Title: NoCaptcha Spam Filter for Contact Form 7 Author: pontocinza Published: April 22, 2026 Last modified: April 24, 2026 --- Search plugins ![](https://ps.w.org/nocaptcha-spam-filter-for-contact-form-7/assets/banner-772x250. png?rev=3512620) ![](https://ps.w.org/nocaptcha-spam-filter-for-contact-form-7/assets/icon-256x256. png?rev=3512620) # NoCaptcha Spam Filter for Contact Form 7 By [pontocinza](https://profiles.wordpress.org/pontocinza/) [Download](https://downloads.wordpress.org/plugin/nocaptcha-spam-filter-for-contact-form-7.1.1.0.zip) * [Details](https://wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/#description) * [Reviews](https://wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/#reviews) * [Installation](https://wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/#installation) * [Development](https://wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/#developers) [Support](https://wordpress.org/support/plugin/nocaptcha-spam-filter-for-contact-form-7/) ## Description NoCaptcha Spam Filter for Contact Form 7 provides a deterministic, cache-safe, multi- layered defense against automated form submissions for Contact Form 7 without the need for CAPTCHAs or external libraries. The plugin uses a combination of: * Unique Honeypot: A site-specific hidden field that traps bots. * Cryptographic Signing: Ensures form tokens are genuine and haven’t been tampered with. * Anti-Replay Nonces: Each submission is unique; tokens cannot be reused. * Time-Check Validation: Blocks bots that fill out forms faster than humanly possible. * Cache-Safe Architecture: Automatically detects stale tokens on cached pages and refreshes them via a lightweight REST API fallback. ### Scope of Protection This plugin is designed to block the vast majority of automated spam submissions( 99% of common web crawlers) in Contact Form 7, with zero impact on user experience or performance. However, please note: * Not a WAF: It is not a substitute for a Web Application Firewall or server-level security layers for mitigating sophisticated DDoS attacks. * Targeted Attacks: Highly sophisticated bots using headless browsers or manual human bypasses (spam farms) fall outside the scope of lightweight algorithmic protection. For maximum security, we recommend using this plugin as part of a multi-layered defense strategy. ### Configuration (optional, only for advanced users) You can override defaults in ‘wp-config.php’: `php define('CF7NCSP_DOMAIN_SALT',' your-random-string'); define('CF7NCSP_TTL', 2400); // Token lifetime (seconds) define(' CF7NCSP_MIN_TIME', 20); // Minimum time before submission Recommendations * Use a long, random string for ‘CF7NCSP_DOMAIN_SALT’ * Keep ‘CF7NCSP_MIN_TIME’ between 10–30 seconds ### Privacy Policy This plugin is designed with privacy-first principles: * No PII Collection: It does not collect, store, or transmit any Personally Identifiable Information (PII).* No Persistent IP Storage: IP addresses are used transiently for rate limiting and are not stored in plain form or retained beyond a short-lived, temporary cache. * Local Processing: All validation happens on your server. No data is sent to third- party services. * Cookieless: The plugin does not set any browser cookies. ### Disclaimer This plugin is provided “as is”, without warranty of any kind, express or implied. Use at your own risk. While best efforts have been made to ensure reliability and security, the author is not liable for any damages or losses resulting from its use. ** DEVELOPER’S NOTE: ** This plugin is designed to be a lightweight, “set and forget” solution. It focuses on stability and minimal maintenance, with updates provided as needed for bug fixes and compatibility with WordPress and Contact Form 7. Because it is built to be self- sufficient, please be aware that the developer will not implement non-critical feature requests. ## Installation 1. Upload the plugin folder to the ‘/wp-content/plugins/’ directory. 2. Activate the plugin through the ‘Plugins’ menu in WordPress. 3. No further configuration is required. The protection is automatically applied to all Contact Form 7 forms. ## FAQ ### Does it work with WP Rocket or Cloudflare? Yes. If a page is served from cache, the JavaScript will automatically fetch a fresh security token from the server before submission. ### Why are my legitimate submissions being blocked? The plugin requires a minimum of 20 seconds to fill a form. If your users submit forms very quickly, you can change this threshold by defining ‘CF7NCSP_MIN_TIME’ in your ‘wp-config.php’. ### Where can I see the Validation Flow? You can check the full diagram here: [📄 Validation Flow (PDF) ](https://pontocinza.com.br/wp-content/uploads/2026/04/nocaptcha-spam-filter-for-cf7-validation-flow.pdf) ## Reviews There are no reviews for this plugin. ## Contributors & Developers “NoCaptcha Spam Filter for Contact Form 7” is open source software. The following people have contributed to this plugin. Contributors * [ pontocinza ](https://profiles.wordpress.org/pontocinza/) “NoCaptcha Spam Filter for Contact Form 7” has been translated into 3 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/nocaptcha-spam-filter-for-contact-form-7/contributors) for their contributions. [Translate “NoCaptcha Spam Filter for Contact Form 7” into your language.](https://translate.wordpress.org/projects/wp-plugins/nocaptcha-spam-filter-for-contact-form-7) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/nocaptcha-spam-filter-for-contact-form-7/), check out the [SVN repository](https://plugins.svn.wordpress.org/nocaptcha-spam-filter-for-contact-form-7/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/nocaptcha-spam-filter-for-contact-form-7/) by [RSS](https://plugins.trac.wordpress.org/log/nocaptcha-spam-filter-for-contact-form-7/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 (2026.04.22) * Added: hourly cron-based garbage collection for expired transients.* Fixed: explicit version set on wp_register_script. #### 1.0.0 * Initial release. /eof/ ## Meta * Version **1.1.0** * Last updated **5 months ago** * Active installations **20+** * WordPress version ** 5.9 or higher ** * Tested up to **6.9.8** * PHP version ** 7.4 or higher ** * Languages * [Dutch](https://nl.wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/), [English (US)](https://wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/), [Lao](https://lo.wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/), and [Portuguese (Brazil)](https://br.wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/nocaptcha-spam-filter-for-contact-form-7) * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[cf7](https://wordpress.org/plugins/tags/cf7/) [contact form 7](https://wordpress.org/plugins/tags/contact-form-7/)[security](https://wordpress.org/plugins/tags/security/) [spam protection](https://wordpress.org/plugins/tags/spam-protection/) * [Advanced View](https://wordpress.org/plugins/nocaptcha-spam-filter-for-contact-form-7/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/nocaptcha-spam-filter-for-contact-form-7/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/nocaptcha-spam-filter-for-contact-form-7/reviews/) ## Contributors * [ pontocinza ](https://profiles.wordpress.org/pontocinza/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/nocaptcha-spam-filter-for-contact-form-7/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://pontocinza.com.br/apoiando-o-ponto/)