bwt
// plugin

Contact Form 7

by Takayuki Miyoshi

The original WordPress form plugin. Free, minimal, solo-maintained for nearly two decades.

// decision data
Lighthouse
96 / 100
Tested May 30, 2026
Accessibility
WCAG AA
2 axe issues
Open CVEs
0
No known open advisory
Last release
April 18, 2026 v5.9.6
WP.org rating
4.0
2.2K reviews · 10M+ installs
Forms plugin Free GPL Since 2007 Tested up to WP 7.0.1 Requires WP 6.7+ PHP 7.4+
// editorial verdict

Contact Form 7 is the original WordPress contact form plugin, launched in 2007 by Takayuki Miyoshi and maintained solo ever since. One of the most-installed WordPress plugins of all time. Famously minimal feature stance: ship the form plugin that does the form plugin job, nothing more. Free, GPL, no paid tier.

The minimalist philosophy

Contact Form 7's defining trait is what it deliberately leaves out. Takayuki Miyoshi has held a consistent line for nearly two decades: ship a plugin that renders and mails forms reliably, and resist the feature creep that turns tools into platforms. That's why CF7 stays tiny while the commercial builders have grown into sprawling suites.

This is a design choice, not neglect. The minimal core is the whole value proposition — it's the reason CF7 loads fast, rarely conflicts, and has survived nineteen years of WordPress changes without a business model pushing it toward bloat. If you read its short feature list as a limitation, you've misunderstood the product; the restraint is the point.

How you actually build a form

There is no drag-and-drop canvas. You build a form by writing form-tags — a compact, shortcode-style markup — in a plain text editor, then drop the resulting [contact-form-7] shortcode or block into a page. A tag-generator toolbar helps assemble fields so you're not memorizing syntax, and the mail template that formats the notification email is configured on a separate tab.

For anyone comfortable with a little markup, it's quick and transparent — you can see exactly what the form is. For a non-technical user expecting to click and drag, it's the main friction point, and the most common reason people move to WPForms. Neither is wrong; they're different tools for different hands.

What it doesn't do — and how the ecosystem fills the gaps

Out of the box, CF7 doesn't store submissions, block spam, branch on answers, or take payments. Instead of building those in, it relies on an enormous ecosystem of companion plugins. Submission storage comes from Flamingo, written by the same author. Spam protection comes from Akismet, reCAPTCHA, or Cloudflare Turnstile integrations. Conditional logic comes from the Conditional Fields for CF7 add-on. Payments and CRM connections come from third-party bridges.

The trade-off is real: you assemble your own stack rather than getting a bundled one. That means more control and a lighter base, but also more moving parts to vet and maintain — the opposite of the all-in-one model WPForms and Gravity Forms sell.

Performance and security posture

The small footprint pays off in speed. In our reproducible Lighthouse testing, Contact Form 7 posts the highest score of the major form plugins — there's simply less code to load. On a performance-sensitive site, that headroom is a genuine reason to choose it.

Security-wise, CF7's ubiquity makes it a target, but its patch record is solid and disclosures are handled promptly. The realistic risk is misconfiguration rather than the core plugin — an unprotected file-upload field or a form shipped without any spam layer. Keep it updated, add anti-spam deliberately, and lock down file uploads, and it's as safe as anything in the category.

Who Contact Form 7 is for

CF7 is the pick for performance-conscious owners, developers, and anyone comfortable editing a bit of markup who wants a free, no-upsell, no-bloat form — and who's happy to add the two or three companion plugins that round it out. Its footprint and price (zero) are hard to beat.

If you want a visual builder and integrations working out of the box, WPForms is the friendlier path. If you need deep conditional logic, a mature add-on catalog, and commercial support, Gravity Forms is the heavier but more capable tool. Contact Form 7 wins when less is genuinely more.

Pros

  • Genuinely free, no paid tier, no upsell flow
  • Tiny footprint compared to WPForms or Gravity Forms
  • Solo developer with nearly two decades of consistent maintainership
  • Vast ecosystem of complementary plugins (Flamingo, Conditional Fields, etc.) for the features CF7 itself does not ship

Cons

  • No drag-and-drop builder; forms are configured via shortcode-style markup
  • Submission storage requires the companion Flamingo plugin
  • Spam protection requires CAPTCHA or Akismet integration (not built-in)
When to pick Contact Form 7

Pick Contact Form 7 when you want a lightweight, free, no-frills contact form on a WordPress site and you are comfortable editing shortcode markup. The default safe choice for performance-conscious site owners.

When to avoid Contact Form 7

Avoid if you need a drag-and-drop form builder, conditional logic, or integrated CRM connectors out of the box (look at WPForms, Gravity Forms, or Fluent Forms instead).

// faq

Frequently asked questions

Is Contact Form 7 free?
Yes, completely. No Pro tier, no upsell flow. Takayuki Miyoshi has maintained CF7 as fully free for nearly two decades. The plugin is funded by donations and remains GPL.
Contact Form 7 vs WPForms?
Contact Form 7 is lighter (smaller footprint, no UI builder) but requires editing shortcode markup. WPForms is heavier but has a drag-and-drop builder. CF7 for technical users who want speed; WPForms for non-technical users who want the GUI.
How do I store CF7 submissions?
Contact Form 7 doesn't store submissions natively — submitted forms email the form data and are not persisted. The companion Flamingo plugin (by the same author) handles submission storage. Many sites pair the two.
Does Contact Form 7 have spam protection?
Not built in. CF7 integrates with Akismet, reCAPTCHA, Cloudflare Turnstile, and similar via add-on configuration. The minimal-by-default stance is intentional; expect to add a spam layer separately.
Is Contact Form 7 still maintained?
Yes, actively. Takayuki Miyoshi still ships regular releases — security patches and WordPress-compatibility updates land on a steady cadence, with the most recent versions arriving in 2026. It remains one of the longest continuously maintained plugins in the WordPress directory, though it's a solo project, which is worth weighing if long-term bus-factor matters to you.
Does Contact Form 7 slow down my site?
No — it's the opposite. In our reproducible Lighthouse testing, Contact Form 7 scores highest of the major form plugins because it loads so little code. If you want to squeeze it further, you can dequeue its CSS and JavaScript on pages that don't contain a form, but for most sites the default footprint is already negligible.
Can Contact Form 7 do conditional logic?
Not on its own. Conditional logic — showing or hiding fields based on previous answers — comes from the free Conditional Fields for Contact Form 7 add-on. It works well, but it's one more plugin to install and maintain, which is the CF7 pattern: a lean core extended by companion plugins rather than a bundled feature set.
How do I stop spam and add reCAPTCHA to Contact Form 7?
CF7 has built-in integration points for spam tools even though it ships no filter itself. The common setups are Akismet (which CF7 supports natively if the Akismet plugin is active), Google reCAPTCHA, or Cloudflare Turnstile — each configured with API keys under the plugin's Integration settings. Adding one is strongly recommended, since an unprotected CF7 form is a frequent spam magnet.
// activity & context

Recent releases

  1. v5.9.6 April 18, 2026

    Security patch, WordPress 6.8 compatibility

  2. v5.9.5 March 4, 2026

    Patch release

  3. v5.9.4 January 22, 2026

    Maintenance release

  4. v5.9.3 December 8, 2025

    Translation updates

  5. v5.9.2 November 18, 2025

    Security fix for file upload field

  6. v5.9.1 October 4, 2025

    Patch release

  7. v5.9 September 15, 2025

    Form tag generator improvements

  8. v5.8.7 August 12, 2025

    Maintenance release

// often compared with Full comparison
Product CategoryPriceLighthouse
Contact Form 7 this FormsFree96
WPForms FormsFree, Pro from $4989
Gravity Forms FormsFrom $5992
// methodology

Performance testing

Tested on Kinsta Starter (Google Cloud C3D, Iowa). Configuration: Contact Form 7 with one form on contact page, Twenty Twenty-Four theme baseline, mobile, 4G simulated, cold cache. 5 runs, median reported. Raw Lighthouse JSON downloadable on request.

Vulnerability tracking

Open and recently closed CVE counts pulled from Patchstack and Wordfence Intelligence on every build. Last disclosure date reflects the most recent public CVE for this plugin, not necessarily the most recent vendor patch.