pontocinza

NoCaptcha Spam Filter for Contact Form 7 provides a deterministic, cache-safe, multi-layered defense against automated form submissions for Contact Form 7 without the need for CAPTCHAs or external libraries.
The plugin uses a combination of:
<ul>
<li>Unique Honeypot: A site-specific hidden field that traps bots.</li>
<li>Cryptographic Signing: Ensures form tokens are genuine and haven’t been tampered with.</li>
<li>Anti-Replay Nonces: Each submission is unique; tokens cannot be reused.</li>
<li>Time-Check Validation: Blocks bots that fill out forms faster than humanly possible.</li>
<li>Cache-Safe Architecture: Automatically detects stale tokens on cached pages and refreshes them via a lightweight REST API fallback.</li>
</ul>
<h3>Scope of Protection</h3>
This plugin is designed to block the vast majority of automated spam submissions (99% of common web crawlers) in Contact Form 7, with zero impact on user experience or performance. However, please note:
<ul>
<li>Not a WAF: It is not a substitute for a Web Application Firewall or server-level security layers for mitigating sophisticated DDoS attacks.</li>
<li>Targeted Attacks: Highly sophisticated bots using headless browsers or manual human bypasses (spam farms) fall outside the scope of lightweight algorithmic protection.</li>
</ul>
For maximum security, we recommend using this plugin as part of a multi-layered defense strategy.
<h3>Configuration (optional, only for advanced users)</h3>
You can override defaults in ‘wp-config.php’: 
 <code>php 
define('CF7NCSP_DOMAIN_SALT', 'your-random-string'); 
define('CF7NCSP_TTL', 2400); // Token lifetime (seconds) 
define('CF7NCSP_MIN_TIME', 20); // Minimum time before submission</code> 
Recommendations 
* Use a long, random string for ‘CF7NCSP_DOMAIN_SALT’ 
* Keep ‘CF7NCSP_MIN_TIME’ between 10–30 seconds
<h3>Privacy Policy</h3>
This plugin is designed with privacy-first principles: 
* No PII Collection: It does not collect, store, or transmit any Personally Identifiable Information (PII). 
* No Persistent IP Storage: IP addresses are used transiently for rate limiting and are not stored in plain form or retained beyond a short-lived, temporary cache. 
* Local Processing: All validation happens on your server. No data is sent to third-party services. 
* Cookieless: The plugin does not set any browser cookies.
<h3>Disclaimer</h3>
This plugin is provided “as is”, without warranty of any kind, express or implied. Use at your own risk. While best efforts have been made to ensure reliability and security, the author is not liable for any damages or losses resulting from its use.
** DEVELOPER’S NOTE: **
This plugin is designed to be a lightweight, “set and forget” solution. It focuses on stability and minimal maintenance, with updates provided as needed for bug fixes and compatibility with WordPress and Contact Form 7. Because it is built to be self-sufficient, please be aware that the developer will not implement non-critical feature requests.

NoCaptcha Spam Filter for Contact Form 7

Honeypot, signed security tokens, and anti-replay protection for Contact Form 7. Built for performance and full-page cache compatibility.

azizultex

WPPOOL

Md. Al-Shahreyar

wpdarkmode

Mahafuz

Md Sajjadul Islam

farhanmullick

Cloudflare Turnstile for WordPress, WooCommerce, Contact Form 7, BuddyPress, WPForms, and more. Secure your WordPress website with the best reCAPTCHA alternative for WordPress.
“Studies show that 15% of users will abandon a web-based service when they face a traditional CAPTCHA test.”
HOW TO ADD CLOUDFLARE TURNSTILE IN WORDPRESS
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/2jU2LhkiQQU?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
PROTECTS AGAINST SPAM FOR:
<ul>
<li>WordPress Login form</li>
<li>WordPress Signup form</li>
<li>WordPress Reset Password form</li>
<li>WordPress Comment form</li>
<li>WooCommerce forms</li>
<li>Contact Form 7 forms</li>
<li>WPForms contact forms</li>
<li>BuddyPress forms</li>
<li>Elementor forms</li>
</ul>
Say to no user experience nightmare, known as CAPTCHA. It hinders your website experience significantly as it slows down user actions at every step of the website journey. Welcome to Turnstile, the latest alternative to invisible CAPTCHA and honeypot. This anti-spam plugin allows you to easily integrate Turnstile on your website within a few seconds without any coding.
<a href="https://wordpress.org/support/plugin/wppool-turnstile-captcha-spam-filter/" rel="ugc">👩🏼‍💻 Get support</a>
WHAT IS CLOUDFLARE TURNSTILE, AND HOW TO ACTIVATE IT ON YOUR WEBSITE?
Turnstile is the latest privacy-focused invisible CAPTCHA technology developed by Cloudflare to create a modern CAPTCHA alternative and reCAPTCHA alternative.
Turnstile helps you identify real website visitors without needing additional actions. Instead, Turnstile automatically runs a series of small non-interactive JavaScript challenges based on telemetry and client behavior displayed during a session. That means the possibility of your users facing CAPTCHA will reduce significantly. <a href="https://www.cloudflare.com/en-gb/products/turnstile/" rel="nofollow ugc">Learn more about Turnstile</a>
Getting started with Turnstile on WordPress is super easy. All you have to do is install and activate our plugin. Then, generate your site and secret keys from Cloudflare (a free and easy process) and input them through the provided field. That’s it. The plugin does everything else and ready to protect your forms from spam. You will no longer have to get frustrated with the poor efficacy of reCAPTCHA ever again!
<a href="https://wordpress.org/support/plugin/wppool-turnstile-captcha-spam-filter/" rel="ugc">👩🏼‍💻 Get support</a>
<h3>EASY SPAM FILTER FEATURES</h3>
<ol>
<li>Automatic deployment: Once you setup Easy Spam Filter with your site key and secret key, the plugin does the rest. It will automatically deploy the required HTML snippet in your website for you.</li>
<li>WordPress spam protection: Spam Filter with Turnstile safeguards your website against spam comments or brute force attacks. It has support for every kind of WordPress form, including
<ul>
<li>Signup/registration form spam protection</li>
<li>Login form spam protection</li>
<li>Reset password form spam protection</li>
<li>Comment spam protection</li>
</ul>
</li>
<li>Disable/enable WordPress login spam protection: You can disable Turnstile at any time from the WordPress login form from the plugin setting.</li>
<li>SEO boost: Spambots often include low-quality or malicious outbound links, risking your website’s ranking. Turnstile prevents these bots from spamming and ensures you continue receiving a good ranking.</li>
<li>Mobile-friendly Anti Spam: Our Turnstile integration is fully optimized for mobile devices and will not break under any circumstances.</li>
<li>WooCommerce spam protection: Protect your WooCommerce store against malicious spam attacks. This reCAPTCHA alternative for WooCommerce provides protection against every kind WooCommerce form.
<ul>
<li>Signup/registration form spam protection</li>
<li>Login form – my account spam protection</li>
<li>Lost/Reset password form spam protection</li>
<li>Checkout billing form spam protection</li>
</ul>
</li>
<li>Contact Form 7 spam protection: Experience flawless Turnstile integration for Contact Form 7 forms. Protect your CF7 forms from spam comments. After configuration, add Turnstile to any Contact Form 7 form.</li>
<li>BuddyPress login spam protection: Keep your BuddyPress groups safe with secured spam protection by Cloudflare Turnstile antispam filter.</li>
<li>WPForms spam protection: Add Cloudflare Turnstile in Contact Form by WPForms and keep your everyday contact forms safe from spam submissions. Activate and enjoy
<ul>
<li>Contact forms spam protection</li>
<li>Payment forms spam protection</li>
<li>Survey forms spam protection</li>
<li>Newsletter forms spam protection</li>
<li>Registration forms spam protection</li>
</ul>
</li>
<li>Elementor forms spam protection: Add Turnstile to Elementor forms. If you are using Elementor Pro, you can now protect your
<ul>
<li>Elementor contact us forms</li>
<li>Elementor multi-step forms</li>
<li>Elementor login form</li>
</ul>
</li>
<li>Turnstile widget theme: Change the outlook of the Turnstile widget according to your wish (Dark or Light).</li>
<li>Submit button restriction: Control whether users need to pass the Cloudflare Turnstile security check to submit the button.</li>
<li>Custom message: Customize the Turnstile widget message and replace the default one (“Please verify you are human”).</li>
</ol>
<h3>Privacy Policy</h3>
Easy Spam Filter uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster & make product improvements.
Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice. We collect the data to ensure a great user experience for all our users.
Integrating Appsero SDK DOES NOT IMMEDIATELY start gathering data, without confirmation from users in any case.
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses this data</a>.

Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor

That’s awesome! Integrated CloudFlare Turnstile in my WordPress site in just a few minutes :wink: very lightweight and easy. Thanks for the plugin.

Very lightweight Turnstile WordPress plugin

Very helpful !

Add Cloudflare Turnstile to WordPress, Contact Form 7, WooCommerce, WPForms, BuddyPress & Elementor. A CAPTCHA, reCAPTCHA alternative for WordPress.

NoCaptcha Spam Filter for Contact Form 7 vs Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor