How to stop contact form spam in WordPress

A guide for site owners. Updated October 17, 2026. Settings are named as in Contact Form 7 6.2 and WPForms Lite 2.0.

Your contact form sends you an email every time someone fills it in, and most of them are junk: links to sketchy sites, "SEO services", fake invoices. Nearly all of it comes from bots, and bots give themselves away in a few ways. Here's how to catch them, starting with what your form plugin can already do.

How bots give themselves away

• They post straight to the form, without ever loading the page it's on.
• They fill in every field, including ones a person can't see. A hidden field like that is called a honeypot.
• They're fast. A form filled in and sent within a couple of seconds of the page loading wasn't typed by a person.
• They repeat themselves, from the same address, again and again.

Checks for those four things are invisible to real people. A CAPTCHA works too, but every real visitor pays for it with a puzzle, so it's best kept for when the invisible checks aren't enough. And some spam is typed by people, or written by AI and pasted in. No form check stops all of that; a content filter like Akismet helps there.

Contact Form 7

• Akismet. Install and set up the Akismet plugin, then add akismet:author to your name field and akismet:author_email to your email field in the form's tags, for example [text* your-name akismet:author]. Akismet then checks each message's content. It needs a key from akismet.com: free for personal sites, paid for business sites.
• A word list. Contact Form 7 checks messages against WordPress's own list, under Settings, Discussion, Disallowed Comment Keys. Add words and web addresses you keep seeing in spam, one per line. The same list applies to comments.
• A CAPTCHA, if you need one. Under Contact, Integration, Contact Form 7 connects to Google reCAPTCHA or Cloudflare Turnstile. Both need free keys from Google or Cloudflare.

Contact Form 7 has no built-in honeypot, timing check or limit on repeats; those need another plugin.

WPForms

Open your form in the form builder and go to Settings, Spam Protection and Security:

• Enable modern anti-spam protection. Keep it on: it's WPForms' invisible check.
• Enable minimum time to submit. Turn it on, so forms sent faster than a few seconds are refused.
• Enable Akismet anti-spam protection, once the Akismet plugin is set up.
• A CAPTCHA, if you need one. Add hCaptcha, Google reCAPTCHA or Cloudflare Turnstile keys under WPForms, Settings, CAPTCHA, then switch it on for the form.

WPForms' country and keyword filters are part of its paid version.

Comments and reviews, while you're there

Under Settings, Discussion, Comment author must have a previously approved comment holds first-time commenters for you to approve, and Number of links to allow in a comment before holding for moderation catches most link spam. On a WooCommerce store, letting only people who bought a product review it stops fake reviews: see the fake accounts guide.

How Ropeline Pro does it, with no puzzle

Ropeline Pro guards WordPress comments, WooCommerce product reviews, Contact Form 7 and WPForms, with the four invisible checks:

• A hidden honeypot field on each form.
• A timing token: a form posted without its page being loaded, or sent in under 3 seconds, is refused.
• A limit of 5 posts in 10 minutes from one address, for contact forms and for comments separately.
• Each refusal is in your activity log with the reason. Contact Form 7 marks the message as spam, so it isn't sent to you.

Caching doesn't break your forms, and verified AI agents aren't held to the limit. For its first 7 days Ropeline only records what it would have stopped, so you can see it won't get in anyone's way. Spam protection is part of every Pro plan, including the $5-a-month Site plan, and the first 14 days are free.

Questions

Does it replace Akismet?

They do different jobs and work well together. Ropeline stops bots by how they behave, before the message is sent. Akismet looks at what the message says, which also catches spam a person typed.

Will real people ever be stopped?

Rarely. A person would have to send a whole form in under 3 seconds, or more than 5 in 10 minutes from one address. The hidden field is marked so that browsers don't fill it in on their own.

My form is on a cached page. Does it still work?

Yes, with one check fewer. A cached page carries the time it was cached, so the 3-second check can only catch bots on pages that aren't cached. The hidden field and the limit on repeats work either way, and an old token is never held against a real visitor.