How to Stop Contact Form 7 Spam Without reCAPTCHA

Contact Form 7 is installed on more than ten million WordPress sites, which is exactly why it attracts so much spam. A bot that learns how to submit one Contact Form 7 form can try the same request on thousands of others.

The usual advice is to add a CAPTCHA. It can work, but it adds friction for real visitors and does nothing about spam typed by a person. This guide shows how to stop most Contact Form 7 spam with invisible layers instead, and where a CAPTCHA still makes sense.

Why Contact Form 7 forms get spam

A Contact Form 7 form posts to a predictable handler. Bots do not need to load your page, see your design or wait for a button to appear; they send the request directly. Other submissions come from real people (or people paid by the hour) who paste the same pitch into every form they find, sometimes from genuine-looking Gmail addresses. We cover that case in Contact Form 7 Spam From Real Gmail Addresses.

These are two different problems, and they need different answers: automation needs to be detected, and unwanted content needs to be filtered.

What Contact Form 7 gives you out of the box

According to its WordPress.org listing, Contact Form 7 can work with Akismet, reCAPTCHA and Cloudflare Turnstile as optional integrations. The listing notes that these may send the submitter’s personal data, including the IP address, to the provider. They are worth knowing about, but each one needs its own account or keys, and a bot check does not read what is written in the message.

A layered setup that needs no CAPTCHA

1. Install Maspik and leave the defaults on. Contact Form 7 is supported in the free plugin. After activation, IP verification (a check against Maspik’s blocklist) and the honeypot trap are already enabled. The honeypot adds a hidden field to your forms; bots tend to fill it in and people never see it. Follow the Getting Started guide if you want the full walkthrough.
2. Block the words you keep seeing. In the Textarea Fields section, add the words and phrases that show up in your spam, one per line, for example “seo”, “ranking” or “crypto”. Since version 2.4.0 the blacklist matches whole words, so add variations (“crypto”, “cryptocurrency”) instead of hoping a short word catches them all. See Textarea Field for the details.
3. Tighten the email field. You can block full addresses, domains, wildcards such as *@*.ru, or a fragment that appears anywhere in the address. A + in the list blocks addresses that contain a plus sign, which are often disposable. Details in Email Field.
4. Enforce the phone format you actually accept. If a phone number does not match any format you list, the submission is marked as spam. Formats can use wildcards or regular expressions, as explained in Phone Field.
5. Limit links and message length. Spam messages are often a link and a sentence. Limits on the number of links and on characters in the message field catch a lot of it without reading a single word.
6. Check the spam log after a few days. Every blocked submission is recorded with the reason, the IP address, the country and the form it came from. Use it to remove any rule that blocked a real enquiry. Our guide to reading your spam log shows how.

What each layer catches

• Honeypot and IP verification: automated submissions and traffic from known spam sources.
• Word, email and link rules: messages that look like human-written spam.
• Phone format: throwaway entries with invented numbers.

Our advice: take the CAPTCHA out

We think a lead form should not make people prove they are human. Every challenge is one more step between a visitor and the form, some of those visitors will give up, and a lost enquiry costs far more than a spam message you can delete. The layers above do the same job invisibly.

A safe way to do it: add the layers, remove the CAPTCHA, then watch the spam log and your inbox for a week. If bot volume rises, you can bring a bot check back, behind the content rules rather than in front of your visitors. We compare the two approaches in Maspik vs reCAPTCHA and Maspik vs Cloudflare Turnstile.

Common Contact Form 7 spam patterns and the rule that answers each

• “SEO”, “ranking”, “first page of Google” pitches. Add those words to the textarea blacklist. Because matching is by whole words, add the variations you see.
• The same message under a different name every time. If one name keeps coming back, block it in the text field list, and rely on the message-field words for the rest.
• A message that is only a link. Limit the number of links allowed in the message field.
• Made-up phone numbers. List the formats you accept; anything else is marked as spam.
• Disposable or foreign-domain addresses. Use email fragments or wildcards, such as a + or a domain ending.
• Submissions that never loaded your page. The honeypot, verification key and direct-POST protection are aimed at these.

How to test it before you rely on it

1. Open the form in a private browser window and send an ordinary message with a real-looking name, email and phone number. Confirm it reaches your inbox.
2. Send a second message that contains one of the words you blocked. It should be refused, and a new row should appear in the spam log naming the field and the reason.
3. Remove the test word if it is something a real visitor might write.

Ten minutes of testing now saves you from discovering a rule that is too strict through a lost enquiry.

Frequently asked questions

Does Contact Form 7 have spam protection built in?

According to its WordPress.org listing, it offers optional integrations with Akismet, reCAPTCHA and Cloudflare Turnstile. They each need their own account or keys, and the listing notes they can send submitter data, including the IP address, to the provider.

Will Maspik slow my forms down?

The plugin states that most protection runs locally inside WordPress, that only enabled layers are executed, and that it adds no unnecessary front-end JavaScript.

Can I use Maspik with Akismet or reCAPTCHA on the same form?

Yes. They check different things, so they can run side by side.

Do I need Pro for Contact Form 7?

No. Contact Form 7 is supported in the free plugin. Pro adds country and language rules and the multi-site dashboard.

Get started

Maspik is free for Contact Form 7. See how it works with Contact Form 7, then install it from Plugins > Add New.