How to stop Contact Form 7 spam
The free fixes for Contact Form 7 spam (reCAPTCHA, Akismet, honeypots and the disallowed list), what each one misses, and how to handle human-written pitches.
Updated
Contact Form 7 is free, flexible and has been around a long time. Out of the box, it does little to stop spam. Protection comes from integrations and settings you switch on yourself.
Here are the free fixes, what each one misses, and what to do about the messages none of them catch: polite, human-written sales pitches.
The free fixes, and what each one misses
Menus change between versions, so treat the locations below as places to look.
reCAPTCHA v3
Contact Form 7 has a built-in integration for Google's reCAPTCHA v3: you create keys with Google and paste them into the plugin's integration settings. There's no puzzle. Google scores each visit in the background.
What it misses: anything that behaves enough like a person, including a person. Bots are catching up: SentinelOne documented AkiraBot, which uses OpenAI to write unique spam for contact forms on Shopify, GoDaddy, Wix and Squarespace sites while bypassing CAPTCHAs.
Akismet
With the Akismet plugin active, Contact Form 7 can send submissions to it for checking. You mark the name, email and website fields with Akismet options, which the Contact Form 7 docs list. Akismet is good at known spam sources and repeated junk. It's free for personal sites; business sites are expected to pay.
What it misses: new senders and one-off messages. A salesperson writing a careful note from a fresh address looks like any other visitor.
A honeypot
A honeypot is a hidden field that people never see but simple bots fill in. If it has anything in it, the submission is rejected. Contact Form 7 relies on add-on plugins for this, and free ones exist. It's the gentlest fix here, because real visitors never notice it.
What it misses: bots that know to skip hidden fields, and every human.
The disallowed list
Contact Form 7 checks submissions against WordPress's Disallowed Comment Keys list, under Settings > Discussion. Add a word or email address there, one per line, and any submission containing it is treated as spam.
What it misses, and what it catches by mistake: the list matches inside words, so a short entry can trip on innocent messages, and the same list applies to your blog comments. Pitches get reworded constantly, so a phrase list is always a step behind. And a real customer who mentions "SEO" gets blocked along with the agencies.
A quiz question
Contact Form 7's quiz field asks a simple question, like "What color is the sky?", and rejects wrong answers. Simple bots fail it. People and AI pass it, and every real customer gets a small chore.
One catch worth knowing. When Contact Form 7 marks a submission as spam, the email isn't sent and the visitor sees a generic error. The plugin doesn't keep its own copy of messages, so a real customer caught by mistake never reaches you. A storage plugin such as Flamingo, from the same developer, keeps a record in your dashboard.
What all of these miss
Every fix above asks a version of one question: is this a bot? That's still worth asking, but it's no longer the whole story.
When someone at an agency fills in your form by hand to offer an SEO audit, they pass every bot check, because they're a person. Nothing about the message is technically wrong.
Whether it's even unwanted depends on your business. "Can you help us rank higher on Google?" is a lead for an SEO agency and a pitch to a plumber. A spam filter has no idea which one you are.
How to handle human-written pitches
- Add a "What's this about?" menu, and route it. Contact Form 7's drop-down menus can send each option to a different address, a feature its docs describe as a selectable recipient with pipes. Add an option like "Selling a product or service" and point it at a separate inbox. Some sellers pick it honestly; others pick "New customer" anyway. It sorts; it doesn't block.
- Publish a vendor address, and a note. A line like "No sales pitches, please. Selling something? Email vendors@yourdomain.com" gives salespeople a door that isn't your main inbox. It's weak: some people respect it, and bots don't read it.
- Filter in your inbox instead of blocking. Gmail and Outlook rules can move form emails containing "guest post", "backlinks" or "SEO audit" into a folder. Unlike the disallowed list, nothing is lost. The phrases need constant updating, and a real customer will land there now and then, so skim before you delete.
Where Ascue fits
Ascue answers the question the plugins don't ask: does this person want to buy from you, or sell to you? It reads every message along with a one-sentence description of your business, then labels it. Lead is delivered right away. Pitch is held for a weekly digest or delivered tagged, your choice. Spam is blocked and kept for 30 days. Ask me is delivered marked "Ascue wasn't sure", and one click confirms or corrects it, which tunes that site's thresholds.
When in doubt, it delivers, and nothing is deleted. The WordPress plugin works with Contact Form 7 and sends the form's normal email if Ascue doesn't answer within a few seconds. Or skip the plugin and point the form's mail at your private Ascue address. The Contact Form 7 setup covers both. It's free for your first 50 messages a month.