Spam protection for Contact Form 7

Let the real messages through.

A small, focused WordPress plugin that quietly makes spam harder — without sending your visitors or their data anywhere else.

v2.2.0 latest release GPLv3 licensed
contact-form.local
Send us a messageWe usually reply within one business day.
Your name
Alex Morgan
Your email
alex@example.com
Your message
Protected by Simple HoneypotSend message
Honeypotfield is quiet
Human checklooks good
WordPress native Local-first by design No external services Built for CF7

One plugin, several quiet signals

Good spam protection is layered.

Most bots are noisy. Simple Honeypot gives your forms a few extra ways to tell the difference between a person and a script — while keeping the visitor experience simple.

01

Honeypot fields

Invisible fields catch bots that fill in everything. Real visitors never need to think about them.

The classic layer
03

Proof of Work

An optional browser puzzle adds a small cost to automated submissions without slowing people down.

For the persistent ones
04

Blocking rules

Block IPs and email patterns with wildcards or CIDR support. Keep the rules in your own dashboard.

Your rules, your call
06

Private by default

Checks happen on your server. No visitor tracking, data sharing, or third-party anti-spam account.

A calmer setup

A straightforward workflow

Quiet in the front. Clear in the back.

Visitors get a normal Contact Form 7 experience. You get sensible controls and a record of what your defenses are seeing.

Read the setup guide
01

Add a honeypot tag

Drop [honeypot] into a Contact Form 7 form. No new service or account required.

02

Choose your layers

Turn on timing, Proof of Work, and the rules that fit the site. Global settings can be overridden per form.

03

Keep an eye on the signal

Review blocked events in the dashboard, tune the rules, and let legitimate messages keep moving.

A dashboard you can understand

Settings that explain themselves.

See the controls, rules, forms, and reports in one familiar WordPress admin experience. No mystery settings hidden behind a separate platform.

Settings / Simple Honeypot for Contact Form 7
Simple Honeypot settings screen showing time check, token, proof of work, and data controls
Configure your layersTiming, token lifetime, Proof of Work, and event retention.
Reports / Recent events
Simple Honeypot reports screen showing blocked spam summary and recent events
Know what got caughtBlocked events with useful reasons, form names, and request details.

Prefer to keep things simple? Start with the honeypot and add more layers when a site needs them.

Explore all features

Made for the people behind the form

Less spam for everyone involved.

Whether you write the site, own the site, or look after a dozen of them, the goal is the same: fewer junk submissions and less maintenance.

For developers

Keep your stack close to home.

Use WordPress hooks and a small, readable plugin that plays nicely with Contact Form 7, caching, and record-keeping plugins.

Browse the code
For site owners

Stop babysitting the inbox.

Get sensible defaults, clear settings, and a spam log that tells you more than “something went wrong.”

See common questions
For agencies

Ship a calmer handoff.

Give clients a practical anti-spam layer without adding another monthly service or another dashboard to explain.

Plan an install

A few useful answers

Good to know before you install.

Still curious? The full documentation and issue tracker live on GitHub.

Read the full FAQ
Does it send form data to a third party?

No. The checks run locally on your WordPress site. There is no external anti-spam account, visitor tracking, or data sharing.

Will visitors notice the protection?

Usually not. Honeypot fields are invisible, timing checks happen quietly, and the default Proof of Work setting is designed to take roughly 50–100ms in a modern browser.

Can I use it on more than one form?

Yes. Add the [honeypot] tag to as many Contact Form 7 forms as you need, then use global settings or customize individual forms.

What if I need to block a specific IP or email?

Add a rule from the Rules tab. IP rules support wildcards and CIDR notation, while email rules support wildcard patterns.

Ready when you are

Give your forms a little peace and quiet.

Simple Honeypot is free, open source, and ready to try on the next WordPress site you touch.

Get started on GitHub WordPress 6.7+ · PHP 7.4+