LukasApps CAPTCHA tools for Contact Form 7

What you get with Pro

6-Layer Spam Defense — additional spam-blocking methods that work quietly in the background: – Advanced Honeypot — invisible trap fields with names that regenerate every 24 hours. – Time Limit Validation — bots submit in 0.2 seconds. Humans take 15–30. This blocks anything that moves too fast (or stays too long). – Rate Limiting — caps submissions per IP so bot networks can’t flood your inbox or burn through your email quota. – Geographic Blocking — whitelist only the countries you serve, or blacklist known spam regions. – IP Pattern Blocking — block single IPs, wildcards, CIDR ranges, or entire subnets when you know exactly where an attack is coming from. – Word Filter — scans every submission for spam keywords, phishing URLs, and known scam phrases before it reaches you.

Lead Recovery — captures form data in real-time as visitors type, so you don’t lose leads from abandoned forms.

Database Storage & Export — every submission is saved with full metadata (IP, browser, referrer, timestamp). Export to CSV, Excel, JSON, or PDF whenever you need it. No more lost leads if your email fails.

Webhooks — send form data instantly to any URL. Connect to Zapier, Salesforce, Slack, Google Sheets, or any custom API. Multiple webhooks per form, with retry logic built in.

Mailchimp Integration — submissions automatically added to your Mailchimp lists. Field mapping, tags, opt-in handling.

Twilio SMS — receive instant alerts for every submission or send automated SMS replies to your clients.

Comprehensive Logging — every spam block, webhook call, and integration event is logged. Debug any issue in minutes instead of hours.

👉 Get CF7 Captcha Pro

External services

This plugin relies on third-party CAPTCHA providers to detect and block spam submissions on your Contact Form 7 forms. Only the service(s) you configure and activate in the plugin settings are contacted.

Google reCAPTCHA (v2 and v3) This plugin loads the Google reCAPTCHA script and sends the CAPTCHA response token to Google’s verification API when a protected form is submitted, in order to confirm the submission is not from a bot. The visitor’s IP address is also sent as part of this verification. This service is provided by Google: Terms of Service , Privacy Policy .

hCaptcha This plugin loads the hCaptcha script and sends the CAPTCHA response token to hCaptcha’s verification API when a protected form is submitted, in order to confirm the submission is not from a bot. This service is provided by hCaptcha: Terms of Service , Privacy Policy .

Cloudflare Turnstile This plugin loads the Cloudflare Turnstile script and sends the CAPTCHA response token to Cloudflare’s verification API when a protected form is submitted, in order to confirm the submission is not from a bot. This service is provided by Cloudflare: Terms of Service , Privacy Policy .

These services are only contacted when the corresponding CAPTCHA type is enabled and configured with valid API keys.