Protect Contact Form 7 Submissions with CF7 Captcha Pro

CF7 Captcha Pro includes CAPTCHA verification and six additional spam checks to Contact Form 7. It also provides tools to recover, shop, export, and route form submissions.

CAPTCHA providers and show settings

Choose Google reCAPTCHA v2 or v3, hCaptcha, or Cloudflare Turnstile. reCAPTCHA v2 uses a checkbox, while v3 provides invisible, score-based verification. Turnstile verifies visitors in the background and may request a click if someone appears suspicious. Multiple forms can use CAPTCHA on one page.

Copy the shortcode from the plugin settings into each Contact Form 7 form you want to protect. Shortcode options include normal or compact sizing, a language, and light or dark themes where supported. Turnstile also works with an automatic theme, and the options can be combined.

Six additional spam checks

• Advanced honeypot: Adds invisible trap fields whose names regenerate every 24 hours.
• Time limit validation: Helps block submissions completed unusually quickly or forms left open for an unusually long time.
• Rate limiting: Caps submissions from an IP address to help reduce flooding and excessive email use.
• Geographic blocking: Whitelist countries you serve or blacklist regions associated with spam.
• IP pattern blocking: Block individual IP addresses, wildcards, CIDR ranges, or entire subnets.
• Word filter: Checks submissions for spam keywords, phishing URLs, and known scam phrases.

Recover and manage submissions

Lead Recovery captures form data as visitors type, helping retain information from abandoned forms. Submission storage saves entries with metadata such as IP address, browser, referrer, and timestamp. Export stored data as CSV, Excel, JSON, or PDF.

Webhooks can send form data to services such as Zapier, Salesforce, Slack, Google Sheets, or a custom API. You can configure multiple webhooks per form, with retry logic. The Mailchimp integration supports adding submissions to lists, field mapping, tags, and opt-in handling. Twilio can send instant submission alerts or automated SMS replies to clients.

Submission insights and logs

Submission Insights shows sender IP, source page, device, and browser details. Logs record spam blocks, webhook calls, and integration events for activity review and troubleshooting.

Setup

1. Sign up with the CAPTCHA provider you plan to use and obtain its Site Key and Secret Key.
2. Install CF7 Captcha Pro in WordPress and enter the provider details in the plugin settings.
3. Open the settings page and copy the supplied shortcode.
4. Add the shortcode to each Contact Form 7 form that needs protection.
5. Configure any additional spam checks, storage, exports, or integrations for your process.

Only CAPTCHA services enabled and configured with valid keys are contacted when protected forms are used. Each selected provider receives the CAPTCHA response token for verification. Google reCAPTCHA also receives the visitor’s IP address.