Contact Form 7 CAPTCHA & reCAPTCHA Alternative (2026)

If your Contact Form 7 emails keep going to spam, or your CF7 inbox is filling with obviously fake messages, the problem is your form rather than your email provider. Bots submit CF7 forms thousands of times an hour, your site dutifully emails the contents, and your mail server treats those rapid-fire outgoing emails as suspicious. Fix the form and the email problem goes away with it.

The fix is a contact form with a CAPTCHA on it — one that blocks the bot before it ever submits, which stops the runaway outbound-email pattern that pushed your legitimate mail into junk in the first place. This guide shows how to add Prosopo Procaptcha to Contact Form 7 in a few minutes — free for the first 10,000 verifications per month, GDPR-compliant, and a drop-in replacement for the reCAPTCHA integration built into CF7.

Which contact form should have a CAPTCHA?

Every WordPress contact form should have one — CF7 is the most-installed, but WPForms, Gravity Forms, Ninja Forms, Fluent Forms and the rest are just as exposed. The integration steps differ per plugin, but the general process is the same: install a CAPTCHA plugin, get a site key, drop the CAPTCHA field into the form, verify server-side on submission. The rest of this article covers the CF7-specific flow; jump to Related at the bottom for the WPForms and other-plugin equivalents.

Why your Contact Form 7 emails go to spam

Three causes explain CF7 mail going to spam:

1. Bots submitting your form generate sudden bursts of outbound email from your site. Mail providers (especially Gmail and Outlook) flag this volume pattern as suspicious and either drop the messages or send them to junk.
2. Spammed contents include links and phrases that reputation-scoring filters mark as risky.
3. A poorly-protected form means rate-limiting, SPF, DKIM, and DMARC alone aren't enough — the spam is being authored by your own site, so authentication still passes.

A CAPTCHA on the form stops 1 and 2 by stopping the bot from submitting in the first place. The bursts of outbound email stop, your sending reputation recovers, and CF7 mail starts arriving in inboxes again.

Contact Form 7 reCAPTCHA: three reasons to replace it

Contact Form 7 comes with a built-in Google reCAPTCHA integration, but in 2026 the default is quietly costing you. Three reasons to switch to a reCAPTCHA replacement for Contact Form 7:

1. You're paying (or about to). reCAPTCHA is billed per assessment above 10,000/month. A single CF7 form on a moderately busy WordPress site crosses that threshold fast, at which point Google starts charging you for every submission — legitimate or bot.
2. You're leaking user data to Google. reCAPTCHA sets third-party Google tracking cookies on every CF7 page load, feeds them into Google's ad-tech identifiers, and processes the data in the US. For any WordPress site with EU visitors that requires a consent banner, a DPA entry, and a Schrems II transfer basis before the form is even legal to serve.
3. It's letting bots through anyway. Modern CAPTCHA-solving farms clear reCAPTCHA v3 checks for under $1 per 1,000 puzzles. Your CF7 inbox is still full of spam, you're paying Google, and your users are still being tracked.

Procaptcha is a drop-in Contact Form 7 reCAPTCHA alternative that's free for the first 10,000 verifications per month, GDPR-compliant, and installs in the same CF7 form-tag flow you already use. No shortcodes, no consent-banner rework, no ongoing bill.

Which CAPTCHA for Contact Form 7 should you use?

The best CAPTCHA for Contact Form 7 in 2026 is a privacy-first, non-Google option: reCAPTCHA sets tracking cookies without a valid GDPR lawful basis for many EU sites, hCaptcha still shows image puzzles that bots increasingly solve, and both charge for the volume of traffic a typical CF7 form receives once you cross the free tier. Procaptcha for Contact Form 7 is free for the first 10,000 verifications per month, needs no cookie consent banner, and drops into the existing CF7 form-tag flow — no shortcodes, no rewriting your forms.

If you already have a captcha contact form 7 setup with reCAPTCHA or hCaptcha and just want to swap it out, jump straight to the integration steps below.

Contact Form 7 anti-spam options compared

Contact Form 7 can use several kinds of spam protection, and they do different jobs. A CAPTCHA checks whether a person is submitting the form. Akismet checks whether the message itself looks like spam. A honeypot is a hidden field that people never see, so a submission that fills it in came from a bot.

A honeypot only stops bots that fill in every field, so it works best alongside one of the others. The strongest setup is one CAPTCHA plus Akismet, because the CAPTCHA stops automated submissions and Akismet catches spam that a person typed by hand. Use only one CAPTCHA per form: if you are moving from reCAPTCHA or Turnstile to Procaptcha, remove the old keys under Contact > Integration so visitors are not asked to pass two checks.

What is Contact Form 7?

Contact Form 7 is one of the most widely used form plugins for WordPress. It lets users create simple and customisable contact forms for their websites with minimal effort. The plugin has an interface where users can add and configure form fields, such as text, email, radio buttons, checkboxes, and more.

Key features of Contact Form 7 include easy form creation using simple HTML markup, with support for multiple forms on a single site. The plugin also supports email notifications, allowing administrators to receive form submissions directly to their inbox.

Though Contact Form 7’s interface is minimalistic, it supports advanced options such as custom validation messages, file uploads, and form tags to personalise and extend it. The plugin is fully responsive, so forms look good on all devices.

While Contact Form 7 is free to use, users can extend its functionality with a variety of third-party add-ons for features like PayPal integration, multi-step forms, and more. Though it’s relatively lightweight and doesn’t offer as many built-in features as some other plugins, Contact Form 7 is a solid choice for users who want a simple, customisable form plugin for WordPress.

Why Use Prosopo Procaptcha With Contact Form 7?

Prosopo is a specialist bot and agent trust platform. Every block comes with a reason, in plain words, on a proprietary detection engine with an open-source client stack. UK-incorporated, EU-processed, GDPR-native. It stops the abuse patterns WordPress form spam alone doesn't cover:

• Scraping
• Denial of inventory
• Credential stuffing
• Account takeover
• Click through rate/ad fraud
• Ticket scalping
• Black friday automation (and more general sale automation)
• Phishing attacks
• Loyalty programme automation

Prosopo also keeps visitor data out of Google's data controller chain for reCAPTCHA telemetry — the 2026 reCAPTCHA terms change reclassified Google as controller rather than processor.

How to integrate Prosopo Procaptcha with Contact Form 7

1. Install the Prosopo WordPress plugin

2. Register for a free account on Prosopo

3. Login to the Prosopo dashboard, and copy your site key and secret key

4. Add your domain in the Prosopo dashboard, if it is not already present

5. Add your site key and secret key to the Prosopo WordPress plugin settings. You can find them in Site Management in the Prosopo dashboard.

6. Open each Contact Form 7 form under Contact > Contact Forms and add the [prosopo_procaptcha] form tag where you want the widget to appear, usually just above [submit].

Once you save the form, the CAPTCHA is included in it. Repeat this for every Contact Form 7 form you want to add the CAPTCHA to.

How to check the CAPTCHA is working

Two quick tests before you consider the setup done:

1. Load the page in a private/incognito window and confirm the Procaptcha widget renders below the form fields. It should appear on first load without a consent-banner interaction.
2. Submit the form as a real user to confirm the CAPTCHA verifies and the CF7 confirmation message appears. Then check the Prosopo dashboard event log — the verification should show up within a few seconds, tagged to your site key.

If the widget doesn't render, double-check that the site key and secret key in the Prosopo plugin settings match the ones from the Prosopo dashboard (a mismatch of a single character is enough to break it). If the widget renders but submissions are silently blocked, check the CF7 form's other spam-protection settings — Akismet or a caching plugin can be the cause rather than the CAPTCHA itself.

Why am I still getting spam on Contact Form 7?

If spam keeps arriving after you have added Procaptcha, check these causes:

1. A form is missing the tag. The [prosopo_procaptcha] tag protects only the form it is in. Check every Contact Form 7 form on the site, including ones in footers, pop-ups and landing pages, and add the tag to each.
2. Your page cache is serving an old copy of the form. If you use a caching plugin or a CDN, clear the cache after editing a form, then load the page in a private window to check the widget appears.
3. The spam is typed by people. A CAPTCHA proves a person is submitting, so it does not stop someone who fills in your form by hand, such as SEO and link-building pitches. Turn on Akismet for the form, or add the words and addresses that keep appearing to the disallowed list under Settings > Discussion in WordPress, which Contact Form 7 also checks.
4. The spam is not coming through Contact Form 7. Bots also post through comments, registration, login and WooCommerce forms. The Prosopo Procaptcha plugin can protect those as well; turn them on in its settings. Email sent straight to an address published on your page never passes through any form, so no CAPTCHA can stop it.
5. The keys or domain are wrong. If the widget shows an error instead of a checkbox, check that the site key and secret key match the Prosopo portal and that your domain is listed against the site key there.

Related

• WPForms spam protection — the same setup for WPForms, the other most-installed WordPress form plugin.
• Ninja Forms spam protection, Gravity Forms, Fluent Forms — the other big three WordPress form plugins, same integration pattern.
• Spam bot protection — the broader use case: why your forms get spam and how to stop it across every platform.
• Free anti-spam for WordPress — every WordPress plugin integration on one page, plus where Akismet fits.
• Spam Filter — pair the CAPTCHA with email-pattern and traffic-source filtering (throwaway Gmail/iCloud/Yahoo addresses, VPN/Tor, disposable domains).
• reCAPTCHA pricing calculator — if you're currently on reCAPTCHA and wondering what a busy CF7 form actually costs.
• Best CAPTCHA in 2026 — the wider comparison across every mainstream CAPTCHA option.