CF7 Captcha Pro

CF7 Captcha Pro adds CAPTCHA verification and six additional spam checks to Contact Form 7. It also helps capture, store, review, and route form submissions.

Choose a CAPTCHA provider

• Google reCAPTCHA v2: Uses a checkbox challenge.
• Google reCAPTCHA v3: Provides invisible, score-based verification.
• hCaptcha: Provides another option for bot verification.
• Cloudflare Turnstile: Verifies users in the background and may request a click if someone appears suspicious.

Shortcode settings control widget size, theme, and language. Choose normal or compact sizing, a light or dark theme where supported, and a language for visitors. Turnstile also works with an automatic theme, and the options can be combined.

Set up protection on a form

1. Register with the CAPTCHA provider you want to use and get its Site Key and Secret Key.
2. Install CF7 Captcha Pro in WordPress and enter the provider details in the extension settings.
3. Copy the supplied shortcode from the settings page.
4. Add the shortcode to each Contact Form 7 form you want to protect. Multiple forms on one page can be protected.
5. Configure the spam checks, submission storage, exports, or integrations needed for your process.

Apply six additional spam checks

These methods work alongside CAPTCHA:

• Advanced honeypot: Invisible trap fields use names that regenerate every 24 hours.
• Time limit validation: Helps block submissions completed unusually quickly or left open for an unusually long time.
• Rate limiting: Caps submissions per IP address to help prevent flooding and excessive email use.
• Geographic blocking: Whitelist countries you serve or blacklist known spam regions.
• IP pattern blocking: Block individual addresses, wildcards, CIDR ranges, or entire subnets.
• Word filter: Checks submissions for spam keywords, phishing URLs, and known scam phrases before they reach you.

Recover and manage submissions

Lead Recovery captures form data as visitors type, which can help retain details from abandoned forms. Submissions can be stored with metadata such as IP address, browser, referrer, and timestamp. Export stored data to CSV, Excel, JSON, or PDF for review and reporting.

Webhooks can send form data to services such as Zapier, Salesforce, Slack, Google Sheets, or a custom API. Configure multiple webhooks per form; retry logic is included. The Mailchimp integration supports adding submissions to lists, field mapping, tags, and opt-in handling. Twilio can send submission alerts or automated SMS replies to clients.

Review submission activity

Submission Insights shows sender IP, source page, device, and browser details. Activity logs record spam blocks, webhook calls, and integration events for review and troubleshooting.

Only CAPTCHA services that you configure and activate are contacted when protected forms are used. Verification sends the CAPTCHA response token to the selected provider, and the user's IP address is also sent for verification.