How to Stop Contact Form Spam on WordPress
WordPress runs a huge share of the web, which makes its contact forms a prime target for spam bots. Plugins like Contact Form 7, WPForms, and Gravity Forms are easy to spot in page source, so automated tools submit to them at scale.
This guide covers the built-in options, where they fall short, and how to block spam automatically on any WordPress form — without forcing visitors through a CAPTCHA.
Why WordPress forms get hit so hard
Contact Form 7 and similar plugins use predictable markup and a known submission endpoint. Spam tools fingerprint that markup and fire submissions automatically — the same junk SEO, link, and crypto pitches you see everywhere.
Akismet helps with comment spam but is comment-focused and misses much contact-form abuse, and many form plugins ship with little to no built-in filtering at all.
Built-in and plugin options
Common WordPress tactics, and their limits:
- CAPTCHA add-ons (reCAPTCHA, hCaptcha) — stop some bots but add friction that lowers form completion.
- Honeypot plugins — catch lazy bots but miss tools that render JavaScript.
- Akismet — strong for comments, weaker for arbitrary contact forms.
- Keyword blocklists — go stale quickly and create false positives that hide real messages.
A layered filter that works on any form
Instead of one plugin per trick, SpamShield scores each submission across sender reputation, content patterns, behaviour (timing and honeypots), and optional AI — then only blocks high-scoring spam. It works on any WordPress form because it runs from a small embed snippet, not a plugin tied to one form library.
Borderline messages go to a review queue, so a real inquiry is never silently dropped, and every decision comes with a clear reason.
Add it to WordPress in minutes
Setup is a single snippet — no plugin conflicts:
- Create a free account at spamshield.dev and add your site.
- Copy the embed snippet from Site Setup.
- Paste it before the closing body tag — via your theme footer, a code-snippets plugin, or your builder’s custom-code area.
- Submit a test message and confirm it appears in your dashboard.