Contact Form 7 CAPTCHA

What Contact Form 7 spam looks like

A form that turns every submission into an email is an easy target. Once a bot has found yours, the messages follow a pattern: offers for SEO and backlinks, links to casino, crypto or phishing sites, text in languages none of your customers write in, and names made of random letters. Most of it comes from scripts that post straight to the form, often from changing IP addresses, so blocking one address does little.

There is a second risk. If your form sends a confirmation to the address the visitor entered (Contact Form 7 calls this Mail (2)), a bot can type a stranger’s address and make your site send mail to them. Let that run for a while and your domain’s sender reputation suffers.

Keyword lists and Akismet catch part of this after the fact. A CAPTCHA works earlier: a submission that fails the check never turns into an email.

How TrustCaptcha protects Contact Form 7 forms

Contact Form 7 support is part of our WordPress CAPTCHA plugin, so one setup gives your whole site the same form spam protection.

When a visitor opens a page with your form, the TrustCaptcha widget starts on its own. The browser solves a small proof-of-work task in the background, and the riskier a request looks, the harder that task gets. That makes sending spam in bulk slow and expensive. From the Solo plan, TrustCaptcha also calculates a bot score from technical and behavioral signals: 0 means probably a human, 1 probably a bot.

When the visitor clicks send, the plugin validates the result on your WordPress server, inside Contact Form 7’s own spam check. If the check passes, the message goes out as usual. If the bot score is above your threshold or the token is missing, Contact Form 7 marks the submission as spam, sends no email and shows an error message. The plugin writes the reason to Contact Form 7’s spam log. The widget then resets, so a real person who mistyped an email address can correct it and send again without reloading the page.

Because TrustCaptcha plugs into Contact Form 7’s spam check, other anti-spam filters that use the same check, such as Akismet, keep working. Since version 3.0 the plugin ships the widget script itself, so your pages load no script from an outside CDN.

Replace reCAPTCHA or Really Simple CAPTCHA in Contact Form 7

On Contact Form 7 sites that already have a CAPTCHA, it is usually one of two: Google reCAPTCHA through Contact Form 7’s built-in integration, or Really Simple CAPTCHA, the image CAPTCHA plugin from the author of Contact Form 7. Both can go once TrustCaptcha runs. Set up TrustCaptcha first, send a test message, and only then remove the old CAPTCHA, so your form is never left without protection.

Moving from reCAPTCHA

Contact Form 7 connects to reCAPTCHA v3 under Contact → Integration. reCAPTCHA v3 shows no puzzle either, so for visitors the switch changes little.

If you want a Contact Form 7 CAPTCHA without reCAPTCHA, remove the reCAPTCHA keys under Contact → Integration once TrustCaptcha is live. Contact Form 7 then stops loading Google’s script.

Moving from Really Simple CAPTCHA

Really Simple CAPTCHA draws a few distorted characters on your server, and the visitor types them into a field. It needs no outside service, which is why it is still around. The cost lands on your visitors: they have to read and type before they can contact you, and text images like these are what OCR tools and CAPTCHA solving services have been reading for years.

To switch, open each form in the Contact Form 7 editor, delete the [captchac] and [captchar] tags and save. Once no form uses them any more, deactivate Really Simple CAPTCHA.