SMTP for Contact Form 7 vs Anti-Spam Protection – No API Key, GDPR Friendly

WordPress uses PHPMailer to send mail from with your local mail server, but it can happen that your mail were not accepted by mail providers… This can happen for several reasons, sometimes because the mail server is not configured or sometimes because the records DKIM, DMARC and SPF of the domain been set up correctly and so on… Anyway you can avoid any problems by using an external SMTP server and sending mail with it! Additional features ✅ OAuth2 Authentication: Securely connect to Gmail and Microsoft Office 365 without needing to store passwords in your database or enable “less secure apps”. ✅ Per-Form Custom Templates: Wrap CF7 emails with beautiful templates. You can now select a specific custom template for each form directly from the plugin settings! ✅ Global or CF7-Only Mode: Choose whether to override all WordPress emails with this SMTP configuration or limit it exclusively to Contact Form 7 submissions. ✅ Live testing: a module for testing e-mail settings with the Rest-Api (that avoid to reload the page for this kind of test). The entire output of the php mailer will be captured, which will be useful in case of configuration errors or to get the wrong parameter when is possible. ✅ Automated Reports: choose when and what email you want to receive the report and I will send you a beautifully formatted HTML summary of sent and failed emails. Includes log retention settings to keep your database clean. ✅ Advanced Headers & Security: Easily automatically set “Reply-To” headers, allow insecure options for self-signed certificates, and define custom “From Name” and “From Email” settings. This plugin is ads free and I don’t want to try to sell you any pro version! If you want to contribute, there are many ways to do so, from simple suggestions and bug reports to translating and contributing code. See below how to do it! SMTP SMTP stands for ‘Simple Mail Transfer Protocol’. It is a connection-oriented, text-based network protocol of the Internet protocol family and as such is on the seventh layer of the ISO/OSI model, the application layer. Like any other network protocol, it contains the rules for proper communication between networked computers. SMTP is specifically responsible for sending and forwarding e-mails from a sender to a recipient. Since its release in 1982 as the successor to the ‘Mail Box Protocol’ in Arpanet, SMTP has become the standard protocol for sending e-mails. However, the SMTP procedure remains largely invisible to the normal consumer, as it is executed in the background by the e-mail programme used. Only if the software, the webmail application on the browser or the mobile e-mail application does not automatically determine the SMTP protocol when creating an account, does it have to be set manually to ensure smooth e-mail traffic. SMTP presets Aruba Gmail (tls and ssl) Yahoo (tls and ssl) Outlook (tls and ssl) Office365 (tls) OAuth2 Setup Google Gmail To use Gmail with OAuth2, you need to create a Google Cloud Project: 1. Create Project: Go to Google Cloud Console and create a new project. 2. Enable Gmail API (Required): Go to APIs & Services > Library, search for Gmail API, and click Enable. 3. Configure Consent Screen: Go to OAuth consent screen and create an External app. * Scopes: Click Add or Remove Scopes, search for the Gmail API, and check the boxes for .../auth/userinfo.email and .../auth/gmail.compose (or https://mail.google.com/). * Publishing Status: Click Publish App to push it to production (otherwise, your connection token will expire every 7 days). 4. Create Credentials: Go to Credentials > Create Credentials > OAuth client ID. * Application type: Web application. * Authorized redirect URIs: Copy and paste the exact callback URL provided in your plugin settings. 5. Connect: Copy the generated Client ID and Client Secret into the plugin settings and click Connect. 6. Grant Permissions (Critical): During the Google login popup, click Advanced > Go to App if prompted with an “unverified app” warning. You must explicitly check the boxes that ask for permission to compose/send emails before clicking Continue. Microsoft Office 365 1. Go to the Azure Portal (portal.azure.com). 2. Navigate to Azure Active Directory > App registrations > New registration. 3. Enter an application name and set the Redirect URI (Web) to the exact URL provided in the plugin settings. 4. Go to Certificates & secrets and create a new client secret. Copy the secret’s Value. 5. Go to API permissions > Add a permission > Microsoft Graph > Delegated permissions and add SMTP.Send and offline_access. 6. Copy the Application (client) ID and the Client Secret into the plugin settings. 7. Click Connect with OAuth2. Would you like to find more presets (that you think are useful to other users)? Open a request in the support form and provide the necessary connection data (auth, server address and port). In the next cf7-smtp version you will find the required configuration among the presets. Security It’s warmly advised to use OAuth2 for supported providers (Gmail, Office365) so no passwords are saved. If using basic SMTP authentication, it is highly recommended to store at least the password into wp-config.php as a constant. And in addition, it’s also very easy! It needs only to add define( 'CF7_SMTP_USER_PASS', 'mySecr3tp4ssWord' ); into your wp-config.php just before /* That's all, stop editing! Happy publishing. */ All passwords will be stored encrypted, but still it is not good practice to put it into database! Quick setup As with the user password other security constants can also be defined. Available constants are CF7_SMTP_USER_NAME, CF7_SMTP_USER_PASS, CF7_SMTP_OAUTH2_CLIENT_ID, CF7_SMTP_OAUTH2_CLIENT_SECRET. define( 'CF7_SMTP_SETTINGS', array( 'user_name' => string, 'user_pass' => string, 'oauth2_client_id' => string, 'oauth2_client_secret' => string, )); Template Wouldn’t it be better to have a small container to make our mail a little prettier? Well we have it! You can now assign specific templates to each of your forms via the plugin settings dashboard. To use your own custom templates for emails, simply create them by following these steps: 1. Create a folder named cf7-smtp/ or templates/cf7-smtp/ in your theme (or child theme) folder. 2. Create a .php or .html template file inside it. 3. Go to the plugin settings under Style > Form Email Templates, and select your newly found custom template from the dropdown menu for the desired form. 4. (Optional) You can customize the logo, website link, and other template parts. Checkout the filter documentation on GitHub/wiki. Support Community support: via the support forums on wordpress.org Bug reporting (preferred): file an issue on GitHub Contribute We love your input! We want to make contributing to this project as easy and transparent as possible, whether it’s: Reporting a bug Testing the plugin Discussing the current state, features, improvements Submitting a fix or a new feature We use GitHub to host code, to track issues and feature requests, as well as accept pull requests. By contributing, you agree that your contributions will be licensed under its GPLv2 License.

Is Contact Form 7 spam destroying your mornings? No API key. No data leaving your server. No charges for commercial use. Just effective spam protection that works the moment you activate it. What Gets Protected (FREE) ✅ Contact Form 7 – Block bot spam automatically ✅ WPForms Lite & Pro – Stop automated submissions ✅ Jetpack Contact Forms – Filter bot spam instantly ✅ Fluent Forms – Eliminate bot attacks ✅ SureForms – Block bot spam submissions ✅ WordPress Comments – Clean comment spam from badbots ✅ Business sites included – No commercial fees ever Works immediately after activation. No configuration. No learning curve. No monthly costs. How It Works 3 Steps to Spam-Free Contact Forms: Install – Search “Contact Form 7 spam” in your WordPress dashboard Activate – One click to turn on protection Relax – Your Contact Form 7 and WPForms and others are now protected from bots The moment you activate, spam bots are automatically blocked on all your forms and comments. No settings to configure. No technical knowledge required. No ongoing maintenance. Most users report 95-100% spam reduction within the first 24 hours. Tomorrow morning, check your inbox. Instead of dozens of spam submissions, you’ll see only real customer inquiries. That’s the peace of mind this plugin delivers. Why Contact Form 7 Needs This Contact Form 7 is WordPress’s most popular form plugin with over 5 million active installations. It’s lightweight, flexible, and completely free. But it doesn’t include spam protection. Without protection, Contact Form 7 sites get hammered. Bot networks discover unprotected forms and flood them with submissions. Your inbox fills with junk. You waste time sorting real inquiries from spam. Worse, you risk missing legitimate customers buried in the noise. This plugin fixes that problem. For free. Forever. Free vs Pro: What You Get FREE Version (Most Sites Need Only This): ✅ Contact Form 7 bot spam blocked ✅ WPForms automated spam stopped ✅ Jetpack forms protected ✅ Fluent Forms secured ✅ SureForms protected ✅ WordPress comment spam eliminated ✅ Works on business/commercial sites ✅ Spam statistics dashboard Automated bots cause 95%+ of spam. The free version handles this completely. PRO Version (For Advanced Needs): ⚡ Private Machine Learning human spam detection (runs on your own server, learns from your spam) ⚡ Gravity Forms integration ⚡ WooCommerce registration protection ⚡ Email quarantine for review ⚡ Custom IP blocklists ⚡ Allow/deny pattern rules ⚡ Priority support Most Contact Form 7 users never need Pro. But if you’re getting manually-typed spam or need enterprise features, Pro has you covered. Why This Works Better Than CAPTCHA CAPTCHA makes your visitors prove they’re human by solving puzzles. It’s annoying, hurts conversions, and still lets some spam through. This plugin takes a smarter approach: Invisible honeypot fields – Bots can’t resist filling hidden fields that humans never see Timing analysis – Bots submit forms instantly; real people don’t Behavioral fingerprinting – Bot patterns are detectable and consistent No user friction – Your visitors never know the protection exists Lightning fast – All processing happens locally on your server Your Contact Form 7 stays fast. Your conversion rates stay high. Spam disappears. It just works. Quietly. Effectively. Completely free. Common Questions Answered “Will this work with my existing Contact Form 7 setup?” Yes. It integrates automatically with all CF7 configurations, custom fields, and extensions. Nothing breaks. Spam just stops. “I’m not technical. Can I install this?” If you can install a WordPress plugin, you can use this. There’s literally nothing to configure. Install, activate, done. “What about sites that aren’t in English?” Works perfectly on all languages. The spam detection doesn’t depend on language – it detects bot behavior patterns. “My site sells products. Do I have to pay?” No. Unlike some popular anti-spam solutions that charge business sites, this is free for commercial use. No exceptions. No hidden fees. Ready to Stop Contact Form 7 Spam? Installation takes 30 seconds: In your WordPress dashboard, go to Plugins → Add New Search for “Contact Form 7 spam” Click Install, then Activate Done – your forms are now protected Check your email tomorrow. Enjoy the silence. For detailed statistics and settings, visit Settings → Anti Spam after activation. Go Pro Most Contact Form 7 users never need Pro – the free version eliminates their spam problem completely. What makes Pro unique – private Machine Learning: Unlike cloud filters that ship your visitors’ messages off to an external service, the Pro classifier runs entirely on your own server. It learns from the spam you classify, gets smarter the more you use it, and never sends data to a third party outside your control – no external cloud service, no data sharing, no privacy trade-off. Pro delivers: ✅ Private Machine Learning Human Spam Detection – Stops manually-typed spam that gets past basic filters, using Machine Learning that runs entirely on your own server and learns from your spam classifications – your visitors’ data never leaves your site or goes to a third party outside your control ✅ Gravity Forms Integration – Complete protection for premium form users ✅ WooCommerce Registration Blocking – Stop fake account spam ✅ Email Quarantine – Review and rescue any legitimate messages caught by mistake ✅ Quarantine / Audit Log – Full spam traceability: see every submission the plugin checks, allowed or blocked, and exactly why it was decided (bot trap, Machine Learning human-spam score, single-word, deny rule, real-time IP blocklist or allow list) – with the analysed content, masked IP and country, plus one-click allow/deny actions to fix any mistake ✅ Custom Allow/Deny Rules – Block specific IPs, patterns, or keywords ✅ IP Blocklist Checking – Automatic blocking of known spam networks ✅ Priority Support – Get help directly from the developers Perfect for: – High-traffic sites getting manually-entered spam – Agencies managing multiple client installations – Enterprise sites requiring advanced controls – Gravity Forms and WooCommerce users Start Your Free 30-Day Pro Trial Try Pro features risk-free for 30 days. A card is required to start, but you won’t be charged if you cancel before the trial ends. No pressure, no hassle.