A contact form needs to accept genuine enquiries as well as reject spam. Adding several unrelated CAPTCHA plugins is not automatically the best answer. Start with the spam protection your current Contact Form 7 version supports.
Choose a supported integration
Contact Form 7 documents native integrations for Cloudflare Turnstile, reCAPTCHA v3 and Akismet. Choose an appropriate option for the site and review the external service’s terms, data handling and any current costs. Do not assume an old article’s key type or free allowance still applies.
Configure through the integration screen
For native Turnstile support, create a widget for the correct hostname, use the recommended Managed mode and enter its keys in Contact → Integration → Turnstile. Keep secret keys private. Contact Form 7 handles the widget; its current native integration does not require manually embedding a challenge script.
If you choose reCAPTCHA v3 instead, use the matching v3 keys and follow the current integration guide. The old v2 instructions and v2 keys are not interchangeable with the supported v3 integration.
Decide whether to store submissions
Contact Form 7 does not itself provide a submission inbox. Its documentation describes Flamingo for message storage. Before enabling storage, decide who needs access, which personal data is retained and how long it should be kept. Do not install a logger simply because an old tutorial listed it.
Test the whole journey
On an authorised test environment, check keyboard use, required fields, spam handling and actual delivery to the intended mailbox. Test a legitimate enquiry as well as a blocked submission. A success message alone does not prove an email arrived. Arrange test messages with the site owner before sending them.
If spam continues, investigate the observed submissions and existing filters before piling on extra plugins. Keep the form usable, and review the mail configuration separately from the CAPTCHA. See our WordPress support for help with a specific fault.
Sources and further reading
Guidance checked 26 October 2026: Contact Form 7’s native Turnstile integration; Contact Form 7’s message-storage guidance.