WordPress

How to Stop Contact Form Spam on WordPress

6 min read

WordPress runs a huge share of the web, which makes its contact forms a prime target for spam bots. Plugins like Contact Form 7, WPForms, and Gravity Forms are easy to spot in page source, so automated tools submit to them at scale.

This guide covers built-in options, their trade-offs, and how an embedded filter can evaluate supported WordPress forms without presenting a visible CAPTCHA.

Why WordPress forms get hit so hard

Contact Form 7 and similar plugins use predictable markup and a known submission endpoint. Spam tools fingerprint that markup and fire submissions automatically — the same junk SEO, link, and crypto pitches you see everywhere.

Akismet is focused primarily on comments. Contact-form coverage and built-in controls vary by form plugin, so check the current plugin documentation and test the configured form.

Built-in and plugin options

Common WordPress tactics, and their limits:

CAPTCHA add-ons (reCAPTCHA, hCaptcha) — add a challenge or risk-scoring layer, depending on configuration.
Honeypot plugins — catch lazy bots but miss tools that render JavaScript.
Akismet — strong for comments, weaker for arbitrary contact forms.
Keyword blocklists — can go stale and misclassify legitimate messages.

A layered filter for supported embedded forms

Instead of one plugin per check, SpamShield evaluates supported submissions using sender reputation, content patterns, behaviour such as timing and honeypots, and optional AI. Configured thresholds determine which submissions are blocked.

It runs from a site embed rather than a form-specific PHP plugin. Borderline messages go to a review queue, and evaluated decisions include a reason so you can inspect, release, or reclassify uncertain submissions.

Add it to WordPress

Setup uses a site embed rather than another PHP plugin:

Create a free account at spamshield.dev and add your site.
Copy the embed snippet from Site Setup.
Paste it before the closing body tag — via your theme footer, a code-snippets plugin, or your builder’s custom-code area.
Submit a test message and confirm it appears in your dashboard.

Frequently asked questions

How do I stop Contact Form 7 spam without reCAPTCHA?Use a layered filter that evaluates submissions using reputation, content, and behaviour signals instead of adding a visible challenge. SpamShield uses a site embed; test the configured form with sample submissions before rollout.

Does it work with WPForms and Gravity Forms?The site embed is designed to evaluate supported WPForms, Gravity Forms, Contact Form 7, and custom forms. Test each configured form and review its captured submissions before relying on the filter.

Will it conflict with my other plugins?It is a site script rather than a PHP plugin, so it does not add another PHP plugin to the stack. Theme, consent-manager, and form customisations still vary, so check compatibility on a staging copy first.

SpamShield evaluates form, sign-up, and review submissions using reputation, content, behaviour, and optional AI signals. Configured thresholds determine which submissions are blocked, while borderline submissions stay available for review. Any automated classification can be wrong, so test the setup and review uncertain decisions. It does not place a visible CAPTCHA on the protected form.

Get SpamShield free