Contact form spam: How do you block bot and advertising messages in WordPress forms?

reCAPTCHA v3 or Cloudflare Turnstile?

Both perform bot checks in the background, usually without showing visitors a puzzle; the main differences concern the provider, pricing plan, and data processed. Contact Form 7’s documentation recommends Turnstile unless there is a specific reason to use reCAPTCHA. Elementor’s form field types include reCAPTCHA and reCAPTCHA V3.

According to Google’s reCAPTCHA v3 documentation , v3 never interrupts users and returns a score between 0.0 and 1.0 for each interaction; 1.0 most likely indicates a genuine interaction, while 0.0 most likely indicates a bot. The document recommends 0.5 as the default threshold and states that tokens expire after two minutes. In Elementor’s integration settings, this threshold can be changed in the “Score Threshold” field; increase the threshold if bots continue getting through.

Cloudflare’s Turnstile documentationdescribes the tool as a smart alternative to CAPTCHA: it can be added to any website without routing the website’s traffic through Cloudflare, and it aims to avoid showing visual puzzles to visitors. The documentation also emphasizes that the widget alone does not protect the form without server-side validation; when the form plugin’s official integration is used, the plugin handles this validation.

A note on user experience and KVKK (Turkey’s Personal Data Protection Law)

Both services load from a third-party provider and process some data about the visitor’s browser. Google’s reCAPTCHA FAQ states that a necessary cookie named _GRECAPTCHA is used for risk analysis; if the badge is hidden, information that the page is protected by reCAPTCHA must remain visible. Cloudflare states that Turnstile processes only the data necessary for its security function and does not access form inputs. How these services should be mentioned in the privacy notice and cookie policy should be assessed with legal counsel; this note is not legal advice.

Contact Form 7 spam: Akismet and the disallowed word list

For Contact Form 7 spam, the plugin’s own documentation highlights three approaches: content filtering with Akismet, bot checks with Cloudflare Turnstile, and WordPress’s disallowed word list. The Turnstile integration is enabled by entering the site key and secret key in the plugin’s Integration menu; the other two are described below.

Akismet integration

Akismet is a service provided by Automattic that classifies submitted content as “spam” or “clean”. According to Contact Form 7’s documentation, the Akismet plugin comes with WordPress, but an API key is required; free keys are available for personal blogs, while business and commercial websites are offered paid subscriptions. To activate Akismet in the form, add the options akismet:author, akismet:author_email, and akismet:author_url to the name, email, and website fields respectively. The documentation recommends using as many of these options as possible for more accurate results and explains that the filter can be tested with special values reserved for testing.

Disallowed word list (Disallowed Comment Keys)

Contact Form 7’s disallowed list documentationexplains that the “Disallowed Comment Keys” box on the Settings > Discussion screen in the WordPress dashboard can also be used for forms. Enter one word or IP address per line in the box; messages containing that word or coming from that IP are classified as spam and are not delivered. To see the sender’s IP address, the documentation recommends adding the [_remote_ip] tag to the notification email. Since this list also affects website comments, enter only spam-specific expressions rather than general words.

Additional filters for Elementor Form spam and WPForms

Alongside honeypots and reCAPTCHA, Elementor offers Akismet integration for form spam; WPForms groups country, keyword, and email list filters in the plugin’s own settings. Which features can be enabled depends on the plan and version in use.

According to Elementor’s help page on blocking spam messages, Akismet integration is available in Elementor Pro plans that support form integrations and requires an Akismet account. After setup, an “Akismet Spam Protection” section appears in the form panel; the fields to scan are specified by pasting their shortcodes into this section. The example values in the section do not work automatically; the shortcodes must be entered manually.

WPForms’ spam documentation describes country and keyword filter options under “Spam Protection and Security” in the form builder, as well as creating allowlists and blocklists based on email addresses. According to the same document, Akismet, reCAPTCHA, hCaptcha, and Cloudflare Turnstile integrations are available in all versions, including free WPForms Lite. The option to store submissions marked as spam in the database is also enabled by default; this option is important for recovering genuine inquiries caught by mistake.

Server-side rate limiting and email field validation

Rate limiting stops large numbers of requests from the same source in a short time before they reach the form plugin; email field validation prevents submissions using malformed or unwanted addresses. Both reduce the load on the plugin layer.

WAF and rate limiting

According to Cloudflare’s rate limiting rules documentation , these rules define a limit for requests matching a particular expression and specify the action to apply when that limit is exceeded. According to the documentation, the free plan allows one rule; it matches a path, counts requests by IP address, and operates over a 10-second period. For example, setting a low limit only for the path receiving form requests slows down a bot making dozens of submissions within seconds. Cloudflare’s other contributions to a website are explained in the what is Cloudflare article, and general hardening steps are covered in the WordPress security guide.

Email fields and form design

Making the form’s email field required and using the email type instead of text eliminates malformed addresses at the browser level. Other adjustments that work in practice include the following:

• Removing the website field: If it is unnecessary for an inquiry, a URL field such as “website address” invites link spam.
• Creating a blocklist: Addresses or domains repeatedly sending spam are added to the WPForms blocklist or Contact Form 7’s word list.
• Validating the phone field: For a local service, refusing nonnumeric characters in the phone field reduces random text entries.

During WordPress form spam prevention, these adjustments do not eliminate spam on their own, but they reduce the number of submissions reaching the filters and make the inbox readable.

How do spam submissions distort GA4 and Google Ads conversion data?

If spam submissions count as form conversions, GA4 reports and Google Ads automated bidding strategies learn from inquiries that are not real. Reports can show “conversions increased” while the number of actual customers remains unchanged.

According to Google Analytics’ enhanced measurement documentation , the form_start event fires on the first interaction with a form in a session, while form_submit fires when the form is submitted. The event definition does not include whether the submission was rejected as spam on the server side. Bots running a browser and manually submitted spam can inflate this event; bots sending requests directly without running a browser may never appear in GA4. Comparing the form plugin’s submission records with GA4 counts reveals this difference.

On the Google Ads side, according to Google’s explanation, Smart Bidding strategies optimize for conversions or conversion value in every auction. If spam is processed as a conversion, the system may consider traffic that brings spam valuable. Counting conversions only on the thank-you page opened after successful submission or on the plugin’s success event is a common way to separate measurement from spam. The setup steps are explained in the Google Ads conversion tracking setup article.

False positive risk: Avoid blocking real customers

Any spam filter can eventually misclassify a genuine inquiry as spam; when tightening filters, keep a record where caught submissions can be reviewed. Contact Form 7’s Akismet documentation explicitly states that automated spam filtering cannot be flawless and that genuine messages can be classified as spam.

The most common causes of false positives in practice are adding words such as “price”, “quote”, or “urgent”, which real customers also use, to the disallowed word list; setting the reCAPTCHA score threshold unnecessarily high; and enabling a country filter for a company that accepts business from abroad. If the Flamingo plugin is installed for Contact Form 7, messages are stored in the database; according to the documentation, marking a message in the spam list as “Not spam” reports that information to Akismet. The option to store spam records in the database in WPForms serves the same purpose. A quick look through the spam folder once a week reveals lost inquiries.

Contact form spam checklist

After protection layers have been configured, verify both that spam has decreased and that genuine submissions arrive without problems. Review this list before considering contact form spam precautions complete:

1. An invisible layer has been added to every form on the website (the Honeypot field in Elementor, modern anti-spam in WPForms).
2. Only one of reCAPTCHA v3 or Turnstile has been selected, and the keys have been entered in the plugin’s integration screen.
3. In Contact Form 7, Akismet options have been added to the name and email fields and tested with test values.
4. Only spam-specific expressions have been entered in the disallowed word list.
5. Submissions and those caught as spam are being stored in the database.
6. Server-side or WAF rate limiting has been considered for the form path.
7. GA4 and Google Ads conversions count only successful submissions.
8. A real test submission has been made from a different device and browser, and delivery of the notification has been confirmed.

This list should be repeated after plugin or theme updates; key settings being reset or a field disappearing after an update is frequently encountered.

When should you consult a specialist for contact form spam?

Specialist support saves time if spam continues despite enabling the layers, if genuine inquiries are suspected of disappearing, or if advertising conversions are mixed with spam. Configuring server-side rate limiting, WAF rules, and conversion measurement together requires more access and care than form settings. An incorrect rule can stop the form from working entirely.

At Onur Freelance, this work is handled within annual WordPress maintenance and updates : forms are tested after updates, spam protection settings are checked to ensure they remain in place, and the work performed is recorded. Maintenance costs between 500–2,000 TL per month depending on the website’s size and scope; the scope is clarified in the initial consultation. If the form notifications themselves land in the recipient’s spam folder, that is a different issue, explained in the email going to spam guide. No protection method carries a promise to eliminate spam entirely; the aim is to reduce spam to a manageable level and deliver real inquiries reliably.