Contact Form 7 is one of the most widely used WordPress plugins in the world. It is free, flexible, and gets the job done - but a few configuration steps are easy to miss, especially around email deliverability and spam protection. Follow this guide and your contact form will be set up properly from the start.
Installing Contact Form 7
From your WordPress dashboard, go to Plugins > Add New and search for "Contact Form 7." Install the plugin by Takayuki Miyoshi and activate it. You will see a new Contact menu item appear in your sidebar.
Contact Form 7 creates a default form automatically on activation. You can edit that form or create a new one by going to Contact > Add New.
Understanding the Form Builder
The form editor uses shortcodes to define fields. Each field shortcode follows the pattern [field-type field-name]. The default form includes basic fields for name, email, subject, and message - a good starting point for most sites.
To add a new field, click the tag generator buttons above the editor (Text, Email, URL, Telephone, etc.). A dialog walks you through naming the field, marking it required, and inserting the shortcode into your form.
Common customizations include:
- Making fields required by using an asterisk:
[text* your-name] - Adding placeholder text within the shortcode:
[text* your-name placeholder "Your full name"] - Adding a dropdown: use the Select tag type and enter your options
The Mail tab controls where form submissions are sent. By default it sends to your WordPress admin email. Update the To field to your actual contact address, and write a clear Subject so you recognize form submissions in your inbox.
The Spam Problem: Your Forms Going to Spam
This is the most common issue after installation. Contact Form 7 sends email through your server's default mail function, and without proper email authentication configured, those messages often end up in spam folders or get blocked entirely.
The fix is ensuring your domain has SPF and DKIM records set up correctly in your DNS. SPF tells receiving mail servers which servers are authorized to send email for your domain. DKIM adds a cryptographic signature that verifies the message was not tampered with in transit. If you are hosted with dotCanada, these records can be configured through cPanel's Email Deliverability tool.
For more reliable delivery, consider installing an SMTP plugin (like WP Mail SMTP) to send form notifications through an authenticated email account rather than the server's default mailer.
Adding Spam Protection with hCaptcha
Without some form of CAPTCHA, your contact form will accumulate bot submissions quickly. Contact Form 7 supports hCaptcha as a built-in integration.
To add hCaptcha:
- Register a free account at hcaptcha.com and get your site key and secret key
- In WordPress, go to Contact > Integration and enter your keys under the hCaptcha section
- Add the
[hcaptcha]shortcode to your form, typically just before the submit button - Save the form
hCaptcha presents a privacy-respecting challenge that stops most bots without requiring visitors to identify traffic lights or fire hydrants.
The Flamingo plugin, made by the same developer, is also worth installing alongside Contact Form 7. It stores every form submission in your WordPress database, which gives you a backup copy of every message in case an email notification goes missing.
Testing Before You Go Live
Do not assume your form works because it looks correct in the editor. Before publishing your site, submit a test message through the form yourself and verify:
- The form submits without an error message
- You receive the notification email in your inbox (not spam)
- The email contains the correct field values
- If using Flamingo, the submission appears under Flamingo > Inbound Messages
Test from a different email address than the one receiving notifications - some mail servers handle intra-domain messages differently. If you have a colleague or friend who can submit a test from their own email, even better.
A contact form that silently fails is worse than no contact form at all. Taking ten minutes to test properly saves you from missing real customer inquiries.
