcha' => array(
-				'title'    => __( 'reCAPTCHA', 'convertkit' ),
-				'callback' => array( $this, 'print_section_info_recaptcha' ),
+			'spam-protection' => array(
+				'title'    => __( 'Spam Protection', 'convertkit' ),
+				'callback' => array( $this, 'print_section_info_spam_protection' ),
 				'wrap'     => true,
 			),
-			'advanced'  => array(
+			'advanced'        => array(
 				'title'    => __( 'Advanced', 'convertkit' ),
 				'callback' => array( $this, 'print_section_info_advanced' ),
 				'wrap'     => true,
@@ -409,15 +409,31 @@ public function register_fields() {
 			)
 		);
 
+		// Spam Protection.
+		add_settings_field(
+			'spam_protection_provider',
+			__( 'Provider', 'convertkit' ),
+			array( $this, 'spam_protection_provider_callback' ),
+			$this->settings_key,
+			$this->name . '-spam-protection',
+			array(
+				'label_for'   => 'spam_protection_provider',
+				'description' => array(
+					__( 'Select which spam protection service to use for the Member Content signup form and Form Builder block.', 'convertkit' ),
+				),
+			)
+		);
+
 		// reCAPTCHA.
 		add_settings_field(
 			'recaptcha_site_key',
 			__( 'reCAPTCHA: Site Key', 'convertkit' ),
 			array( $this, 'recaptcha_site_key_callback' ),
 			$this->settings_key,
-			$this->name . '-recaptcha',
+			$this->name . '-spam-protection',
 			array(
 				'label_for'   => 'recaptcha_site_key',
+				'class'       => 'convertkit-spam-protection-recaptcha',
 				'description' => array(
 					__( 'Enter your Google reCAPTCHA v3 Site Key. When specified, this will be used to reduce spam signups.', 'convertkit' ),
 				),
@@ -428,9 +444,10 @@ public function register_fields() {
 			__( 'reCAPTCHA: Secret Key', 'convertkit' ),
 			array( $this, 'recaptcha_secret_key_callback' ),
 			$this->settings_key,
-			$this->name . '-recaptcha',
+			$this->name . '-spam-protection',
 			array(
 				'label_for'   => 'recaptcha_secret_key',
+				'class'       => 'convertkit-spam-protection-recaptcha',
 				'description' => array(
 					__( 'Enter your Google reCAPTCHA v3 Secret Key. When specified, this will be used to reduce spam signups.', 'convertkit' ),
 				),
@@ -441,9 +458,10 @@ public function register_fields() {
 			__( 'reCAPTCHA: Minimum Score', 'convertkit' ),
 			array( $this, 'recaptcha_minimum_score_callback' ),
 			$this->settings_key,
-			$this->name . '-recaptcha',
+			$this->name . '-spam-protection',
 			array(
 				'label_for'   => 'recaptcha_minimum_score',
+				'class'       => 'convertkit-spam-protection-recaptcha',
 				'min'         => 0,
 				'max'         => 1,
 				'step'        => 0.01,
@@ -453,6 +471,36 @@ public function register_fields() {
 			)
 		);
 
+		// Cloudflare Turnstile.
+		add_settings_field(
+			'cloudflare_turnstile_site_key',
+			__( 'Cloudflare Turnstile: Site Key', 'convertkit' ),
+			array( $this, 'cloudflare_turnstile_site_key_callback' ),
+			$this->settings_key,
+			$this->name . '-spam-protection',
+			array(
+				'label_for'   => 'cloudflare_turnstile_site_key',
+				'class'       => 'convertkit-spam-protection-cloudflare_turnstile',
+				'description' => array(
+					__( 'Enter your Cloudflare Turnstile Site Key. When specified, this will be used to reduce spam signups.', 'convertkit' ),
+				),
+			)
+		);
+		add_settings_field(
+			'cloudflare_turnstile_secret_key',
+			__( 'Cloudflare Turnstile: Secret Key', 'convertkit' ),
+			array( $this, 'cloudflare_turnstile_secret_key_callback' ),
+			$this->settings_key,
+			$this->name . '-spam-protection',
+			array(
+				'label_for'   => 'cloudflare_turnstile_secret_key',
+				'class'       => 'convertkit-spam-protection-cloudflare_turnstile',
+				'description' => array(
+					__( 'Enter your Cloudflare Turnstile Secret Key. When specified, this will be used to reduce spam signups.', 'convertkit' ),
+				),
+			)
+		);
+
 		// Advanced.
 		add_settings_field(
 			'debug',
@@ -547,13 +595,13 @@ public function print_section_info_site_wide() {
 	}
 
 	/**
-	 * Prints help info for the recaptcha section of the settings screen.
+	 * Prints help info for the spam protection section of the settings screen.
 	 *
-	 * @since   3.0.0
+	 * @since   3.3.7
 	 */
-	public function print_section_info_recaptcha() {
+	public function print_section_info_spam_protection() {
 		?>
-		<p class="description"><?php esc_html_e( 'Configure reCAPTCHA to protect the Member Content signup form and Form Builder block from spam and abuse.', 'convertkit' ); ?></p>
+		<p class="description"><?php esc_html_e( 'Configure a spam protection service to protect the Member Content signup form and Form Builder block from spam and abuse. Choose a provider below, then enter the corresponding site and secret keys.', 'convertkit' ); ?></p>
 		<?php
 	}
 
@@ -919,6 +967,29 @@ public function non_inline_form_limit_per_session_callback( $args ) {
 
 	}
 
+	/**
+	 * Renders the dropdown for choosing the active spam protection provider.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   array $args   Setting field arguments (name,description).
+	 */
+	public function spam_protection_provider_callback( $args ) {
+
+		$this->output_select_field(
+			'spam_protection_provider',
+			esc_attr( $this->settings->spam_protection_provider() ),
+			array(
+				'recaptcha'            => esc_html__( 'Google reCAPTCHA v3', 'convertkit' ),
+				'cloudflare_turnstile' => esc_html__( 'Cloudflare Turnstile', 'convertkit' ),
+			),
+			$args['description'],
+			array( 'convertkit-conditional-display' ),
+			array( 'data-conditional-class-prefix' => 'convertkit-spam-protection-' )
+		);
+
+	}
+
 	/**
 	 * Renders the input for the reCAPTCHA Site Key setting.
 	 *
@@ -985,6 +1056,46 @@ public function recaptcha_minimum_score_callback( $args ) {
 
 	}
 
+	/**
+	 * Renders the input for the Cloudflare Turnstile Site Key setting.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   array $args   Setting field arguments (name,description).
+	 */
+	public function cloudflare_turnstile_site_key_callback( $args ) {
+
+		$this->output_text_field(
+			'cloudflare_turnstile_site_key',
+			esc_attr( $this->settings->cloudflare_turnstile_site_key() ),
+			$args['description'],
+			array(
+				'widefat',
+			)
+		);
+
+	}
+
+	/**
+	 * Renders the input for the Cloudflare Turnstile Secret Key setting.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   array $args   Setting field arguments (name,description).
+	 */
+	public function cloudflare_turnstile_secret_key_callback( $args ) {
+
+		$this->output_text_field(
+			'cloudflare_turnstile_secret_key',
+			esc_attr( $this->settings->cloudflare_turnstile_secret_key() ),
+			$args['description'],
+			array(
+				'widefat',
+			)
+		);
+
+	}
+
 	/**
 	 * Renders the input for the Debug setting.
 	 *
diff --git a/includes/blocks/class-convertkit-block-form-builder.php b/includes/blocks/class-convertkit-block-form-builder.php
index 16833a0fd..8c0687a4d 100644
--- a/includes/blocks/class-convertkit-block-form-builder.php
+++ b/includes/blocks/class-convertkit-block-form-builder.php
@@ -77,15 +77,11 @@ public function maybe_subscribe() {
 			return;
 		}
 
-		// Check reCAPTCHA.
-		$recaptcha          = new ConvertKit_Recaptcha();
-		$recaptcha_response = $recaptcha->verify_recaptcha(
-			( isset( $_POST['g-recaptcha-response'] ) ? sanitize_text_field( wp_unslash( $_POST['g-recaptcha-response'] ) ) : '' ),
-			'convertkit_form_builder'
-		);
+		// Check spam protection.
+		$spam_protection = new ConvertKit_Spam_Protection();
 
-		// Bail if reCAPTCHA failed.
-		if ( is_wp_error( $recaptcha_response ) ) {
+		// Bail if spam protection failed.
+		if ( is_wp_error( $spam_protection->verify( 'convertkit_form_builder' ) ) ) {
 			return;
 		}
 
@@ -721,23 +717,23 @@ public function render_form_button( $block_content, $block ) {
 			$block_content
 		);
 
-		// Return the button if reCAPTCHA does not need to be used.
-		$settings = new ConvertKit_Settings();
-		if ( ! $settings->has_recaptcha_site_and_secret_keys() ) {
+		// Return the button if no spam protection provider is active.
+		$spam_protection = new ConvertKit_Spam_Protection();
+		$provider        = $spam_protection->get_active_provider();
+		if ( ! $provider ) {
 			return $block_content;
 		}
 
-		// Enqueue reCAPTCHA JS.
-		$recaptcha = new ConvertKit_Recaptcha();
-		$recaptcha->enqueue_scripts();
+		// Enqueue the spam protection provider's JS.
+		$provider->enqueue_scripts();
 
-		// Add reCAPTCHA attributes to button.
+		// Parse the button's DOM.
 		$parser = new ConvertKit_HTML_Parser( $block_content );
 		$button = $parser->xpath->query( '//button' )->item( 0 );
-		$button->setAttribute( 'data-sitekey', esc_attr( $settings->recaptcha_site_key() ) ); // @phpstan-ignore-line
-		$button->setAttribute( 'data-callback', 'convertKitRecaptchaFormSubmit' ); // @phpstan-ignore-line
-		$button->setAttribute( 'data-action', 'convertkit_form_builder' ); // @phpstan-ignore-line
-		$button->setAttribute( 'class', trim( $button->getAttribute( 'class' ) . ' g-recaptcha' ) ); // @phpstan-ignore-line
+
+		// Attach the spam protection provider's attributes/elements to the form/button as necessary.
+		// $button is narrowed from DOMNode to DOMElement by the //button xpath expression above.
+		$provider->attach_to_form_button_dom( $parser, $button, 'convertkit_form_builder' ); // @phpstan-ignore-line
 
 		// Return button HTML.
 		return $parser->get_body_html();
diff --git a/includes/class-convertkit-cloudflare-turnstile.php b/includes/class-convertkit-cloudflare-turnstile.php
new file mode 100644
index 000000000..b87aa7320
--- /dev/null
+++ b/includes/class-convertkit-cloudflare-turnstile.php
@@ -0,0 +1,203 @@
+<?php
+/**
+ * ConvertKit Cloudflare Turnstile class.
+ *
+ * @package ConvertKit
+ * @author ConvertKit
+ */
+
+/**
+ * Handles Cloudflare Turnstile verification.
+ *
+ * @since   3.3.7
+ */
+class ConvertKit_Cloudflare_Turnstile {
+
+	/**
+	 * The endpoint used to validate Turnstile tokens server-side.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @var     string
+	 */
+	const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+	/**
+	 * The URL of the Turnstile client-side script.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @var     string
+	 */
+	const CLIENT_SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js';
+
+	/**
+	 * Holds the settings class.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @var     bool|ConvertKit_Settings
+	 */
+	private $settings = false;
+
+	/**
+	 * Constructor.
+	 *
+	 * @since   3.3.7
+	 */
+	public function __construct() {
+
+		$this->settings = new ConvertKit_Settings();
+
+	}
+
+	/**
+	 * Enqueues the Cloudflare Turnstile client-side script if Cloudflare Turnstile
+	 * site and secret keys are set and scripts are enabled.
+	 *
+	 * @since   3.3.7
+	 */
+	public function enqueue_scripts() {
+
+		// Don't run if Cloudflare Turnstile or scripts are disabled.
+		if ( ! $this->settings->has_cloudflare_turnstile_site_and_secret_keys() || $this->settings->scripts_disabled() ) {
+			return;
+		}
+
+		// Enqueue Cloudflare Turnstile JS.
+		add_filter(
+			'convertkit_output_scripts_footer',
+			function ( $scripts ) {
+
+				$scripts[] = array(
+					'src'   => self::CLIENT_SCRIPT_URL,
+					'async' => true,
+					'defer' => true,
+				);
+
+				return $scripts;
+
+			}
+		);
+
+	}
+
+	/**
+	 * Verifies a Cloudflare Turnstile response token against the Siteverify API,
+	 * if Cloudflare Turnstile site and secret keys are set, and scripts are enabled.
+	 *
+	 * Mirrors the request format documented at
+	 * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   string $cloudflare_turnstile_response  Cloudflare Turnstile response token from the client.
+	 * @param   string $plugin_action                  Plugin action string (unused).
+	 * @return  bool|WP_Error
+	 */
+	public function verify( $cloudflare_turnstile_response, $plugin_action ) {
+
+		unset( $plugin_action );
+
+		// Don't run if Turnstile or scripts are disabled.
+		if ( ! $this->settings->has_cloudflare_turnstile_site_and_secret_keys() || $this->settings->scripts_disabled() ) {
+			return true;
+		}
+
+		// POST to Cloudflare Siteverify.
+		$response = wp_remote_post(
+			self::SITEVERIFY_URL,
+			array(
+				'body' => array(
+					'secret'   => $this->settings->cloudflare_turnstile_secret_key(),
+					'response' => $cloudflare_turnstile_response,
+					'remoteip' => ( isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '' ),
+				),
+			)
+		);
+
+		// Bail if the request itself errored.
+		if ( is_wp_error( $response ) ) {
+			return $response;
+		}
+
+		// Decode response.
+		$body = json_decode( wp_remote_retrieve_body( $response ), true );
+
+		// If the response body couldn't be decoded, treat that as a failure.
+		if ( ! is_array( $body ) ) {
+			return new WP_Error(
+				'convertkit_cloudflare_turnstile_failed',
+				__( 'Cloudflare Turnstile failure: invalid response from Siteverify.', 'convertkit' )
+			);
+		}
+
+		// If the token verified, return true.
+		if ( $body['success'] === true ) {
+			return true;
+		}
+
+		// Return an error.
+		return new WP_Error(
+			'convertkit_cloudflare_turnstile_failed',
+			sprintf(
+				/* translators: Error codes */
+				__( 'Cloudflare Turnstile failure: %s', 'convertkit' ),
+				implode( ', ', $body['error-codes'] )
+			)
+		);
+
+	}
+
+	/**
+	 * Inserts a Cloudflare Turnstile widget div immediately before the given
+	 * submit button within an existing DOM tree. `data-appearance=interaction-only`
+	 * keeps the widget invisible unless Cloudflare determines a challenge is
+	 * required, and the `convertKitTurnstileFormSubmit` callback submits the
+	 * enclosing form once the challenge is solved.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   ConvertKit_HTML_Parser $parser         Parser wrapping the DOM.
+	 * @param   DOMElement             $button         <button> element.
+	 * @param   string                 $plugin_action  Plugin action string (unused).
+	 */
+	public function attach_to_form_button_dom( $parser, $button, $plugin_action ) {
+
+		unset( $plugin_action );
+
+		$widget = $parser->html->createElement( 'div' );
+		$widget->setAttribute( 'class', 'cf-turnstile' );
+		$widget->setAttribute( 'data-sitekey', esc_attr( $this->settings->cloudflare_turnstile_site_key() ) );
+		$widget->setAttribute( 'data-appearance', 'interaction-only' );
+		$widget->setAttribute( 'data-callback', 'convertKitTurnstileFormSubmit' );
+		$button->parentNode->insertBefore( $widget, $button ); // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
+
+	}
+
+	/**
+	 * Returns the HTML for a Cloudflare Turnstile widget div followed by a
+	 * plain submit button, used by templates that don't have a DOM parser
+	 * available (e.g. the Restrict Content tag view).
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   string   $label          The button's visible label.
+	 * @param   string   $plugin_action  The plugin action string (unused).
+	 * @param   string[] $css_classes    CSS classes for the button.
+	 * @return  string
+	 */
+	public function get_submit_button_html( $label, $plugin_action, $css_classes = array() ) {
+
+		unset( $plugin_action );
+
+		return sprintf(
+			'<div class="cf-turnstile" data-sitekey="%1$s" data-appearance="interaction-only" data-callback="convertKitTurnstileFormSubmit"></div><input type="submit" class="%2$s" value="%3$s" />',
+			esc_attr( $this->settings->cloudflare_turnstile_site_key() ),
+			esc_attr( implode( ' ', $css_classes ) ),
+			esc_attr( $label )
+		);
+
+	}
+
+}
diff --git a/includes/class-convertkit-output-restrict-content.php b/includes/class-convertkit-output-restrict-content.php
index e43883449..1a6412059 100644
--- a/includes/class-convertkit-output-restrict-content.php
+++ b/includes/class-convertkit-output-restrict-content.php
@@ -392,16 +392,13 @@ public function maybe_run_subscriber_authentication() {
 
 		// If Restrict Content is by tag, tag the subscriber.
 		if ( $this->resource_type === 'tag' ) {
-			// Check reCAPTCHA.
-			$recaptcha          = new ConvertKit_Recaptcha();
-			$recaptcha_response = $recaptcha->verify_recaptcha(
-				( isset( $_POST['g-recaptcha-response'] ) ? sanitize_text_field( wp_unslash( $_POST['g-recaptcha-response'] ) ) : '' ),
-				'convertkit_restrict_content_tag'
-			);
+			// Check spam protection (reCAPTCHA or Cloudflare Turnstile, depending on Plugin settings).
+			$spam_protection = new ConvertKit_Spam_Protection();
+			$spam_check      = $spam_protection->verify( 'convertkit_restrict_content_tag' );
 
-			// Bail if reCAPTCHA failed.
-			if ( is_wp_error( $recaptcha_response ) ) {
-				$this->error = $recaptcha_response;
+			// Bail if spam protection failed.
+			if ( is_wp_error( $spam_check ) ) {
+				$this->error = $spam_check;
 				return;
 			}
 
@@ -1469,9 +1466,12 @@ function () use ( $post_id, $resource_id, $resource_type ) {
 					);
 				}
 
-				// Enqueue Google reCAPTCHA JS.
-				$recaptcha = new ConvertKit_Recaptcha();
-				$recaptcha->enqueue_scripts();
+				// Enqueue the active spam protection provider's client-side script.
+				$spam          = new ConvertKit_Spam_Protection();
+				$spam_provider = $spam->get_active_provider();
+				if ( $spam_provider !== false ) {
+					$spam_provider->enqueue_scripts();
+				}
 
 				// Output.
 				ob_start();
diff --git a/includes/class-convertkit-recaptcha.php b/includes/class-convertkit-recaptcha.php
index 0156a047e..92febfe1e 100644
--- a/includes/class-convertkit-recaptcha.php
+++ b/includes/class-convertkit-recaptcha.php
@@ -72,7 +72,7 @@ function ( $scripts ) {
 	 * @param   string $plugin_action       The action to verify the reCAPTCHA response for.
 	 * @return  bool|WP_Error
 	 */
-	public function verify_recaptcha( $recaptcha_response, $plugin_action ) {
+	public function verify( $recaptcha_response, $plugin_action ) {
 
 		// Don't run if the reCAPTCHA or scripts are disabled.
 		if ( ! $this->settings->has_recaptcha_site_and_secret_keys() || $this->settings->scripts_disabled() ) {
@@ -130,4 +130,53 @@ public function verify_recaptcha( $recaptcha_response, $plugin_action ) {
 
 	}
 
+	/**
+	 * Attaches the reCAPTCHA v3 invisible-badge attributes to the given submit
+	 * button element within an existing DOM tree, so that the challenge is
+	 * executed when the button is clicked and the form is submitted via the
+	 * `convertKitRecaptchaFormSubmit` callback.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   ConvertKit_HTML_Parser $parser         Parser wrapping the DOM (unused).
+	 * @param   DOMElement             $button         <button> element to attach attributes to.
+	 * @param   string                 $plugin_action  Plugin action string.
+	 */
+	public function attach_to_form_button_dom( $parser, $button, $plugin_action ) {
+
+		unset( $parser );
+
+		$button->setAttribute( 'data-sitekey', esc_attr( $this->settings->recaptcha_site_key() ) );
+		$button->setAttribute( 'data-callback', 'convertKitRecaptchaFormSubmit' );
+		$button->setAttribute( 'data-action', $plugin_action );
+		$button->setAttribute( 'class', trim( $button->getAttribute( 'class' ) . ' g-recaptcha' ) );
+
+	}
+
+	/**
+	 * Returns the HTML for a submit button with reCAPTCHA v3 invisible-badge
+	 * attributes attached, used by templates that don't have a DOM parser
+	 * available (e.g. the Restrict Content tag view).
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   string   $label          Button's visible label.
+	 * @param   string   $plugin_action  Plugin action string.
+	 * @param   string[] $css_classes    CSS classes for the button.
+	 * @return  string
+	 */
+	public function get_submit_button_html( $label, $plugin_action, $css_classes = array() ) {
+
+		$css_classes[] = 'g-recaptcha';
+
+		return sprintf(
+			'<input type="submit" class="%1$s" value="%2$s" data-sitekey="%3$s" data-callback="convertKitRecaptchaFormSubmit" data-action="%4$s" />',
+			esc_attr( implode( ' ', $css_classes ) ),
+			esc_attr( $label ),
+			esc_attr( $this->settings->recaptcha_site_key() ),
+			esc_attr( $plugin_action )
+		);
+
+	}
+
 }
diff --git a/includes/class-convertkit-settings.php b/includes/class-convertkit-settings.php
index 13c5234b2..e04484524 100644
--- a/includes/class-convertkit-settings.php
+++ b/includes/class-convertkit-settings.php
@@ -424,6 +424,19 @@ public function non_inline_form_limit_per_session() {
 
 	}
 
+	/**
+	 * Returns the active spam protection provider Plugin setting.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  string  none|recaptcha|turnstile
+	 */
+	public function spam_protection_provider() {
+
+		return $this->settings['spam_protection_provider'];
+
+	}
+
 	/**
 	 * Returns the reCAPTCHA Site Key Plugin setting.
 	 *
@@ -503,6 +516,72 @@ public function recaptcha_minimum_score() {
 
 	}
 
+	/**
+	 * Returns the Cloudflare Turnstile Site Key Plugin setting.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  string
+	 */
+	public function cloudflare_turnstile_site_key() {
+
+		return $this->settings['cloudflare_turnstile_site_key'];
+
+	}
+
+	/**
+	 * Returns whether the Cloudflare Turnstile Site Key has been set in the Plugin settings.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  bool
+	 */
+	public function has_cloudflare_turnstile_site_key() {
+
+		return ! empty( $this->cloudflare_turnstile_site_key() );
+
+	}
+
+	/**
+	 * Returns the Cloudflare Turnstile Secret Key Plugin setting.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  string
+	 */
+	public function cloudflare_turnstile_secret_key() {
+
+		return $this->settings['cloudflare_turnstile_secret_key'];
+
+	}
+
+	/**
+	 * Returns whether the Cloudflare Turnstile Secret Key has been set in the Plugin settings.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  bool
+	 */
+	public function has_cloudflare_turnstile_secret_key() {
+
+		return ! empty( $this->cloudflare_turnstile_secret_key() );
+
+	}
+
+	/**
+	 * Returns whether the Cloudflare Turnstile Site Key and Secret Key are defined
+	 * in the Plugin settings.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  bool
+	 */
+	public function has_cloudflare_turnstile_site_and_secret_keys() {
+
+		return $this->has_cloudflare_turnstile_site_key() && $this->has_cloudflare_turnstile_secret_key();
+
+	}
+
 	/**
 	 * Returns whether debugging is enabled in the Plugin settings.
 	 *
@@ -593,11 +672,18 @@ public function get_defaults() {
 			'non_inline_form_honor_none_setting' => '', // blank|on.
 			'non_inline_form_limit_per_session'  => '', // blank|on.
 
+			// Spam Protection.
+			'spam_protection_provider'           => 'recaptcha', // recaptcha|turnstile.
+
 			// reCAPTCHA.
 			'recaptcha_site_key'                 => '', // string.
 			'recaptcha_secret_key'               => '', // string.
 			'recaptcha_minimum_score'            => 0.5, // float.
 
+			// Cloudflare Turnstile.
+			'cloudflare_turnstile_site_key'      => '', // string.
+			'cloudflare_turnstile_secret_key'    => '', // string.
+
 			// Advanced.
 			'debug'                              => '', // blank|on.
 			'no_scripts'                         => '', // blank|on.
diff --git a/includes/class-convertkit-spam-protection.php b/includes/class-convertkit-spam-protection.php
new file mode 100644
index 000000000..f55e98920
--- /dev/null
+++ b/includes/class-convertkit-spam-protection.php
@@ -0,0 +1,138 @@
+<?php
+/**
+ * ConvertKit Spam Protection helper.
+ *
+ * @package ConvertKit
+ * @author ConvertKit
+ */
+
+/**
+ * Returns the currently active spam protection provider (reCAPTCHA or Cloudflare
+ * Turnstile) based on the Plugin settings, and exposes the corresponding POST
+ * field name used to carry the challenge response.
+ *
+ * The active provider is returned only if it has been configured with the
+ * required keys; otherwise `null` is returned so callers can safely treat spam
+ * protection as disabled without provider-specific branching.
+ *
+ * @since   3.3.7
+ */
+class ConvertKit_Spam_Protection {
+
+	/**
+	 * Holds the settings class.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @var     bool|ConvertKit_Settings
+	 */
+	private $settings = false;
+
+	/**
+	 * Constructor.
+	 *
+	 * @since   3.3.7
+	 */
+	public function __construct() {
+
+		$this->settings = new ConvertKit_Settings();
+
+	}
+
+	/**
+	 * Returns the configured spam protection provider instance, or false if the
+	 * selected provider is missing its site and secret keys (in which case the
+	 * caller should behave as if spam protection is disabled).
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  ConvertKit_Recaptcha|ConvertKit_Cloudflare_Turnstile|bool
+	 */
+	public function get_active_provider() {
+
+		switch ( $this->settings->spam_protection_provider() ) {
+			case 'cloudflare_turnstile':
+				if ( ! $this->settings->has_cloudflare_turnstile_site_and_secret_keys() ) {
+					return false;
+				}
+
+				return new ConvertKit_Cloudflare_Turnstile();
+
+			case 'recaptcha':
+			default:
+				if ( ! $this->settings->has_recaptcha_site_and_secret_keys() ) {
+					return false;
+				}
+
+				return new ConvertKit_Recaptcha();
+		}
+
+	}
+
+	/**
+	 * Returns the POST field name the active provider uses for its challenge
+	 * response.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  string
+	 */
+	public function response_field_name() {
+
+		switch ( $this->settings->spam_protection_provider() ) {
+			case 'cloudflare_turnstile':
+				return 'cf-turnstile-response';
+
+			case 'recaptcha':
+			default:
+				return 'g-recaptcha-response';
+		}
+
+	}
+
+	/**
+	 * Reads and sanitizes the challenge response from $_POST for the active
+	 * provider. Returns an empty string if the field is absent.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @return  string
+	 */
+	public function get_response_from_post() {
+
+		$field = $this->response_field_name();
+
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing
+		if ( ! isset( $_POST[ $field ] ) ) {
+			return '';
+		}
+
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing
+		return sanitize_text_field( wp_unslash( $_POST[ $field ] ) );
+
+	}
+
+	/**
+	 * Verifies the challenge response for the active provider.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   string $plugin_action  Plugin action string.
+	 * @return  bool|WP_Error
+	 */
+	public function verify( $plugin_action ) {
+
+		$provider = $this->get_active_provider();
+
+		// No provider configured: allow the request through.
+		if ( ! $provider ) {
+			return true;
+		}
+
+		$response = $this->get_response_from_post();
+
+		return $provider->verify( $response, $plugin_action );
+
+	}
+
+}
diff --git a/resources/backend/js/settings-conditional-display.js b/resources/backend/js/settings-conditional-display.js
index d77d008d9..af8507196 100644
--- a/resources/backend/js/settings-conditional-display.js
+++ b/resources/backend/js/settings-conditional-display.js
@@ -65,7 +65,31 @@ function convertKitConditionallyDisplaySettings(input) {
 			break;
 
 		default:
-			// Iterate through the table rows, hiding any settings.
+			// Group pattern: source has data-conditional-class-prefix; rows opt
+			// into the group by declaring a CSS class of the form
+			// "<prefix><value>". Rows in the group whose class matches the
+			// source's current value are shown; other rows in the group are
+			// hidden. Rows without any matching prefix class are left alone.
+			if (input.dataset.conditionalClassPrefix) {
+				const prefix = input.dataset.conditionalClassPrefix;
+				const expectedClass = prefix + input.value;
+				rows.forEach(function (row) {
+					const inGroup = Array.from(row.classList).some((c) =>
+						c.startsWith(prefix)
+					);
+					if (!inGroup) {
+						return;
+					}
+					row.style.display = row.classList.contains(expectedClass)
+						? ''
+						: 'none';
+				});
+				break;
+			}
+
+			// Single-target pattern: source has data-conditional-element (id)
+			// and data-conditional-value; the matching row is shown when the
+			// source value equals the expected value and hidden otherwise.
 			rows.forEach(function (row) {
 				// Skip if this table row is for the setting we've just changed.
 				if (row.querySelector(`[id = "${input.id}"]`)) {
diff --git a/resources/frontend/js/convertkit.js b/resources/frontend/js/convertkit.js
index 669791f57..bb82a5dd5 100644
--- a/resources/frontend/js/convertkit.js
+++ b/resources/frontend/js/convertkit.js
@@ -90,6 +90,40 @@ function convertKitRecaptchaFormSubmit(token) {
 // Scope the function to the window object as webpack will wrap everything in a closure,
 // resulting in the function not being available globally.
 window.convertKitRecaptchaFormSubmit = convertKitRecaptchaFormSubmit;
+
+/**
+ * Handles form submissions when Cloudflare Turnstile is enabled.
+ *
+ * Turnstile auto-populates a hidden `cf-turnstile-response` input inside the
+ * enclosing form once the challenge is solved, so we just need to submit the
+ * containing form when the callback fires.
+ *
+ * @param {string} token Turnstile response token.
+ */
+function convertKitTurnstileFormSubmit(token) {
+	// Find the Turnstile widget div with the data-callback attribute.
+	const widget = document.querySelector(
+		'.cf-turnstile[data-callback="convertKitTurnstileFormSubmit"]'
+	);
+
+	if (!widget) {
+		return;
+	}
+
+	// Get the parent form of the widget.
+	const form = widget.closest('form');
+
+	if (!form) {
+		return;
+	}
+
+	// Submit the form.
+	form.submit();
+}
+
+// Scope the function to the window object as webpack will wrap everything in a closure,
+// resulting in the function not being available globally.
+window.convertKitTurnstileFormSubmit = convertKitTurnstileFormSubmit;
 /* eslint-enable no-unused-vars */
 
 /**
diff --git a/tests/EndToEnd/forms/blocks-shortcodes/PageBlockFormBuilderCest.php b/tests/EndToEnd/forms/blocks-shortcodes/PageBlockFormBuilderCest.php
index cd0c88202..113640dca 100644
--- a/tests/EndToEnd/forms/blocks-shortcodes/PageBlockFormBuilderCest.php
+++ b/tests/EndToEnd/forms/blocks-shortcodes/PageBlockFormBuilderCest.php
@@ -1182,6 +1182,71 @@ public function testFormBuilderSupportsCoreBlocks(EndToEndTester $I)
 		$I->publishAndViewGutenbergPage($I);
 	}
 
+	/**
+	 * Test the Form Builder block works when Cloudflare Turnstile is enabled
+	 * as the active spam protection provider.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   EndToEndTester $I  Tester.
+	 */
+	public function testFormBuilderWithCloudflareTurnstileEnabled(EndToEndTester $I)
+	{
+		// Setup Plugin and Resources, switching the active spam protection
+		// provider from the default (reCAPTCHA) to Cloudflare Turnstile.
+		$I->setupKitPlugin(
+			$I,
+			[
+				'spam_protection_provider'        => 'cloudflare_turnstile',
+				'cloudflare_turnstile_site_key'   => $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY'],
+				'cloudflare_turnstile_secret_key' => $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY'],
+			]
+		);
+		$I->setupKitPluginResources($I);
+
+		// Add a Page using the Gutenberg editor.
+		$I->addGutenbergPage(
+			$I,
+			title: 'Kit: Page: Form Builder: Block: Cloudflare Turnstile'
+		);
+
+		// Configure metabox's Form setting = None, ensuring we only test the block in Gutenberg.
+		$I->configurePluginSidebarSettings(
+			$I,
+			form: 'None'
+		);
+
+		// Add block to Page.
+		$I->addGutenbergBlock(
+			$I,
+			blockName: 'Kit Form Builder',
+			blockProgrammaticName: 'convertkit-form-builder'
+		);
+
+		// Publish and view the Page on the frontend site.
+		$I->publishAndViewGutenbergPage($I);
+
+		// Confirm the Turnstile widget div is rendered inside the form, immediately
+		// before the submit button, and that the Turnstile client script is enqueued.
+		$I->seeElementInDOM('div.wp-block-convertkit-form-builder form div.cf-turnstile[data-appearance="interaction-only"]');
+		$I->seeElementInDOM('div.wp-block-convertkit-form-builder button[type="submit"]');
+		$I->dontSeeElementInDOM('div.wp-block-convertkit-form-builder button[type="submit"][class*="g-recaptcha"]');
+		$I->seeInSource('<script src="https://challenges.cloudflare.com/turnstile/v0/api.js"');
+
+		// Generate email address for this test.
+		$emailAddress = $I->generateEmailAddress();
+
+		// Submit form.
+		$I->fillField('input[name="convertkit[first_name]"]', 'First');
+		$I->fillField('input[name="convertkit[email]"]', $emailAddress);
+		$I->click('div.wp-block-convertkit-form-builder button[type="submit"]');
+
+		// Cloudflare Turnstile will block this submission as it's automated.
+		// Confirm no subscribed message is displayed.
+		$I->waitForElementNotVisible('.convertkit-form-builder-subscribed-message');
+		$I->apiCheckSubscriberDoesNotExist($I, $emailAddress);
+	}
+
 	/**
 	 * Test the Form Builder block works when reCAPTCHA is enabled.
 	 *
diff --git a/tests/EndToEnd/general/plugin-screens/PluginSettingsGeneralCest.php b/tests/EndToEnd/general/plugin-screens/PluginSettingsGeneralCest.php
index 1f949ca9c..f7c705e98 100644
--- a/tests/EndToEnd/general/plugin-screens/PluginSettingsGeneralCest.php
+++ b/tests/EndToEnd/general/plugin-screens/PluginSettingsGeneralCest.php
@@ -624,6 +624,12 @@ public function testRecaptchaSettings(EndToEndTester $I)
 		// Go to the Plugin's Settings Screen.
 		$I->loadKitSettingsGeneralScreen($I);
 
+		// Provider defaults to reCAPTCHA, so its fields should be visible.
+		$I->seeInField('#_wp_convertkit_settings_spam_protection_provider', 'Google reCAPTCHA v3');
+		$I->seeElement('#recaptcha_site_key');
+		$I->seeElement('#recaptcha_secret_key');
+		$I->seeElement('#recaptcha_minimum_score');
+
 		// Fill in reCAPTCHA settings.
 		$I->fillField('#recaptcha_site_key', $_ENV['CONVERTKIT_API_RECAPTCHA_SITE_KEY']);
 		$I->fillField('#recaptcha_secret_key', $_ENV['CONVERTKIT_API_RECAPTCHA_SECRET_KEY']);
@@ -657,6 +663,69 @@ public function testRecaptchaSettings(EndToEndTester $I)
 		$I->dontSeeInField('#recaptcha_minimum_score', '0.01');
 	}
 
+	/**
+	 * Test that the Spam Protection provider dropdown correctly toggles between
+	 * reCAPTCHA and Cloudflare Turnstile field visibility, and that Turnstile
+	 * settings can be saved and cleared without PHP errors.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   EndToEndTester $I  Tester.
+	 */
+	public function testCloudflareTurnstileSettings(EndToEndTester $I)
+	{
+		// Setup Plugin.
+		$I->setupKitPlugin($I);
+
+		// Go to the Plugin's Settings Screen.
+		$I->loadKitSettingsGeneralScreen($I);
+
+		// Confirm no Cloudflare Turnstile fields are visible.
+		$I->waitForElementNotVisible('#cloudflare_turnstile_site_key');
+		$I->waitForElementNotVisible('#cloudflare_turnstile_secret_key');
+
+		// Switch provider to Cloudflare Turnstile.
+		$I->waitForElementVisible('#_wp_convertkit_settings_spam_protection_provider');
+		$I->selectOption('#_wp_convertkit_settings_spam_protection_provider', 'Cloudflare Turnstile');
+
+		// Turnstile fields should now be visible; reCAPTCHA fields hidden.
+		$I->waitForElementVisible('#cloudflare_turnstile_site_key');
+		$I->waitForElementVisible('#cloudflare_turnstile_secret_key');
+		$I->waitForElementNotVisible('#recaptcha_site_key');
+		$I->waitForElementNotVisible('#recaptcha_secret_key');
+		$I->waitForElementNotVisible('#recaptcha_minimum_score');
+
+		// Fill in Turnstile settings using placeholder values (the settings screen
+		// does not perform a live handshake with Cloudflare; we only need to verify
+		// the values persist).
+		$I->fillField('#cloudflare_turnstile_site_key', $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY']);
+		$I->fillField('#cloudflare_turnstile_secret_key', $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY']);
+
+		// Click the Save Changes button.
+		$I->click('Save Changes');
+
+		// Check that no PHP warnings or notices were output.
+		$I->checkNoWarningsAndNoticesOnScreen($I);
+
+		// Check the Turnstile settings were saved and the provider selection persisted.
+		$I->waitForElementVisible('#_wp_convertkit_settings_spam_protection_provider');
+		$I->seeInField('#_wp_convertkit_settings_spam_protection_provider', 'Cloudflare Turnstile');
+		$I->seeInField('#cloudflare_turnstile_site_key', $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY']);
+		$I->seeInField('#cloudflare_turnstile_secret_key', $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY']);
+
+		// Clear the Turnstile settings by reselecting Turnstile so the fields.
+		$I->clearField('#cloudflare_turnstile_site_key');
+		$I->clearField('#cloudflare_turnstile_secret_key');
+		$I->click('Save Changes');
+
+		// Check that no PHP warnings or notices were output.
+		$I->checkNoWarningsAndNoticesOnScreen($I);
+
+		// Check the Turnstile settings were cleared.
+		$I->seeInField('#cloudflare_turnstile_site_key', '');
+		$I->seeInField('#cloudflare_turnstile_secret_key', '');
+	}
+
 	/**
 	 * Test that no PHP errors or notices are displayed on the Plugin's Setting screen
 	 * when Debug settings are enabled and disabled.
diff --git a/tests/EndToEnd/restrict-content/general/RestrictContentTagCest.php b/tests/EndToEnd/restrict-content/general/RestrictContentTagCest.php
index 5c84db649..15c1d68fa 100644
--- a/tests/EndToEnd/restrict-content/general/RestrictContentTagCest.php
+++ b/tests/EndToEnd/restrict-content/general/RestrictContentTagCest.php
@@ -219,6 +219,65 @@ public function testRestrictContentContainerCSSClasses(EndToEndTester $I)
 		);
 	}
 
+	/**
+	 * Test that restricting content by a Tag specified in the Page Settings works when
+	 * creating and viewing a new WordPress Page, with Cloudflare Turnstile enabled
+	 * as the active spam protection provider.
+	 *
+	 * @since   3.3.7
+	 *
+	 * @param   EndToEndTester $I  Tester.
+	 */
+	public function testRestrictContentByTagWithCloudflareTurnstileEnabled(EndToEndTester $I)
+	{
+		// Setup Kit Plugin, disabling JS and defining Cloudflare Turnstile as
+		// the active spam protection provider with its site and secret keys.
+		$I->setupKitPlugin(
+			$I,
+			[
+				'no_scripts'                      => 'on',
+				'spam_protection_provider'        => 'cloudflare_turnstile',
+				'cloudflare_turnstile_site_key'   => $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY'],
+				'cloudflare_turnstile_secret_key' => $_ENV['CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY'],
+			]
+		);
+		$I->setupKitPluginResources($I);
+
+		// Setup Restrict Content functionality.
+		$I->setupKitPluginRestrictContent($I);
+
+		// Add a Page using the Gutenberg editor.
+		$I->addGutenbergPage(
+			$I,
+			title: 'Kit: Page: Restrict Content: Tag: Cloudflare Turnstile'
+		);
+
+		// Configure metabox's Restrict Content setting = Tag name.
+		$I->configurePluginSidebarSettings(
+			$I,
+			form: 'None',
+			restrictContent: $_ENV['CONVERTKIT_API_TAG_NAME']
+		);
+
+		// Add blocks.
+		$I->addGutenbergParagraphBlock($I, 'Visible content.');
+		$I->addGutenbergBlock(
+			$I,
+			blockName: 'More',
+			blockProgrammaticName: 'more'
+		);
+		$I->addGutenbergParagraphBlock($I, 'Member-only content.');
+
+		// Publish Page.
+		$url = $I->publishGutenbergPage($I);
+
+		// Load Page.
+		$I->amOnUrl($url);
+
+		// Confirm that the CTA form output includes the Cloudflare Turnstile widget.
+		$I->seeElementInDOM('#convertkit-restrict-content form div.cf-turnstile[data-appearance="interaction-only"]');
+	}
+
 	/**
 	 * Test that restricting content by a Tag specified in the Page Settings works when
 	 * creating and viewing a new WordPress Page, with Google's reCAPTCHA enabled.
diff --git a/tests/Support/Helper/KitPlugin.php b/tests/Support/Helper/KitPlugin.php
index 473622aa2..baf6b181c 100644
--- a/tests/Support/Helper/KitPlugin.php
+++ b/tests/Support/Helper/KitPlugin.php
@@ -61,20 +61,23 @@ public function deleteKitPlugin($I)
 	 * @param   bool|array     $options {
 	 *         Optional. An array of settings.
 	 *
-	 *     @type string $access_token               Access Token (if specified, used instead of CONVERTKIT_OAUTH_ACCESS_TOKEN).
-	 *     @type string $refresh_token              Refresh Token (if specified, used instead of CONVERTKIT_OAUTH_REFRESH_TOKEN).
-	 *     @type string $debug                      Enable debugging (default: on).
-	 *     @type string $no_scripts                 Disable JS (default: off).
-	 *     @type string $no_css                     Disable CSS (default: off).
-	 *     @type string $post_form                  Default Form ID for Posts (if specified, used instead of CONVERTKIT_API_FORM_ID).
-	 *     @type string $page_form                  Default Form ID for Pages (if specified, used instead of CONVERTKIT_API_FORM_ID).
-	 *     @type string $article_form               Default Form ID for Articles (if specified, used instead of CONVERTKIT_API_FORM_ID).
-	 *     @type string $product_form               Default Form ID for WooCommerce Products (if specified, used instead of CONVERTKIT_API_FORM_ID).
-	 *     @type string $non_inline_form            Default Global non-inline Form ID (if specified, none if false).
-	 *     @type string $recaptcha_site_key         reCAPTCHA Site Key (if specified, used instead of CONVERTKIT_API_RECAPTCHA_SITE_KEY).
-	 *     @type string $recaptcha_secret_key       reCAPTCHA Secret Key (if specified, used instead of CONVERTKIT_API_RECAPTCHA_SECRET_KEY).
-	 *     @type string $recaptcha_minimum_score    reCAPTCHA Minimum Score (if specified, used instead of 0.5).
-	 *     @type string $usage_tracking             Usage Tracking (if specified, used instead of on).
+	 *     @type string $access_token                    Access Token (if specified, used instead of CONVERTKIT_OAUTH_ACCESS_TOKEN).
+	 *     @type string $refresh_token                   Refresh Token (if specified, used instead of CONVERTKIT_OAUTH_REFRESH_TOKEN).
+	 *     @type string $debug                           Enable debugging (default: on).
+	 *     @type string $no_scripts                      Disable JS (default: off).
+	 *     @type string $no_css                          Disable CSS (default: off).
+	 *     @type string $post_form                       Default Form ID for Posts (if specified, used instead of CONVERTKIT_API_FORM_ID).
+	 *     @type string $page_form                       Default Form ID for Pages (if specified, used instead of CONVERTKIT_API_FORM_ID).
+	 *     @type string $article_form                    Default Form ID for Articles (if specified, used instead of CONVERTKIT_API_FORM_ID).
+	 *     @type string $product_form                    Default Form ID for WooCommerce Products (if specified, used instead of CONVERTKIT_API_FORM_ID).
+	 *     @type string $non_inline_form                 Default Global non-inline Form ID (if specified, none if false).
+	 *     @type string $spam_protection_provider        Spam Protection Provider (if specified, used instead of CONVERTKIT_API_SPAM_PROTECTION_PROVIDER).
+	 *     @type string $recaptcha_site_key              reCAPTCHA Site Key (if specified, used instead of CONVERTKIT_API_RECAPTCHA_SITE_KEY).
+	 *     @type string $recaptcha_secret_key            reCAPTCHA Secret Key (if specified, used instead of CONVERTKIT_API_RECAPTCHA_SECRET_KEY).
+	 *     @type string $cloudflare_turnstile_site_key   Cloudflare Turnstile Site Key (if specified, used instead of CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SITE_KEY).
+	 *     @type string $cloudflare_turnstile_secret_key Cloudflare Turnstile Secret Key (if specified, used instead of CONVERTKIT_API_CLOUDFLARE_TURNSTILE_SECRET_KEY).
+	 *     @type string $recaptcha_minimum_score         reCAPTCHA Minimum Score (if specified, used instead of 0.5).
+	 *     @type string $usage_tracking                  Usage Tracking (if specified, used instead of on).
 	 * }
 	 */
 	public function setupKitPlugin($I, $options = false)
@@ -94,9 +97,12 @@ public function setupKitPlugin($I, $options = false)
 			'product_form'                       => $_ENV['CONVERTKIT_API_FORM_ID'],
 			'non_inline_form'                    => array(),
 			'non_inline_form_honor_none_setting' => '',
+			'spam_protection_provider'           => 'recaptcha',
 			'recaptcha_site_key'                 => '',
 			'recaptcha_secret_key'               => '',
 			'recaptcha_minimum_score'            => '',
+			'cloudflare_turnstile_site_key'      => '',
+			'cloudflare_turnstile_secret_key'    => '',
 		];
 
 		// If supplied options are an array, merge them with the defaults.
diff --git a/views/frontend/restrict-content/tag.php b/views/frontend/restrict-content/tag.php
index 685e51f48..1684d99dd 100644
--- a/views/frontend/restrict-content/tag.php
+++ b/views/frontend/restrict-content/tag.php
@@ -21,14 +21,17 @@
 			<div id="convertkit-restrict-content-email-field" class="<?php echo sanitize_html_class( ( is_wp_error( $this->error ) ? 'convertkit-restrict-content-error' : '' ) ); ?>">
 				<input type="email" name="convertkit_email" id="convertkit_email" value="" placeholder="<?php esc_attr_e( 'Email Address', 'convertkit' ); ?>" required />
 				<?php
-				// Output submit button, depending on whether Google reCAPTCHA is enabled.
-				if ( $this->settings->has_recaptcha_site_and_secret_keys() ) {
-					?>
-					<input type="submit" class="wp-block-button__link wp-block-button__link g-recaptcha" value="<?php echo esc_attr( $this->restrict_content_settings->get_by_key( 'subscribe_button_label' ) ); ?>"
-							data-sitekey="<?php echo esc_attr( $this->settings->recaptcha_site_key() ); ?>"
-							data-callback="convertKitRecaptchaFormSubmit"
-							data-action="convertkit_restrict_content_tag" />
-					<?php
+				// Output the submit button. If a spam protection provider is active
+				// it renders the button plus any accompanying widget div; otherwise a
+				// plain submit button is output.
+				$spam          = new ConvertKit_Spam_Protection();
+				$spam_provider = $spam->get_active_provider();
+				if ( $spam_provider !== false ) {
+					echo $spam_provider->get_submit_button_html( // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+						$this->restrict_content_settings->get_by_key( 'subscribe_button_label' ),
+						'convertkit_restrict_content_tag',
+						array( 'wp-block-button__link', 'wp-block-button__link' )
+					);
 				} else {
 					?>
 					<input type="submit" class="wp-block-button__link wp-block-button__link" value="<?php echo esc_attr( $this->restrict_content_settings->get_by_key( 'subscribe_button_label' ) ); ?>" />
diff --git a/wp-convertkit.php b/wp-convertkit.php
index caead13e1..68c2112eb 100644
--- a/wp-convertkit.php
+++ b/wp-convertkit.php
@@ -66,7 +66,9 @@
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-output-restrict-content.php';
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-post.php';
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-preview-output.php';
+require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-cloudflare-turnstile.php';
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-recaptcha.php';
+require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-spam-protection.php';
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-resource-creator-network-recommendations.php';
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-restrict-content-cache.php';
 require_once CONVERTKIT_PLUGIN_PATH . '/includes/class-convertkit-resource-custom-fields.php';