Spam submissions are one of the biggest challenges for WordPress websites using Contact Form 7. Without proper protection, bots can flood your forms with unwanted messages, slow down your site, and even send malicious links.
The most effective way to prevent this is by adding CAPTCHA to Contact Form 7. By integrating tools like Google reCAPTCHA or hCaptcha, you can automatically block spam and ensure only real users submit your forms.
In this guide, you’ll learn how to add CAPTCHA to Contact Form 7 step by step, including both reCAPTCHA and hCaptcha integration, along with troubleshooting tips and best practices.
Why You Should Add CAPTCHA to Contact Form 7
If you use Contact Form 7 with CAPTCHA, you can significantly reduce spam messages and protect your WordPress site from automated bots.
Without CAPTCHA protection in Contact Form 7, bots can:
- Flood your inbox with spam messages
- Slow down your website with repeated submissions
- Send malicious links through your forms
- Consume server resources unnecessarily
Adding CAPTCHA creates a verification layer that confirms a submission is coming from a real human user.
Common CAPTCHA options for Contact Form 7 include:
- Google reCAPTCHA – the most widely used option
- hCaptcha – privacy-focused alternative
- Math or quiz CAPTCHA plugins for lightweight protection
Prerequisites: Install Contact Form 7 and CF7 Apps Plugin
Before you start the Contact Form 7 CAPTCHA setup, make sure the required plugins are installed on your WordPress site.
You will need:
- Contact Form 7 – the core plugin used to create and manage your forms
- CF7 Apps – an extension plugin that adds additional features
If you already use Contact Form 7 on your website, you can skip the first step and move directly to installing CF7 Apps.
Install Contact Form 7
Follow these steps to install the plugin:
- Log in to your WordPress dashboard
- Navigate to Plugins → Add Plugin
- Search for Contact Form 7
- Click Install Now, then click Activate
Once activated, a new Contact menu will appear in your WordPress dashboard where you can create and manage your forms.
Install CF7 Apps
Next, install the CF7 Apps plugin, which extends Contact Form 7 and allows you to add advanced features like hCaptcha support.
- Go to Plugins → Add Plugin
- Search for CF7 Apps
- Click Install Now and then Activate
After activation, you’ll see a CF7 Apps section under the Contact menu, where you can enable apps such as hCaptcha spam protection.
Contact Form 7 reCAPTCHA Integration (Step-by-Step)
Google reCAPTCHA is built directly into Contact Form 7, making the integration process straightforward. Here’s how you can add Google reCAPTCHA to Contact Form 7.
Step 1: Get Your Google reCAPTCHA API Keys
First, you need Google keys to connect your website.
- Go to the Google reCAPTCHA website and sign in with your Google account
- Enter the following details:
- Label (your website name – for easy identification)
- Domain name (enter your domain and press Enter)
- Select reCAPTCHA v3 (recommended for Contact Form 7 due to its invisible spam detection)
- Name your project, and after accepting the terms, click Submit.
- On the next page, Google will generate the Site Key and Secret Key. Keep the tab open for later use.
Step 2: Add Google reCAPTCHA to Contact Form 7
To complete the integration, connect the Site Key and Secret Key with Contact Form 7 in your WordPress dashboard.
- Head to WordPress Dashboard and navigate to Contact → Integration
- Find reCAPTCHA, and click Setup Integration.
- Paste your Site and Secret Key, and click Save Changes.
Once saved, you have successfully added Google reCAPTCHA to Contact Form 7.
Step 3: Verify if the reCAPTCHA is working
Contact Form 7 automatically applies reCAPTCHA across forms when enabled.
To test it:
- Visit your contact form page
- Submit a test message
- Ensure the form submits successfully
Because reCAPTCHA v3 runs invisibly, users usually won’t see a checkbox.
Instead, Google assigns a spam score in the background and blocks suspicious submissions. After completing these steps in this Contact Form 7 reCAPTCHA guide, your forms will automatically filter spam submissions using Google’s verification system.
Contact Form 7 hCaptcha Integration (Step-by-Step)
If you prefer a privacy-friendly CAPTCHA, hCaptcha is an excellent alternative. Many website owners choose it to avoid Google tracking. Since Contact Form 7 does not include native hCaptcha support, you need a small helper plugin, i.e., CF7 Apps plugin.
Step 1: Create an hCaptcha Account
- Go to the hCaptcha website
- Choose the free plan (or a paid plan if needed) and create your hCaptcha account.
- Generate your Site Key and Secret Key.
- Copy the keys or keep the tab open for integration purposes.
Step 2: Add hCaptcha Keys in WordPress
Just like Google reCAPTCHA, you have to connect the hCaptcha keys in WordPress, but through the CF7 Apps plugin.
- Go to the WordPress dashboard. Head to Contact → CF7 Apps.
- Click to Spam Protection → hCaptcha. Enable hCaptcha App.
- Paste your:
- Site Key
- Secret Key
- Click Save Settings.
Step 3: Add hCaptcha to Contact Form 7
Once your hCaptcha keys are connected, the next step is to place the hCaptcha field inside your Contact Form 7 form.
Start by opening the form where you want to enable CAPTCHA.
- Go to Contact → Contact Forms in your WordPress dashboard.
- Edit an existing form or click Add Contact Form to create one.
Inside the form editor, you’ll notice a new hCaptcha form tag available in the tag generator. This option appears after installing and enabling hCaptcha support.
Click the hCaptcha tag to open the configuration window. Here you can customize how the CAPTCHA appears in your form.
You’ll see several configuration options:
- Field Type: Select hCaptcha from the dropdown. This defines the CAPTCHA field that will be added to your form.
- Field Name: A default name will be generated automatically. You can rename it if needed. This field name is mainly used internally, so it should remain unique.
- Size: Choose how large the CAPTCHA should appear on the form; Normal or Compact.
- Theme: You can match the CAPTCHA design with your form styling by choosing: Light theme or Dark theme.
- Custom CSS (Optional): If needed, you can add custom CSS to further style the CAPTCHA element and align it with your form design.
- After configuring these settings, click Insert Tag. Contact Form 7 will generate the hCaptcha shortcode and add it to your form editor.
Once saved, the hCaptcha verification field will appear on your contact form, helping block automated bots and spam submissions.
Step 4: Testing Your hCaptcha Contact Form 7 Setup
After enabling any CAPTCHA system, always test your form.
Check:
- Form submissions succeed for real users
- Bots cannot submit the form
- CAPTCHA loads properly on mobile devices
- There are no JavaScript errors on the page
A quick test ensures your CAPTCHA Contact Form 7 configuration works correctly.
Fixing Common Issues
Even simple integrations can sometimes fail. Here are the most common CAPTCHA-related problems and their solutions.
Contact Form 7 reCAPTCHA Not Working:
Check the following:
- Incorrect API Keys: Make sure the correct Site Key and Secret Key are added.
- Domain Not Registered: Ensure your website domain matches the one added in Google reCAPTCHA settings.
- Cache Conflicts: Clear WordPress cache, CDN cache, Browser cache
- JavaScript Conflicts: Sometimes another plugin blocks CAPTCHA scripts. Disable plugins temporarily to test.
Contact Form 7 hCaptcha Not Working:
Try these fixes:
- hCaptcha Plugin Not Activated: Make sure the hCaptcha plugin is installed and activated, and that Contact Form 7 support is enabled in its settings.
- Missing or Incorrect Form Tag: Ensure the hCaptcha form tag (for example, [hCaptcha]) is added correctly inside your Contact Form 7 form editor.
- Domain Not Registered in hCaptcha: Verify that your website domain is correctly added to your hCaptcha account settings.
- JavaScript Optimization Conflicts: Some performance or optimization plugins may delay or block CAPTCHA scripts. Try disabling JavaScript optimization to test if that resolves the issue.
Ready to Secure Your Contact Form 7 Forms?
CAPTCHA is one of the easiest methods of securing your Contact Form 7 forms against spam and automated forms.
However, managing multiple features for Contact Form 7, like CAPTCHA, integrations, and advanced functionality, can become complicated if you rely on several separate plugins.
That is where CF7 Apps can ease things up.
Once your CAPTCHA protection is in place, the only thing left is to optimize the functionality of your forms, and the proper add-ons can make the process a lot easier.
FAQs
Can I use multiple CAPTCHA types on the same form?
Technically, yes, but it is not recommended. Using both reCAPTCHA and hCaptcha together may confuse users and cause script conflicts. It’s best to choose one reliable CAPTCHA method.
Are there lightweight alternatives to reCAPTCHA for Contact Form 7?
Yes. Good lightweight options include:
- hCaptcha
- Cloudflare Turnstile
- Honeypot spam protection
These alternatives often load faster and improve privacy.
Can CAPTCHA affect form submission speed or user experience?
Yes, CAPTCHA can slightly affect form performance depending on the type you use. As an example, reCAPTCHA v2 can slow down submissions because of the visual challenges, whereas reCAPTCHA v3 has insignificant effects, and hCaptcha can display image challenges but mostly works well. The selection of an appropriate CAPTCHA is a way to strike a compromise between spam protection and usability.
Which CAPTCHA is best for Contact Form 7?
reCAPTCHA v3 is best for user experience, while hCaptcha is better for privacy-focused websites. The best choice depends on your site’s needs.