Best Contact Form 7 Alternatives: 5 Form Plugins Compared

Contact Form 7 has been in the WordPress directory since 2007, and for good reasons: it's free, it's lean, and it does exactly what the name says. There are good reasons to look for an alternative, too. Anyone who wants more than a bare contact form quickly runs into limits the plugin doesn't even try to hide: it is deliberately minimalist. The only question is whether minimalism is the right currency here.

Where Contact Form 7 hurts in everyday use

The wish to switch almost always starts at one of three points. First: spam. Out of the box, Contact Form 7 filters nothing. It ships connectors for Akismet, reCAPTCHA and Turnstile, but you have to set each one up, and each one sends data elsewhere (more on that below). Second: inquiries exist only as email. The official docs say so plainly: Contact Form 7 doesn't store submitted messages anywhere, so a mail server problem or a mistake in the mail settings can lose them for good (CF7 docs on Flamingo, retrieved 4 October 2026). For a business that's not a cosmetic flaw, it's lost revenue. The fix is Flamingo, a free plugin by the same author that writes every message to the database; in our census it sits in the 800,000+ band (Flamingo census profile). Third: the empty builder. Every form starts from zero, written in a markup-like syntax of form tags such as [text* your-name], which is where many beginners get stuck. Which fields a form really needs is a separate question, answered in how many fields a contact form should have.

Spam and privacy: what Contact Form 7 brings

Contact Form 7 has more anti-spam tools than its reputation suggests, and its docs even recommend combining several kinds. From a privacy point of view, though, they could hardly be more different. This is where you find out whether CF7 fits your project.

The baseline is pleasingly clean. With the default configuration, CF7 doesn't track users by stealth, writes no personal data to the database, sends nothing to external servers and sets no cookies; once you activate reCAPTCHA, Akismet, Turnstile, Brevo, Constant Contact or Stripe, the submitter's data, including the IP address, may be sent to that provider (privacy notices in the wordpress.org listing, retrieved 4 October 2026). The listing therefore recommends checking each provider's privacy policy.

Akismet: the centerpiece, with data sharing

The CF7 docs call Akismet the centerpiece of their spam strategy. You tag the name, email and URL fields with options such as akismet:author_email, and on submission CF7 sends all of the form's input, not just the tagged fields, plus environment variables to Akismet (CF7 docs on Akismet). Personal blogs get the API key for free; for corporate or commercial sites the docs point to paid subscriptions. Reporting misclassified messages back only works if Flamingo is running too. Akismet itself sits in the 5M+ band of our census (Akismet census profile). Which approaches stop spam without a cloud service is the subject of our Akismet alternative comparison.

reCAPTCHA v3: invisible, but at Google

CF7 uses reCAPTCHA v3, which scores visitors in the background without an "I'm not a robot" checkbox. Convenient for visitors; for you it means a Google service is involved in every submission. The CF7 docs also warn that Google plans to move all reCAPTCHA users to reCAPTCHA Enterprise, which means a cost increase for many of them (CF7 docs on reCAPTCHA). Whether you need consent for it in the EU comes down to Article 5(3) of the ePrivacy Directive: storing or reading information on a visitor's device requires consent unless it is strictly necessary to provide a service the visitor explicitly requested. If you play it safe and load reCAPTCHA only after consent, everyone who declines gets no spam protection at all. How consent works cleanly in WordPress is covered in our cookie consent and GDPR comparison.

Cloudflare Turnstile: what the CF7 docs recommend

Turnstile is Cloudflare's replacement for classic CAPTCHAs. Unlike reCAPTCHA, the CF7 docs describe it as free and recommend it unless you have reasons to use reCAPTCHA (CF7 docs on Turnstile). Setup is quick: get a key pair from Cloudflare, paste it under Contact › Integration, done. The widget then appears automatically at the top of every form. On the privacy side, the question simply moves: instead of Google, it's Cloudflare that may receive the submitter's data, IP address included.

What stays local: disallowed list, quiz, honeypot

These options work without anyone else's server. The disallowed list reuses the Disallowed Comment Keys from Settings › Discussion: messages containing a listed word or coming from a listed IP address are treated as spam by CF7 and not delivered (CF7 docs on the disallowed list). The quiz asks a simple question such as "12+48=?" that visitors have to answer correctly. A honeypot, a field humans never see and only bots fill in, isn't in the CF7 docs; you get it from extensions such as CF7 Apps (slug contact-form-7-honeypot), which our census puts in the 300,000+ band with 3.8 out of 5 stars (CF7 Apps census profile). And there is Really Simple CAPTCHA by the CF7 author, an image CAPTCHA whose own directory listing says it is not strongly secure (Really Simple CAPTCHA on wordpress.org). Image CAPTCHAs and quiz questions ask something of the visitor, though, and that is exactly what turns them into a barrier for many people with disabilities. What WCAG says about it is in CAPTCHA accessibility.

How the disallowed list and the quiz hold up against a bot is something you can watch in a 6:40 minute test on a fresh WordPress Playground. Two submissions go in: a harmless visitor question with a listed word in it, and a small script that sends the form the way a bot does. The word list catches the question and lets the script through. The quiz stops the script, and every visitor has to answer it. The second half runs the same two tests with our own plugin Wellenbrecher, and the video also says when Contact Form 7's own tools are enough.

Video: Stop Contact Form 7 spam without a captcha6:40 minutes · One click, and only then, loads content from YouTube

The alternatives at a glance

WPForms: the comfort builder

WPForms is the best-known drag-and-drop builder and pleasantly easy to start with; the Lite edition sits in the 5M+ band of our census with 4.8 out of 5 stars. The catch is the model. Its directory listing names conditional logic and file uploads as features of WPForms Pro, and according to its own docs WPForms Lite doesn't save entries to your WordPress database at all (WPForms docs on Lite Connect, retrieved 4 October 2026). If you switch on the "Lite Connect" backup, every submission goes to WPForms' servers, where it is kept for a year and restored to your dashboard once you upgrade. As of 4 October 2026, the smallest paid tier, Basic, costs $49.50 for the first year and $99 at regular price after that; the tiers go up to Elite at $299.50, or $599 at regular price (WPForms pricing page). A good fit for marketing sites that already have US services in the chain. Worth a closer look for privacy-sensitive projects.

Ninja Forms: a free base with submissions, the rest as add-ons

Ninja Forms has expanded its free edition considerably. According to its directory listing, every submission is stored in your own WordPress database with no limit, and a honeypot is active on every form automatically; conditional logic, file uploads, multi-step forms, payments and integrations remain add-ons you buy individually or as a membership (Ninja Forms on wordpress.org, retrieved 4 October 2026). The smallest membership, Plus, costs $59.40 for the first year as of 4 October 2026 and $99 at regular price after that (Ninja Forms pricing page). If you need exactly one extra feature, you'll do well here. If you plan to grow, do the math first.

Fluent Forms: the best overall package among the builders

Fluent Forms is our recommendation among the classic builders, if a builder is what you want. According to its directory listing, the free edition already includes conditional logic, Stripe payments and fields for reCAPTCHA, hCaptcha and Turnstile, and entries can be exported and imported. In our census it shows 4.8 out of 5 stars from 790 ratings, with all eight support threads resolved. As of 4 October 2026, Pro for one site costs $79 a year at regular price, discounted to $63 for the first year (Fluent Forms pricing page). Point of criticism: the feature set has grown so broad that the interface feels overloaded in places.

Gravity Forms: the developer classic

Gravity Forms has been the tool for complex form projects for years: multi-step forms, calculations, workflows, a mature developer API. There is no free version, the plugin isn't in the wordpress.org directory, and so it has no census profile either. As of 4 October 2026, the Basic license costs $59 a year for one site and Elite $259 for unlimited sites (Gravity Forms pricing page). Against spam there's a honeypot you enable per form in the form settings (Gravity Forms docs on form settings). The safest bet for agencies with edge cases; overkill for a simple contact form.

Leadlotse: designed from the goal backwards

Our own plugin Leadlotse takes a different path, and because it's ours, we say so up front. Leadlotse is not yet another empty builder; it starts with purpose templates: contact, consultation, enquiry, newsletter, download, callback, quote or event. Pick one, adjust, done, with fields, a privacy text and a confirmation email already in place. Every submission lands in an inquiry inbox right inside WordPress, with a status (New, In progress, Done), search, filters and CSV export, and email becomes an extra channel rather than the only storage. If an inquiry waits too long for a reply, Hans, the pilot, speaks up. In Pro, the event registration sends a ticket with a QR code after the double opt-in, with check-in by scan and a capacity limit. How that compares with a ticketing platform is in our Eventbrite alternative comparison.

On spam, the difference from CF7 is at its largest. Leadlotse processes inquiries on your own server and makes no external call; it keeps spam out with a honeypot, a time trap and rate limiting, without any CAPTCHA. If our spam protection Wellenbrecher is active, forms also run through its scoring. Leadlotse doesn't appear in our census, which only covers plugins with 10,000+ installs.

To be honest, this also belongs here: Leadlotse doesn't even try to do everything. If you need fifty field types, payment integrations and multi-page calculation forms, you're better off with Gravity or Fluent. Leadlotse is built for freelancers and small teams who want to capture and work through inquiries reliably without investing a form-building afternoon. How it came about is in the Leadlotse launch post.

The plugins in numbers: what our census shows

No feature comparison tells you how well a plugin is maintained. Our Plugin Directory Census 01/2026 recorded the public figures of every listed plugin with 10,000+ installs on the reference date of 28 August 2026. wordpress.org reports installs only as a band: "10M+" means 10 million up to just under 20 million.

Two things stand out. Contact Form 7 has the most installs, but on rating and support it sits below the median of its group of plugins with 1M+ installs (4.7 stars, 71.9% resolved threads), and its resolution rate is the lowest in this table. And if you upgrade CF7 with Flamingo and a honeypot, your form depends on three plugins from two vendors, each of which needs its own maintenance. Gravity Forms is missing because it isn't in the directory; Leadlotse is below the 10,000-install threshold.

Comparison table

Double opt-in with Contact Form 7

If you collect newsletter subscribers through a form, a checkbox isn't enough. Article 7(1) GDPR requires you to be able to demonstrate that the person consented to the processing of their data. Double opt-in, where the person confirms via a link in an email, is a common way to produce that proof.

Contact Form 7 handles this through its Brevo integration. An acceptance checkbox with the option consent_for:sendinblue makes sure contact data only goes to Brevo once the box is ticked, and according to the CF7 docs, double opt-in only requires activating the additional plugin Double Opt-In Helper (CF7 docs on the Brevo integration). Beyond that, Double Opt-In Helper is aimed at developers who build the process into their own plugins; by default, an open confirmation stays valid for 24 hours (Double Opt-In Helper description). What the law actually requires is covered in double opt-in and GDPR.

Leadlotse includes double opt-in for newsletter sign-ups without an extra plugin and logs consent with timestamp, wording and version. Whether that is enough for your case depends on your privacy policy and your sending setup. That's an assessment, not legal advice.

Our recommendation

If your form is only meant to be a mailbox and you enjoy tinkering: stay with Contact Form 7, install Flamingo and a honeypot, and add Turnstile or Akismet only if spam still gets through. If you want a powerful builder: Fluent Forms. If you need submissions stored in WordPress without a paid tier and can live with add-ons: Ninja Forms. If you have edge cases and budget: Gravity Forms. And if you want to treat inquiries as what they are (potential customers who must never disappear into a spam folder), then take a look at Leadlotse.

Frequently asked questions