Trick spam bots with Honeypot for Contact Form 7

As soon as you offer a contact form, e.g. with the very popular Contact Form 7, you will find a lot of spam in your inbox. Most of those messages do not come from actual people but from so-called spam bots. There are several methods to avoid or reduce the number of such spam messages. All of those methods work differently and it might even make sense to combine them.

Honeypot for Contact Form 7 is one of the very simple and fast methods to embed. Compared to other methods it works so simple that you can implement it in minutes without any impact on your site performance.

The principle of a honeypot is simple — bots are stupid. While some spam is hand-delivered, the vast majority is submitted by bots scripted in a specific (wide-scope) way to submit spam to the largest number of form types. In this way, they somewhat blindly fill in fields, regardless of whether the field should be filled in or not. This is how a honeypot catches the bot — it introduces an additional field in the form that if filled out will cause the form not to validate.

Ryan –

Will this module stop all my contact form spam?
Probably not. But it should reduce it to a level whereby you don’t require any additional spam challenges (CAPTCHA, math questions, etc.).

Are honeypots better than CAPTCHAs?
This largely depends on the quality of the CAPTCHA. Unfortunately the more difficult a CAPTCHA is to break, the more unfriendly it is to the end user. This honeypot module was created because we don’t like CAPTCHA’s cluttering up our forms. Our recommendation is to try this module first, and if you find that it doesn’t stop enough spam, then employ more challenging anti-spam techniques.


  1. Install using the WordPress “Add Plugin” feature — just search for “Honeypot for Contact Form 7”.
  2. Confirm that Contact Form 7 is installed and activated. Then activate this plugin.
  3. Edit a form in Contact Form 7.
  4. Choose Honeypot from the CF7 tag generator. Recommended: change the honeypot element’s ID.
  5. Insert the generated tag anywhere in your form. The added field uses inline CSS styles to hide the field from your visitors.
Contact Form 7 with the hidden honeypot field to trick the spam bot

Even though the video is quite outdated, the principle did not change and stay the same for a very long time. More information and help can be found from the developer or in the WordPress forum.

Adding Honeypot to Contact Form 7 by RoseApple Media