How to stop spam emails being sent through Contact Form 7 (2024)

We have seen cyber security feature prominently in the news recently following the WannaCry ransomware attack. I’ve been contacted by several people wishing to put a stop to nuisance spam emails sent through the popular Contact Form 7 Email plugin. This article details several steps you can take to put an end to unsolicited mailings…

Install Akismet

Akismet checks your comments and contact form submissions against a global database of spam to prevent your site from publishing malicious content. The plug-in automatically checks all comments and filters out the ones that look like spam. To activate you will need to register with Akismet and obtain an API Key. These keys are free for blogs and personal websites.

Install the Contact Form 7 Honeypot Plugin

This addition to Contact Form 7 adds basic honeypot anti-spam functionality to thwart spambots. While some spam is manually submitted, the vast majority is posted by bots scripted in a specific way to submit spam to the largest number of form types. Using this method they somewhat blindly fill in fields, regardless of whether the field should be filled in or not. This is how a honeypot catches the bot — it introduces an additional field in the form that if filled out will cause the form not to validate.

Add reCAPTCHA

I must have spent a good couple of hours searching for an easy-to-use Captcha plug-in. After many failed attempts I stumbled on Contact Form 7’s own built-in form. To access, simply navigate to ‘Contact’ on the left-hand menu bar and select ‘Integration’. You will be presented with a link to google.com/recaptcha – You will need to sign up to gain an API key. Next, add a shortcode to your contact form and reCAPTCHA is displayed.

These 3 easy steps provide a great barrier against spam and malicious emails being sent via your website’s contact form.