Contact Form 7: what reCAPTCHA and Akismet actually cost you

Every layer Contact Form 7 offers in 2026 — what each one catches, what it costs the visitors you want to hear from, and why the well-written pitches walk through all of them.

If you run a WordPress site with Contact Form 7, you have probably already tried the usual fixes. You added a CAPTCHA, the obvious junk slowed down, and the mailbox still fills up. The messages that remain are the annoying kind: polite, correctly spelled, addressed to your company by name, and selling something you did not ask for.

That is not a sign your setup is broken. It is a sign that the layers Contact Form 7 offers were built to answer one question, "is a bot submitting this form?", and the mail you are still getting passes that question honestly. This post covers what each layer does, what it costs the customers you want to hear from, the order worth doing things in, and what to do about the rest.

What Contact Form 7 gives you

Contact Form 7's own FAQ on stopping spam lists three things: Akismet filtering, Cloudflare Turnstile, and the disallowed list. Its documentation covers two more, and one gap is usually filled by a separate plugin.

Akismet. Automattic's anti-spam service. You add akismet:author, akismet:author_email and akismet:author_url options to your form fields, and when someone submits, Contact Form 7 sends all of the user's inputs to Akismet, which answers "spam" or "ham". An API key is free for a personal blog; commercial sites need a paid subscription.
Cloudflare Turnstile. Added in Contact Form 7 6.1, released in June 2025. The plugin's documentation now says "We recommend Turnstile unless you have reasons to use reCAPTCHA", and suggests the widget's Managed mode. Cloudflare's Free plan includes unlimited challenges.
reCAPTCHA v3. Since version 5.1, Contact Form 7 uses the reCAPTCHA v3 API, which runs in the background and returns a score. The plugin treats a submission as spam when that score falls below a default threshold of 0.50. The v2 checkbox is only available through an add-on. Google has also moved reCAPTCHA onto Google Cloud: you can no longer create new classic keys, and the free allowance is 10,000 assessments a month.
The disallowed list. Contact Form 7 reuses WordPress's Disallowed Comment Keys under Settings > Discussion. Messages containing a listed word, or sent from a listed IP address, are treated as spam and not delivered.
The quiz tag. A question and answer you write yourself, such as [quiz math-quiz "12+48=?|60"]. The sender has to type the correct answer to submit.
A honeypot, via a plugin. Contact Form 7 does not ship one. A common choice on wordpress.org is CF7 Apps, whose honeypot adds a hidden field that people never see and bots fill in. wordpress.org lists it at 300,000+ active installations.

What each layer catches, and what it costs

Layer	Catches	Misses	Cost to a genuine visitor
Honeypot	Scripts that fill every field they find	Anything driving a real browser, and people	Close to none if the field is properly hidden
Turnstile (Managed)	Scripted submissions	People, paid solvers, well-disguised browsers	Usually nothing; sometimes a checkbox
reCAPTCHA v3	Traffic that behaves unlike a person	People; anything that scores above your threshold	Nothing visible, but a false positive shows them an error
Akismet	Known spam patterns, senders and content	New, fluent, personalised messages	A false positive shows an error, and the message is not stored unless you run Flamingo
Disallowed list	Exact words and IPs you list	Everything you did not predict	Matches inside words, so a genuine message can be blocked
Quiz	Scripts that cannot read the question	People, and any tool that can read	Extra effort for everyone; a real barrier for some

Two rows deserve a closer look.

The disallowed list is cruder than it looks. WordPress's own documentation warns that entries match inside words, so "press" will match "WordPress", and the same list also governs your blog comments. A word you add to stop one campaign can quietly stop a customer.

The quiz asks every visitor to do arithmetic or trivia to reach you. The W3C's note on CAPTCHA accessibility points out that logic puzzles introduce substantial barriers to access for people with language, learning or cognitive disabilities, and gives the example of someone with dyscalculia facing a sum.

Also note what happens when Akismet or reCAPTCHA says "spam". Contact Form 7 suspends the email and shows "There was an error trying to send your message". The plugin does not store submissions itself, so without the Flamingo plugin a wrongly blocked enquiry leaves no record at all.

Why the well-written ones get through

Contact Form 7's documentation is candid about this. Its reCAPTCHA FAQ says CAPTCHA solutions "are designed to be able to block spambots effectively but are helpless against other types of spam. Human spammers can easily get around the program."

A typical message that passes every layer above looks like this:

Hello,

I was looking at your recent project page and the extension work in Harrogate stood out. We help building firms like yours win more of the right enquiries without adding admin.

Would you be open to a short call next week to see if it is a fit?

No honeypot was triggered, because either a person or a real browser filled the form. Turnstile and reCAPTCHA saw a human-shaped session, and in the sense they measure, they were right. Akismet found nothing it recognised, because the text was written for your site and has never been sent anywhere else in that form. There is no word to add to the disallowed list that would not also catch a genuine customer.

The problem is not the sender's behaviour. It is that the message was not really written to you. We have written about why the old filters cannot see this and about the patterns automated sales outreach leaves in the text.

The order worth doing things in

Keep the cheap layers. They still remove the crude traffic, and the crude traffic has not gone away.

Use Turnstile rather than reCAPTCHA unless you already rely on reCAPTCHA elsewhere. It is what the plugin's author recommends, it is free, and it avoids the Google Cloud migration.
Add a honeypot. It costs genuine visitors nothing.
Turn on Akismet if your licence allows it, and install Flamingo alongside it. Give Akismet as many of the akismet: options as your form has fields for. Flamingo keeps what was marked as spam in its own list, so you can check for mistakes and report them back to Akismet.
Use the disallowed list for specific IP addresses only, and sparingly. Contact Form 7 suggests adding the [_remote_ip] special mail-tag to your email body to see where a message came from.

Then stop doing the things that only hurt customers:

Do not make the form longer. Extra required fields do not slow a tool that fills forms for a living. They do slow a customer on a phone.
Do not add a quiz to every form as a reaction to fluent spam. The spam can read.
Do not lower or raise the reCAPTCHA threshold on instinct. The plugin's own FAQ says to analyse the current situation first, and Flamingo shows the score each submission received.

Check the Mail tab before anything else

Some "spam" complaints turn out to be delivery or reply problems, and any change you make later depends on this tab being right. Open the form, go to the Mail tab, and check three fields.

From. This should be an address on the same domain as your website. If you put the visitor's address here, mail providers find it harder to tell your notification apart from spoofed mail. Contact Form 7's mail best-practice page also recommends setting up SPF and DKIM for that domain.
Reply-To. Put the visitor's address here so that pressing reply reaches them. It goes in the Additional headers field as Reply-To: [your-email].
The mail-tags themselves. A mail-tag has to match the name of a field in your form. If the form has [email* your-email], the mail-tag is [your-email]. The syntax is documented here. If a form was copied and a field renamed, the tag can silently come out empty.

Send a test with a real outside email address and reply to it. If the reply goes to the right person, the tab is sound.

Moving the filter from the form to the message

Once the cheap layers are in place, what is left needs someone, or something, to read the message and ask whether a person wrote it to your business. That has to happen after the form, not on it.

In Contact Form 7 this needs no code and no extra plugin. The Mail tab's To field accepts any valid address. Humainbox gives each form its own inbox address; you paste it into To, it reads every message and, once the inbox is active, delivers the ones a person wrote to you and holds the rest with a written reason you can check. Nothing it holds is deleted. The Contact Form 7 integration page shows the field, and how it works covers the modes and thresholds.

Whatever you use, test it before trusting it. In Humainbox that is dry run mode, which delivers everything as before and records what would have been held. Leave it for a week and compare its decisions with your own.

Where it is hard

Shared hosting mail. Notifications leave through whatever mail setup your WordPress site has. If your host throttles or drops outgoing mail, no filter downstream will see those messages. The plugin warns that some hosts block mail from a wordpress@ address that does not exist. If notifications are already unreliable, fix that first; our post on how form notifications are sent goes through it.
Forms with file uploads. Attachments travel inside the notification email, and Contact Form 7 caps the total at 25 MB. Large drawings or photo sets can fail before any filter sees them. Test a submission with a realistic file after any change to the Mail tab.
Several forms on one site. Each Contact Form 7 form has its own Mail tab, so changing one does not change the others. A quote form and a careers form attract different mail and often go to different people. Give each its own inbox rather than routing everything to one address, and check every form, including the old one on a landing page nobody remembers.