pontocinza

<p>NoCaptcha Spam Filter for Contact Form 7 provides a deterministic, cache-safe, multi-layered defense against automated form submissions for Contact Form 7 without the need for CAPTCHAs or external libraries.</p>
<p>The plugin uses a combination of:</p>
<ul>
<li>Unique Honeypot: A site-specific hidden field that traps bots.</li>
<li>Cryptographic Signing: Ensures form tokens are genuine and haven’t been tampered with.</li>
<li>Anti-Replay Nonces: Each submission is unique; tokens cannot be reused.</li>
<li>Time-Check Validation: Blocks bots that fill out forms faster than humanly possible.</li>
<li>Cache-Safe Architecture: Automatically detects stale tokens on cached pages and refreshes them via a lightweight REST API fallback.</li>
</ul>
<h3>Scope of Protection</h3>
<p>This plugin is designed to block the vast majority of automated spam submissions (99% of common web crawlers) in Contact Form 7, with zero impact on user experience or performance. However, please note:</p>
<ul>
<li>Not a WAF: It is not a substitute for a Web Application Firewall or server-level security layers for mitigating sophisticated DDoS attacks.</li>
<li>Targeted Attacks: Highly sophisticated bots using headless browsers or manual human bypasses (spam farms) fall outside the scope of lightweight algorithmic protection.</li>
</ul>
<p>For maximum security, we recommend using this plugin as part of a multi-layered defense strategy.</p>
<h3>Configuration (optional, only for advanced users)</h3>
<p>You can override defaults in ‘wp-config.php’:<br />
    <code>php<br />
define('CF7NCSP_DOMAIN_SALT', 'your-random-string');<br />
define('CF7NCSP_TTL', 2400);      // Token lifetime (seconds)<br />
define('CF7NCSP_MIN_TIME', 20);   // Minimum time before submission</code><br />
Recommendations<br />
* Use a long, random string for ‘CF7NCSP_DOMAIN_SALT’<br />
* Keep ‘CF7NCSP_MIN_TIME’ between 10–30 seconds</p>
<h3>Privacy Policy</h3>
<p>This plugin is designed with privacy-first principles:<br />
* No PII Collection: It does not collect, store, or transmit any Personally Identifiable Information (PII).<br />
* No Persistent IP Storage: IP addresses are used transiently for rate limiting and are not stored in plain form or retained beyond a short-lived, temporary cache.<br />
* Local Processing: All validation happens on your server. No data is sent to third-party services.<br />
* Cookieless: The plugin does not set any browser cookies.</p>
<h3>Disclaimer</h3>
<p>This plugin is provided “as is”, without warranty of any kind, express or implied. Use at your own risk. While best efforts have been made to ensure reliability and security, the author is not liable for any damages or losses resulting from its use.</p>
<p>** DEVELOPER’S NOTE: **</p>
<p>This plugin is designed to be a lightweight, “set and forget” solution. It focuses on stability and minimal maintenance, with updates provided as needed for bug fixes and compatibility with WordPress and Contact Form 7. Because it is built to be self-sufficient, please be aware that the developer will not implement non-critical feature requests.</p>


NoCaptcha Spam Filter for Contact Form 7

Honeypot, signed security tokens, and anti-replay protection for Contact Form 7. Built for performance and full-page cache compatibility.

Matthias Nordwig

<p>Protect all your forms and logins against spam and brute-force attacks. The plugin is invisible and compliant to GDPR (RGPD, DSGVO).<br />
It has a lot of options on the one hand and comes with a well balanced default configuration. Thus it starts working very well, as soon as it is activated.</p>
<h3>Setup Guide</h3>
<div class="embed-vimeo" style="text-align: center;"><iframe loading="lazy" src="https://player.vimeo.com/video/905897718" width="750" height="422" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>
<h3>Key features</h3>
<ul>
<li>Blocks spam on all(!) public forms, comments and logins</li>
<li>Invisible. No user-input required</li>
<li>Still receive 100 percent of the real requests</li>
<li>Compliant to GDPR (respectively DSGVO, RGPD)</li>
<li>The Plugin is for free</li>
<li>No tracking, no cookies, no sessions</li>
<li>No external ressources</li>
<li>Easy to use</li>
<li>SEO-friendly</li>
<li>Only necessary code</li>
<li>Optionally messages can be flagged instead of blocking them</li>
</ul>
<h3>Examples WordPress</h3>
<ul>
<li>Login Form</li>
<li>Registration Form</li>
<li>Password Reset Form</li>
<li>Comments Form</li>
</ul>
<h3>Examples WooCommerce</h3>
<ul>
<li>Checkout</li>
<li>Login Form</li>
<li>Registration Form</li>
<li>Password Reset Form</li>
<li>Comments form</li>
<li>Product Evaluation Form</li>
</ul>
<h3>Examples other Plugins</h3>
<ul>
<li>Elementor Pro Forms, Contact Form 7, Fluent Forms, Jetpack Forms, Divi Forms, WPForms, Forminator, Thrive Architect & Thrive Apprentice, Gravity Forms, Formidable Forms, Mailchimp for WordPress Forms, BuddyPress Registration Form, bbPress Create Topic & Reply Forms, Ultimate Member Forms, wpDiscuz Custom Comments Form, Easy Digital Downloads Forms, Paid Memberships Pro Forms, MemberPress Forms, WP-Members Forms, WP User Frontend Forms, CheckoutWC & Flux Checkout, Ninja Forms, Everest Forms, Formidable Forms, WS Forms, Quform, Otter Blocks, Typeform, NEX-Forms, Bit Form, Form Maker, Funnelforms, Mailjet, Jotform, Page Builder, Metform, Calculated Fields Form, JetFormBuilder, weForms, Responsive Contact Form Builder, Zoho Forms, Smart Forms, Kali Forms, Happyforms, ApplyOnline, Subscribe Forms, FormCraft, Advanced Forms, CRM Perks Forms, Tripetto, Formstack, BuddyForms, vcita, Easy Form Builder, SimpleForm</li>
</ul>
<h3>Thank you!</h3>
<p>I hope you enjoy using the CAPTCHA plugin! If you are happy with it, I would be glad to get your review and probably a coffee too.</p>


Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant


Blocked hundreds of spam WooCommerce orders, and the plugin continues to be actively monitored and improved. I'm sure it will continue to get even better. Great work.


Excellent


The developer is really motivated to get this plugin going. Nice guy.



And the plugin helps catching spam without violating GDPR. Great for german or EU-sites.



Thanks a lot for this plugin.


Works like a charm and great developer-support

Anti-spam - CAPTCHA that protects all forms against spam and brute-force. Invisible and GDPR-compliant.

NoCaptcha Spam Filter for Contact Form 7 vs Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant