How to Stop Contact Form 7 Spam (2026 Guide)

Contact Form 7 powers over 10 million WordPress sites, which makes it one of the most common form plugins and one of the most common spam targets. Unlike some form builders, CF7 doesn’t ship with every anti-spam tool turned on by default, so a lot of sites end up fighting junk submissions without realizing what’s actually available. Here’s a practical walkthrough of what works, including CF7’s own tools and where a dedicated layer like Spamvora fits in.

Quick answer: CF7’s native tools (Akismet, reCAPTCHA v3, Turnstile) handle most bot spam once configured correctly, that’s Steps 1–5 below. If you’re still getting junk that looks human but isn’t a real lead, especially from paid ad traffic, Spamvora plugs directly into Contact Form 7 and scores every submission in real time, catching what bot filters are never built to catch. More on that in Step 6.

The two kinds of spam CF7 users deal with

• Bot submissions – automated scripts finding your form and submitting junk at scale, usually random text, promotional links, or nonsense email addresses.
• Human-submitted junk – real people entering fake or low-effort information, common on quote requests and lead-gen forms tied to paid traffic.

Contact Form 7’s official tools mostly target the first category. Worth knowing that going in, because it changes which fix you reach for.

Step 1: Set up Akismet (CF7’s own “centerpiece” spam filter)

Unlike WPForms or Gravity Forms, Contact Form 7 doesn’t have a one-click honeypot toggle baked in — but it does have deep native Akismet support, and CF7’s own documentation calls Akismet the centerpiece of its spam prevention strategy.

To wire it up:

1. Activate the Akismet plugin (it ships bundled with WordPress core) and connect an API key.
2. In your CF7 form template, add the akismet:author, akismet:author_email, and akismet:author_url options to the matching name, email, and URL fields.
3. Save the form. CF7 will now pass every submission to Akismet before sending the notification email.

If Akismet flags a submission as spam, CF7 blocks the email and shows an error message to the sender instead. You can test this is working by submitting the test values viagra-test-123 as the name or akismet-guaranteed-spam@example.com as the email — both are reserved by Akismet to always return a spam verdict.

One limitation: CF7 doesn’t store submissions anywhere by default, spam or otherwise. If you want to review what’s being caught (and correct false positives), install the free Flamingo plugin, which logs every submission into an Inbox/Spam view inside wp-admin.

Step 2: Add a honeypot field

This is the part CF7 doesn’t include natively. A honeypot is a hidden field that’s invisible to real visitors but gets auto-filled by bots, which flags the submission instantly. Since CF7 has no built-in honeypot, you’ll need a small dedicated plugin (several free options exist in the WordPress plugin directory) to add a [honeypot] form-tag to your template.

This is free, has zero impact on real users, and catches the laziest bots outright — worth adding alongside Akismet rather than instead of it.

Step 3: Turn on reCAPTCHA v3 or Cloudflare Turnstile

CF7 has official support for both:

• reCAPTCHA v3 — under Contact → Integration in wp-admin, add your site key and secret key. It scores visitor behavior in the background with no visible challenge, so it doesn’t hurt conversion the way older checkbox CAPTCHAs do.
• Cloudflare Turnstile — CF7’s newer, privacy-friendlier alternative to reCAPTCHA, also configured under Integration.

Either one adds a second layer that catches bots sophisticated enough to slip past a honeypot.

Step 4: Use the built-in quiz field for smaller forms

If you’d rather not rely on a third-party service at all, CF7 has a native [quiz] tag that lets you add a simple question-and-answer challenge (e.g., “What is 3 + 4?”). It won’t stop determined spam, but it’s a zero-setup filter for low-traffic forms that mostly deal with unsophisticated bots.

Step 5: Filter by keyword or domain

Under your form’s Additional Settings, the blacklist_keywords option lets you reject submissions containing specific words or email domains — useful once you notice a spam pattern (a repeated phrase, a disposable email provider, a specific keyword like “seo” or “casino” showing up in junk submissions).

Step 6: Handle fake leads separately from bot spam

Everything above — honeypot, Akismet, reCAPTCHA, quiz fields is built to catch bots. None of it is built to judge whether a real human’s submission is a genuine lead. If you’re running Google or Meta ads to a CF7 quote form and still seeing entries that pass every filter but are obviously not real prospects (vague messages, mismatched details, competitors scoping your pricing), that’s a lead-quality problem, not a bot problem, and it needs a tool that evaluates the content and context of the submission rather than just checking for bot patterns.

This is the layer AI-based tools like Spamvora are built for scoring each CF7 submission in real time and flagging the ones that look human-submitted but aren’t genuine, which matters most once you’re paying per click or per lead. Setup takes a few minutes, and you can try it free before committing to a plan.

Quick setup checklist

• Akismet connected with akismet:author / akismet:author_email tags on your form
• Flamingo installed to review flagged submissions
• Honeypot field added via a dedicated plugin
• reCAPTCHA v3 or Turnstile enabled under Integration
• Blacklist keywords added for any repeating spam patterns
• Fake-lead scoring added if you’re running paid traffic to the form

The bottom line

Contact Form 7’s spam tools are solid once they’re actually configured Akismet and reCAPTCHA cover most bot traffic, and a honeypot plugin closes the rest. But like WPForms and Gravity Forms, none of CF7’s native tools are built to tell a real lead from a human who’s just wasting your time. If you’ve set up everything above and you’re still seeing junk that looks legitimate enough to get through, the fix isn’t another spam filter it’s a tool built to score lead quality specifically.

See how this works in practice: Spamvora integrates with Contact Form 7 and scores every submission in real time start your free trial or explore the features first.

Getting the same problem on other form plugins? Here’s how to fix it on WPForms and Gravity Forms. Or if Akismet alone isn’t cutting it, see our comparison of Akismet alternatives.