Install Contact Form 7 from Plugins > Add Plugin, activate it, place its block on a Contact page, then configure the Form and Mail tabs as a matched pair. Test a real submission before publishing. Add documented spam protection if needed, and install Flamingo when administrators must search or retain submissions because Contact Form 7 does not provide a built-in inbox.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What Contact Form 7 does—and what it does not
Contact Form 7 is a free, open-source WordPress plugin for creating forms and sending submitted values by email. The WordPress.org directory describes it as “a plugin designed to be a practical tool for all WordPress users who embrace the philosophy of free and open source software.” Its listing reported more than 10 million active installations in 2026, but installation counts, plugin versions and compatibility metadata change over time.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
The directory currently lists version 6.2.2, tested up to WordPress 7.1.3, with PHP 8.3 or higher shown as a requirement. Treat those values as time-sensitive: check the live plugin directory and your host’s PHP support immediately before deployment rather than copying them into a permanent maintenance document.
A standard installation creates a form and sends each submission through the site’s WordPress mail path. It does not automatically create a searchable message inbox. If staff need to review old messages inside WordPress, install the companion Flamingo plugin and define who can access entries and how long they should be retained.
#1 Best Overall
Before you install
Confirm access and compatibility
- Sign in with a WordPress administrator account. Plugin installation and integration settings may be restricted for editors or authors.
- Confirm that the site’s WordPress version, PHP version and hosting configuration meet the current Contact Form 7 listing. The published compatibility values are volatile.
- Decide which mailbox should receive enquiries and use an address on the site’s domain for the sender identity.
- Plan how personal data will be handled. A form can collect names, email addresses, messages, phone numbers, dates and uploaded files, so your privacy notice and retention rules should match the fields you actually publish.
- Check whether the site already uses a security, caching or consent tool that could block scripts, submissions or file uploads.
Choose whether you need stored submissions
Contact Form 7’s default configuration does not itself covertly track users, write personal data to the database, send data to external servers or use cookies, according to its WordPress.org listing. That description applies to the default plugin, not every integration or add-on. If the team needs an administrator-accessible history, install Flamingo, activate it and set a documented retention period. Storing submissions increases the site’s privacy and security responsibilities.
Install and publish your first form
- Open the plugin installer. In the WordPress dashboard, go to Plugins > Add Plugin.
- Search for the plugin. Enter
Contact Form 7and verify that the result is the official plugin from Rock Lobster Inc. - Install and activate it. Select Install Now, wait for the installation to finish, and choose Activate.
- Open the form manager. Go to Contact > Contact Forms. The plugin normally creates a default form that you can edit, duplicate or replace.
- Create or open a Contact page. Use Pages > Add New for a new page, or edit an existing contact page.
- Insert the block. Add a Contact Form 7 block in the WordPress editor, then select the form you want to display. In some editor views, the block appears through the plus-button block inserter.
- Save or publish the page. Use Save Draft, Update or Publish, depending on the page’s status.
- Open the public URL. Check the form as a visitor, not only in the editor. Verify labels, required indicators, keyboard focus, mobile layout and the success or error response.
The official getting-started sequence ends with inserting the Contact Form 7 block, selecting the default form and saving the page. You can later place the same form on additional pages by selecting it in another Contact Form 7 block.
Build fields in the Form tab
Open Contact > Contact Forms, select a form, and use the Form tab to edit its markup. The tag generator can create text, email, number, date, checkbox, menu, file, acceptance and submit controls. A generated tag is inserted into the form template; the surrounding label and explanatory text are yours to edit.
Give every field a stable, readable name
Use names such as your-name, your-email and your-message. Names are the link between what the visitor submits and what appears in the email. Avoid changing a field name casually after configuring the Mail tab, because the corresponding mail-tag will no longer match.
Make labels and requirements understandable
- Write a visible label that says what information is required, for example “Your email address.”
- Mark a field required only when the information is necessary to answer the enquiry. Requiring optional demographic or marketing data can increase abandonment and create unnecessary privacy obligations.
- Use an email field for email addresses so the browser and Contact Form 7 can validate the expected format.
- Use a number field for quantities and a date field for dates rather than asking visitors to type everything into an unrestricted text box.
- For a limited set of choices, use a menu or checkbox control and explain whether one or several choices are allowed.
- For uploads, state accepted file types, size limits and whether the file is necessary. Do not request sensitive documents unless the site has an appropriate handling process.
- Use an acceptance field for terms or consent only when the visitor must actively agree to a clearly stated condition. Link to the relevant policy from the label.
- Keep the submit control’s wording specific, such as “Send message,” instead of implying a response time you cannot guarantee.
Understand form-tags and mail-tags
A form-tag appears in the Form tab and defines an input control. Its name is reused as a mail-tag in the Mail tab. For example, the official FAQ gives the pair [text your-new-field] in the form and [your-new-field] in the mail template. The mail-tag is replaced with the visitor’s input when the message is generated.
If you add a field but omit its mail-tag, the visitor can complete the field while the email omits the answer. Conversely, a mail-tag with no matching form field cannot supply a submitted value. Keep a one-to-one checklist as you build:
| Purpose | Example form-tag | Matching mail-tag |
|---|---|---|
| Name | [text* your-name] |
[your-name] |
[email* your-email] |
[your-email] |
|
| Message | [textarea your-message] |
[your-message] |
| Topic menu | [select your-topic "Support" "Press"] |
[your-topic] |
The examples illustrate the naming relationship; use the tag generator’s current syntax and options for the installed version.
Configure the Mail tab safely
Open the Mail tab for the same form. This is where you decide who receives the message, what identity appears in the headers, and which submitted values are included.
Recipient (To)
Enter the mailbox that should receive enquiries in the To field. Confirm spelling, aliases and departmental routing. A correctly completed form can still appear to “fail” when the recipient is simply wrong.
From
Use a sender address controlled by the site, preferably on the same domain as the website. Do not put the visitor’s unverified address in From; doing so can create authentication and spoofing problems. A typical pattern is a domain mailbox such as [email protected], with the visitor’s address used for replies instead.
Reply-To
Put the visitor’s email mail-tag in Reply-To, for example [your-email]. Selecting Reply in the mail client will then address the visitor while the message’s From identity remains aligned with the site’s domain.
Subject and message body
Make the subject useful for sorting, such as Website enquiry: [your-topic], if the topic field exists. In the message body, include every value the recipient needs, with one label per line:
Name: [your-name]
Email: [your-email]
Topic: [your-topic]
Message:
[your-message]Every bracketed mail-tag must have a matching field name in the Form tab. If you rename your-message to message, update the mail template at the same time.
Additional headers and attachments
Keep headers minimal and deliberate. Add only headers supported by your mail setup, and do not copy visitor-entered text into arbitrary headers. If you use a file field, configure the attachment according to the installed plugin’s generated tag and your host’s upload limits; test both a permitted file and a rejected file on the live page.
Test delivery before announcing the page
- Save the Form and Mail settings.
- Open the published page in a private browser window or while logged out.
- Submit a realistic test with every field populated, including any menu, acceptance control or file upload.
- Confirm the success response shown by the form.
- Check the intended recipient inbox and its spam or junk folder.
- Verify that the subject, From address, Reply-To address and every expected field value are correct.
- Reply to the message and confirm that the reply goes to the test address.
- Repeat from a phone or narrow browser window to catch layout and validation problems.
Delivery depends on the site’s WordPress mail path and hosting. Contact Form 7’s documentation does not promise one universal SMTP remedy, so diagnose the complete path rather than assuming the form markup is responsible.
Rank #4
Reduce spam without creating unnecessary friction
Contact Form 7 documents several controls, including Akismet, reCAPTCHA and a disallowed list. There is no authoritative universal percentage for spam blocking or false positives, so choose based on the site’s risk, audience and privacy requirements, then monitor real submissions.
reCAPTCHA v3
Contact Form 7 version 5.1 and later uses reCAPTCHA v3. The documented setup is:
- Register the site with Google reCAPTCHA and obtain a site key and secret key.
- In WordPress, open Contact > Integration.
- Enter both keys in the reCAPTCHA section and save the integration settings.
- Submit the public form and check the response and mail delivery.
Version 3 operates in the background. You do not add a visible “I’m not a robot” checkbox or a [recaptcha] tag to the form. Because the service is external, submitter-related data may be sent to the provider. Explain that transfer in the site’s privacy notice and review the provider’s current policy.
Recommended Free Tools
Akismet
Akismet can receive selected field values from Contact Form 7 for spam analysis. It requires an active subscription. Its guidance identifies Flamingo as the companion option when administrators need to mark stored submissions as spam or not spam. Before enabling it, decide which fields are sent for analysis and document the disclosure in the privacy notice.
Disallowed list and layered controls
A disallowed list can block known unwanted terms, addresses or patterns without adding a visitor-facing challenge. It is useful for recurring abuse but can produce false positives if rules are broad. Add one control at a time, record what changed and inspect legitimate messages that were rejected. Other documented integrations include Constant Contact, Brevo, Stripe and Cloudflare Turnstile; each can alter data flows, consent requirements or operational complexity.
Choosing an approach
| Option | Visitor experience | Data and administration | When it fits |
|---|---|---|---|
| reCAPTCHA v3 | Background scoring; no checkbox required | External provider receives relevant service data; keys are managed under Contact > Integration | Sites wanting a low-friction, documented challenge layer |
| Akismet | Usually invisible to visitors | Selected values are sent for analysis; an active subscription is required | Sites already using that service and able to explain the transfer |
| Disallowed list | No additional challenge | Rules stay under site control, but over-broad patterns can block real enquiries | Known repeated words, addresses or patterns |
| Flamingo | No direct anti-spam challenge | Stores submissions for search and manual spam classification | Operational auditability and recovery matter more than preventing the initial message |
These options are not a published performance ranking. Compare effectiveness, user friction, whether data leaves the site, retention and searchability, cost and geographic availability, and compatibility with current WordPress and PHP versions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Store and review submissions with Flamingo
Contact Form 7 does not include a built-in inbox for historical messages. Install and activate Flamingo if the site must retain, search or manually classify submissions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Go to Plugins > Add Plugin and search for
Flamingo. - Install and activate the companion plugin.
- Submit a test through the live Contact Form 7 page.
- Open Flamingo’s administration screens and verify that the test appears with the expected fields.
- Set administrator roles, access rules and a deletion schedule appropriate to the site’s privacy obligations.
- Document how staff mark spam, export information when required and remove entries at the end of the retention period.
Storage is not a substitute for reliable delivery. Keep the mailbox test and the Flamingo test separate so you know whether a failure affects email, database retention or both.
Privacy and external data transfers
The default plugin listing says Contact Form 7 itself does not track users covertly, write personal data to the database, send it to external servers or use cookies. Activating integrations changes the analysis. The listing names reCAPTCHA, Akismet, Constant Contact, Brevo, Stripe and Cloudflare Turnstile as features that may send submitter personal data to those providers.
- List the categories of information the form collects, such as name, email address, message text and files.
- Identify whether information is sent to an external spam, marketing, payment or security provider.
- State the purpose and legal basis used by the site, where applicable.
- Explain retention, access, deletion and correction procedures.
- Restrict WordPress and Flamingo access to staff who need it.
- Review each provider’s current policy, geographic processing details and contractual requirements before activation.
Do not add a consent checkbox merely to make the form look compliant. Use an acceptance field when a clearly written condition genuinely requires affirmative agreement, and obtain legal advice for jurisdiction-specific obligations.
Quick Recap
Troubleshoot the common failures
A field is missing from the email
- Compare the exact name in the Form tab with the mail-tag in the Mail tab, including hyphens and spelling.
- Ensure the mail-tag is inside the message body or the intended header, not only in the form markup.
- Save both tabs, clear any page cache and submit again from the live page.
- For a renamed field, remove the old mail-tag and insert the new one from the current field name.
No message arrives
- Verify the To address and inspect both inbox and spam folders.
- Confirm that the domain-based From address exists and that Reply-To contains the visitor’s email mail-tag.
- Check domain DNS and mail authentication records, host sending limits and the site’s WordPress mail path.
- Submit a test to a second mailbox to distinguish recipient filtering from site-side failure.
- Review the official troubleshooting documentation and your host’s mail logs when available.
Spam increases after launch
- Enable one documented control at a time so you can identify its effect.
- Review false positives before tightening rules or rejecting a broad category.
- Use a disallowed list for a narrow, repeated pattern rather than a large collection of vague words.
- Check whether an external service’s keys, subscription or domain registration are still valid.
The form works in the editor but not publicly
- Open the published URL while logged out and test every required field.
- Inspect browser-console errors and blocked third-party scripts if reCAPTCHA or another integration is enabled.
- Clear page and object caches after changing tags or integration settings.
- Temporarily test without conflicting optimization or security rules, then re-enable them one by one.
Stored messages are absent
- Confirm Flamingo was active before the test submission.
- Check that the test reached the form’s success response and that the expected administrator account can access Flamingo.
- Verify that a retention or cleanup process has not already deleted the entry.
- Remember that successful email delivery does not prove database storage, and database storage does not prove email delivery.
A practical launch checklist
- Contact Form 7 is installed from the plugin directory and activated.
- The Contact Form 7 block on the public page selects the intended form.
- Every visible field has a clear label and an appropriate required setting.
- Every Form-tab field name has the matching Mail-tab mail-tag.
- The recipient is correct, the From address belongs to the site, and Reply-To uses the visitor’s email field.
- A live submission has been checked in the recipient inbox and spam folder.
- Spam controls, external transfers and consent wording are documented in the privacy notice.
- Flamingo is installed only when retention or searchable history is required, with access and deletion rules defined.
- WordPress, PHP, Contact Form 7 and integration versions have been rechecked before launch.
Key decisions at a glance
| Requirement | Configuration | Important qualification |
|---|---|---|
| Display a form on a page | Add a Contact Form 7 block and select the form | Test the published page, not only the editor |
| Include a submitted answer in email | Match each Form-tab name to a Mail-tab mail-tag | A missing or misspelled tag leaves the value out |
| Reply directly to the visitor | Site-controlled From plus visitor email in Reply-To | Do not use an unverified visitor address as From |
| Reduce automated spam | Use reCAPTCHA v3, Akismet or a carefully scoped disallowed list | External services can receive data; no universal performance percentage is established |
| Review historical submissions | Install Flamingo | Define retention, access and deletion rules |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
