WTF_CSRF_ENABLED Set to False to disable all CSRF protection.
WTF_CSRF_CHECK_DEFAULT When using the CSRF protection extension, this controls whether every view is protected by default. Default is True.
WTF_CSRF_SECRET_KEY Random data for generating secure tokens. If this is not set then SECRET_KEY is used.
WTF_CSRF_METHODS HTTP methods to protect from CSRF. Default is {'POST', 'PUT', 'PATCH', 'DELETE'}.
WTF_CSRF_FIELD_NAME Name of the form field and session key that holds the CSRF token.
WTF_CSRF_HEADERS HTTP headers to search for CSRF token when it is not provided in the form. Default is ['X-CSRFToken', 'X-CSRF-Token'].
WTF_CSRF_TIME_LIMIT Max age in seconds for CSRF tokens. Default is 3600. If set to None, the CSRF token is valid for the life of the session.
WTF_CSRF_SSL_STRICT Whether to enforce the same origin policy by checking that the referrer matches the host. Only applies to HTTPS requests. Default is True.
WTF_I18N_ENABLED Set to False to disable Flask-Babel I18N support.


RECAPTCHA_USE_SSL Enable/disable recaptcha through SSL. Default is False.
RECAPTCHA_PUBLIC_KEY required A public key.
RECAPTCHA_PRIVATE_KEY required A private key.
RECAPTCHA_OPTIONS optional A dict of configuration options.


CSRF errors are logged at the INFO level to the flask_wtf.csrf logger. You still need to configure logging in your application in order to see these messages.