How to stop spam in Contact Form 7

A new Contact Form 7 form usually starts getting junk within days: SEO offers, crypto links, fake orders, random text. Contact Form 7 has several official ways to block this. Some stop bots before they submit, some check the content, and some ask the visitor a question. This guide covers how to set up each one, what it catches, and what it costs your visitors.

Why spam submissions also hurt your email delivery

Each spam submission makes your website send an email. That email comes from your domain and contains whatever the spammer typed, often several links to spam sites. Mailbox providers such as Gmail and Outlook read that content. When your domain sends a steady stream of messages full of spam links, its reputation drops, and your real form emails start landing in junk too. See why Contact Form 7 emails go to spam for the other causes.

It gets worse in two cases:

• Mail (2) is turned on. The auto-reply goes to whatever address the spammer entered. That is often a fake address, which bounces, or a real person who never used your form and may report it as spam.
• Your host or mail service limits sending. Spam uses up the hourly or monthly limit, and real messages fail once it is reached.

When Contact Form 7 decides a submission is spam, it does not send the email at all. So every method below protects your sending reputation as well as your inbox.

1. Cloudflare Turnstile

Turnstile is Cloudflare’s alternative to a CAPTCHA. It runs a check in the browser, and most visitors never have to click anything. It is free, and the Contact Form 7 docs recommend it unless you have a reason to use reCAPTCHA. You do not need to use Cloudflare for your DNS to use it.

1. Sign in to the Cloudflare dashboard (create a free account if you need one).
2. Create a Turnstile widget for your site’s domain and copy the site key and secret key.
3. In WordPress, go to Contact → Integration.
4. In the Turnstile box, click Setup integration, paste both keys and save.

Every Contact Form 7 form on the site is now protected. The widget appears at the top of each form. To move it, put a [turnstile] form-tag where you want it in the form template. The tag accepts options such as size, theme and language, for example [turnstile size:compact language:en].

2. reCAPTCHA v3

Contact Form 7 5.1 and later uses Google reCAPTCHA v3. It runs in the background and gives each submission a score. Contact Form 7 treats a submission as spam when the score is at or below the threshold, which is 0.50 by default. There is no checkbox and no picture puzzle.

1. Sign in to the reCAPTCHA Admin Console with a Google account.
2. Register your site, choose reCAPTCHA v3 as the type and enter your domain.
3. Copy the site key and secret key.
4. In WordPress, go to Contact → Integration, click Setup Integration in the reCAPTCHA box, paste the keys and click Save Changes.

Points to know before choosing it:

• Keys created for v2 do not work with v3. Register the site again for v3 keys.
• The v2 “I’m not a robot” checkbox is not part of current Contact Form 7. Old [recaptcha] tags are ignored and removed from the form when it is shown. Getting a v2 checkbox needs a separate plugin.
• The Contact Form 7 docs warn that Google plans to move all reCAPTCHA users to reCAPTCHA Enterprise, which will cost more for many sites. This is one reason they recommend Turnstile.
• reCAPTCHA loads Google scripts on your pages, which you should cover in your privacy policy.

3. Akismet

Akismet checks the content of each submission against a service run by Automattic and answers spam or not spam. It catches messages written by people or by bots that get past a browser check. The Akismet plugin comes with WordPress, so you only need to activate it under Plugins and add an API key. The key is free for personal blogs. Commercial sites need a paid plan.

Akismet does not check a form until you mark its fields with akismet: options. Add as many as your form has:

[text* your-name akismet:author]
[email* your-email akismet:author_email]
[text your-url akismet:author_url]

Contact Form 7 then sends all of the visitor’s input, not only the marked fields, to Akismet with each submission. To test it, enter viagra-test-123 as the name or [email protected] as the email and submit. Akismet always marks these as spam, so you should see the error message with an orange border.

4. The quiz form-tag

A quiz asks the visitor a simple question that a basic bot cannot answer. The text before the pipe is the question, the text after it is the answer:

[quiz math-quiz "12+48=?|60"]

If you list several question and answer pairs in one tag, Contact Form 7 picks one at random each time. A wrong answer shows “The answer to the quiz is incorrect.” The quiz adds a small step for every visitor and does not stop people typing spam by hand, so it works best alongside one of the other methods.

5. The disallowed list

Contact Form 7 uses the WordPress comment block list. Go to Settings → Discussion and find Disallowed Comment Keys. Enter one word, phrase or IP address per line. Any submission that contains one of them, or comes from a listed IP address, is treated as spam and not sent.

To find the IP address of a repeat sender, add the [_remote_ip] mail-tag to the message body on the Mail tab. The check matches anywhere in the text and ignores case, so avoid short words that appear inside normal words. The same list also applies to your blog comments.

6. Honeypot fields

Contact Form 7 does not include a honeypot, but several free plugins in the WordPress plugin directory add one. A honeypot is a hidden field that people never see. Simple bots fill in every field, so a submission with that field filled in is rejected. It adds no friction and sends no data to anyone. It does not stop smarter bots or human spammers. Choose a plugin that is actively maintained and tested with your Contact Form 7 version.

Trade-offs at a glance

• Turnstile: little or no friction, free, stops bots. Loads a Cloudflare script. Does not judge message content.
• reCAPTCHA v3: no friction, stops bots by score. Loads Google scripts, may cost more in future.
• Akismet: no friction, judges the content, catches some human spam. Sends submissions to a third party. Paid for commercial sites.
• Quiz: nothing sent to third parties. Every visitor answers a question.
• Disallowed list: blocks exactly what you list. Needs upkeep and can block real messages.
• Honeypot: invisible and private. Only stops simple bots.

A good default is Turnstile plus Akismet, with the disallowed list for any repeat sender that still gets through.

Store submissions in Flamingo to see what got through

Contact Form 7 does not save submissions. Install the free Flamingo plugin, from the same author, and every submission is stored under Flamingo → Inbound Messages. Normal messages go to the Inbox list and blocked ones go to the Spam list, so you can check whether a real enquiry was caught.

If you use Akismet, open a message and change its Status to Spam or Not Spam. Flamingo reports the correction to Akismet, which improves its future results.

Check that it worked

After setting up protection, submit the form yourself as a normal visitor and confirm the email arrives. Then watch how many form emails your site sends over the next week. If you send through SecureSMTP with Contact Form 7, the delivery log lists every email the form sent, so a drop in junk, or a real message that never went out, is easy to spot. If real visitors start seeing “There was an error trying to send your message”, check the Flamingo Spam list first.

Frequently asked questions