CF7 Captcha Pro adds CAPTCHA verification and six additional spam checks to Contact Form 7. It also provides tools to recover, shop, export, and route form submissions.

Choose a CAPTCHA and set its display

• Google reCAPTCHA v2: Uses the classic checkbox challenge.
• Google reCAPTCHA v3: Checks visitors invisibly with score-based verification.
• hCaptcha: Provides another CAPTCHA option for form verification.
• Cloudflare Turnstile: Verifies visitors in the background and may ask for a click if someone appears suspicious.

Copy the shortcode from the plugin settings into each Contact Form 7 form you want to protect. Multiple forms can use CAPTCHA on the same page. Shortcode settings let you pick normal or compact sizing, a light or dark theme where supported, and a language. Turnstile also works with an automatic theme, and you can combine these options to fit the form layout.

When a protected form is used, only CAPTCHA services enabled and configured with valid API keys are contacted. The selected service loads its script and verifies the response token. Google reCAPTCHA verification also sends the visitor’s IP address.

Screen submissions with six more checks

• Advanced honeypot: Adds invisible trap fields with names that regenerate every 24 hours.
• Time limit validation: Helps block submissions completed unusually quickly or left open for an unusually long time.
• Rate limiting: Caps submissions from an IP address to help limit flooding and excessive email use.
• Geographic blocking: Whitelist the countries you serve or blacklist known spam regions.
• IP pattern blocking: Block individual IP addresses, wildcards, CIDR ranges, or entire subnets.
• Word filter: Checks submissions for spam keywords, phishing URLs, and known scam phrases before they reach you.

Recover and manage form submissions

Lead Recovery captures form data as visitors type, so information from abandoned forms can be retained. You can also store submissions with metadata such as IP address, browser, referrer, and timestamp. Export stored entries as CSV, Excel, JSON, or PDF.

Webhooks send form data to services such as Zapier, Salesforce, Slack, Google Sheets, or a custom API. You can configure multiple webhooks per form, with retry logic included. Mailchimp integration supports adding submissions to lists, field mapping, tags, and opt-in handling. Twilio can send an alert for each submission or an automated SMS reply to clients.

Review activity and configure the extension

Submission Insights shows sender IP, source page, device, and browser details. Logs record spam blocks, webhook calls, and integration events for reviewing activity and investigating workflow issues.

1. Sign up with the CAPTCHA provider you want to use and obtain its Site Key and Secret Key.
2. Install CF7 Captcha Pro in WordPress and enter the provider details in the plugin settings.
3. Open the settings page and copy the supplied shortcode.
4. Add the shortcode to each Contact Form 7 form that needs protection.
5. Configure any defense methods, storage, exports, or integrations needed for your workflow.