Protecting Contact Form 7 Forms From Spam

Hey everyone, and welcome to this video series.

In this series, we’re going to look at several ways of protecting our Contact Form 7 forms from automated submissions by bots, robots and other automated software.

When I use the term “automated”, I mean that the form has been completed and submitted by software rather than by a real person.

What You Will Need

This video series assumes that:

1. You have administrator access to your WordPress website’s backend.

2. You have Contact Form 7 installed and configured.

3. You are familiar with the topics covered in our Using Contact Form 7 video series.

What Are We Trying to Prevent?

The purpose of this series is to reduce automated submissions and the spam emails that they can generate.

It is important to understand that we cannot prevent a real person from visiting your website and completing a form. If a person deliberately submits spam through your form, technologies such as Turnstile cannot determine that the submission is unwanted simply because it was made by a person.

Our focus here is therefore on reducing automated form submissions.

Why Not Google reCAPTCHA?

Many of us are familiar with Google’s reCAPTCHA, which has traditionally been used to help protect websites from automated submissions.

Google’s reCAPTCHA service now has usage and billing considerations, depending on the version and level of usage. For this series, we’re going to look at an alternative called Turnstile which is a service of Cloudflare.

What Is Cloudflare Turnstile?

Cloudflare Turnstile is a service designed to help websites distinguish between legitimate visitors and automated activity.

We will use Turnstile to help detect and block automated submissions to our Contact Form 7 forms.

It is important to understand that Turnstile does not guarantee that every automated submission will be stopped. Instead, it provides an additional layer of protection against bots.

One of the advantages of Turnstile is that, once we have configured it for our website, we can use it with our Contact Form 7 forms without having to create a completely separate configuration for every form.

Additional Protection

We won’t rely on Turnstile alone.

To strengthen our protection against automated submissions, we will also look at implementing a honeypot and a simple challenge, such as a quiz question.

The idea is to use multiple layers of protection. If an automated system manages to get past one method, another method may still be able to identify or discourage the submission.

What We Will Cover

This video series is specifically aimed at protecting Contact Form 7 forms on WordPress websites.

We will start by creating and configuring Cloudflare Turnstile and obtaining the keys required to connect it to our website.

We will then configure Turnstile in WordPress and Contact Form 7 and add it to our forms.

After that, we will look at additional protection using a honeypot and a simple challenge.

Finally, we will test our forms to make sure that everything is working correctly.

The aim is to put several measures in place to significantly reduce automated form submissions and the spam they generate.

So, let’s get started and look at how we can protect our Contact Form 7 forms.