Contact Form 7 spam protection
Contact Form 7 is free, flexible and hugely popular, which also makes its forms a favourite target for bots. Out of the box it relies on you to add spam protection.
The short answer
To stop spam from Contact Form 7: add a honeypot field with a honeypot add-on, connect an anti-spam service in Contact → Integration (such as reCAPTCHA v3), use Akismet for content filtering if you have a licence, and block link-heavy messages with WordPress's disallowed keys. Keep a copy of messages with a storage add-on so blocked ones can be checked.
Step by step for Contact Form 7
- Update Contact Form 7 to the latest version.
- Add a honeypot. Install a well-maintained honeypot add-on for CF7, then add its honeypot tag to each form.
- Connect an anti-spam service. In Contact → Integration, CF7 lists the services your version supports, such as reCAPTCHA v3. Add the site key and secret key, then send a test message.
- Use disallowed words. CF7 checks WordPress's Settings → Discussion → Disallowed Comment Keys. Add common spam phrases and link patterns.
- Save messages. CF7 doesn't store messages by default; a storage add-on lets you find anything that was caught or lost.
- Check each form, including old ones in footers and landing pages.
Why CF7 still gets spam with reCAPTCHA
- Human spam: reCAPTCHA v3 passes real people, including people paid to paste sales pitches.
- Low scores accepted: the default threshold lets some bots through.
- Old forms or duplicated forms without the protection.
Adding a honeypot and a time check alongside reCAPTCHA usually closes the gap. For the reasoning, see honeypot vs CAPTCHA.
When to go further
If spam survives all of this, bots are likely posting directly to CF7's submission endpoint. Server-side protection with a signed one-time token and rate limit stops that. We can install it without changing your forms.
Common questions
Does Contact Form 7 have spam protection built in?
It has integrations with anti-spam services and uses WordPress's disallowed keys, but no built-in honeypot. Most sites add one with an add-on.
Is reCAPTCHA v3 enough for Contact Form 7?
It stops many bots but not all, and not human spam. Combine it with a honeypot and link rules.
Why don't I see blocked CF7 messages?
CF7 doesn't save messages by default. Add a storage add-on so you can review them.