Contact Form 7 spam filter
Stop Contact Form 7 spam without a CAPTCHA
The oopspam Anti-Spam plugin checks every Contact Form 7 submission in the background. It blocks spam from bots and real people before it reaches your inbox, with nothing for visitors to solve.
- 4.9 on WordPress.org
- 6,000+ active installs
- 3.5M+ websites protected
The problem
Why Contact Form 7 still gets spam
Contact Form 7 runs on millions of WordPress sites, so spam bots look for it first. Many forms are left without any protection after setup.
Its built-in tools stop simple bots, but none of them read the message itself. Spam typed by real people, and bots that behave like people, still get through.
Contact Form 7 also doesn't save submissions by default, so it's hard to see what was blocked and why.
| reCAPTCHA v3 | Scores visitors in the background, but loads a Google script on every page and can't judge the message itself. |
|---|---|
| Cloudflare Turnstile | Good at stopping bots without puzzles. Doesn't stop spam typed by people. |
| Quiz field | Asks visitors a question. Extra friction for real people, and easy for a human spammer to answer. |
| Akismet | Built for blog comments rather than forms, and needs a paid plan on commercial sites. |
How it works
Set up in about five minutes
No changes to your forms, and nothing for your visitors to solve.
Install the plugin
In WordPress, go to Plugins → Add New, search for “oopspam Anti-Spam”, then install and activate it.
Add your API key
Create a free account, copy your API key and paste it under Settings → oopspam Anti-Spam.
Turn on Contact Form 7
In the Contact Form 7 section of the settings, switch on Activate Spam Protection and write the message spammers will see. That's it.
What happens to a blocked submission? The visitor sees the message you wrote, and the submission is not sent to your inbox. It is saved in the plugin's Spam Entries log with its score and the reason it was blocked. If you use Flamingo, the oopspam score shows there too.
Features
Everything you need to keep Contact Form 7 clean
99.9% accurate detection
Machine learning reads each message and checks the sender's IP and email against a blocklist of 350M+ known spammers. It catches bots and people paid to spam.
Context-aware checks
oopspam can judge a message against what your website is for, so off-topic pitches that look human get caught too.
Country and language filters
Accept submissions only from the countries and languages you serve, and always trust the ones you choose.
VPN, proxy and disposable email blocking
Block submissions from VPNs and cloud providers, and from throwaway email addresses that spammers use once.
Rate limiting
Cap how many times one IP address or email can submit per hour, so floods stop before they reach you.
Logs that explain every decision
Spam and valid entries are kept in your own WordPress database, with the reason each one was blocked. Get email alerts and a spam summary report.
Block and allow lists
Block specific keywords, phrases, emails and IP addresses, and always let trusted emails and IPs through.
One API key, unlimited websites
You pay for spam checks, not per site. Use the same key on every WordPress site you manage.
Private by default
Nothing is stored on our servers unless you turn on remote logging. You can switch off checks that use personal data, and we're GDPR compliant.
Inside the plugin
Compare
oopspam vs the usual Contact Form 7 fixes
| What you get | oopspam | reCAPTCHA | Honeypot | Akismet |
|---|---|---|---|---|
| Stops automated bots | Yes | Yes | Simple bots only | Yes |
| Stops spam typed by real people | Yes | No | No | Partly |
| No challenge for visitors | Yes | v3 only | Yes | Yes |
| No third-party script on your pages | Yes | No | Yes | Yes |
| Country, language and VPN filters | Yes | No | No | No |
| Shows why a submission was blocked | Yes | No | No | No |
You don't have to choose: oopspam works alongside reCAPTCHA or a honeypot if you want to keep them.
Reviews
What site owners say
4.9 out of 5 from 51 reviews on WordPress.org“I'm very happy with the usable data and tools provided to me. It's eliminated all spam, and even the need for Captcha.”
@gotmick on WordPress.org
“We tried various methods including but not limited to Captcha, Honeypot… We strongly recommend oopspam for anyone who values their time and resources.”
Vu Nguyen, Nilead.com
“Pricing is perfect for agencies as they do tiers by actual # of API calls and no limit on the number of sites you can install this on.”
@squarecandy on WordPress.org
Simple, transparent pricing.
Start with 40 free checks a month, no credit card required.
25,000 checks a month · unlimited websites
FAQ
Contact Form 7 spam: common questions
Does oopspam work with Contact Form 7's reCAPTCHA or Turnstile?
Yes. oopspam runs alongside them, so you can keep them or remove them. Without reCAPTCHA, your pages no longer have to load Google's script.
Do I need Flamingo?
No. The plugin keeps its own Spam Entries log in your WordPress database. Flamingo is optional, and if you use it, the oopspam score appears there as well.
My form has more than one message field. Does that matter?
By default, oopspam checks your form's message field. If a form has several text areas, or you use different field names across forms, enter the message field names under Content field mapping, separated by commas.
Do I need to change my forms?
No. Switch on protection once in the plugin settings and it covers every Contact Form 7 form on your site.
Will it slow down my site?
No. The check happens on your server when the form is submitted. Nothing extra loads in your visitors' browsers.
What if a real message gets blocked?
Find it in the plugin's Spam Entries log, which shows why it was blocked. To make sure it doesn't happen again, add the sender's email or IP address to your allowed list, or lower the sensitivity level.
Is oopspam GDPR compliant?
Yes. Logs stay in your own WordPress database, and nothing is stored on our servers unless you turn on remote logging. You can also switch off checks that use personal data. See our GDPR notice and Data Processing Agreement.
How much does it cost?
Every account includes 40 free spam checks a month. Paid plans are priced by the number of checks, not the number of sites, so one API key covers every website you manage. See the pricing above.
Your Contact Form 7 inbox, minus the spam
Start with 40 free spam checks a month. No credit card required.
