Contact Form 7
The original WordPress form plugin. Free, minimal, solo-maintained for nearly two decades.
- Lighthouse
- 96 / 100 Tested May 30, 2026
- Accessibility
- WCAG AA
- Open CVEs
- 0
- Last release
- April 18, 2026 v5.9.6
- WP.org rating
- 4.0
Contact Form 7 is the original WordPress contact form plugin, launched in 2007 by Takayuki Miyoshi and maintained solo ever since. One of the most-installed WordPress plugins of all time. Famously minimal feature stance: ship the form plugin that does the form plugin job, nothing more. Free, GPL, no paid tier.
The minimalist philosophy
Contact Form 7's defining trait is what it deliberately leaves out. Takayuki Miyoshi has held a consistent line for nearly two decades: ship a plugin that renders and mails forms reliably, and resist the feature creep that turns tools into platforms. That's why CF7 stays tiny while the commercial builders have grown into sprawling suites.
This is a design choice, not neglect. The minimal core is the whole value proposition — it's the reason CF7 loads fast, rarely conflicts, and has survived nineteen years of WordPress changes without a business model pushing it toward bloat. If you read its short feature list as a limitation, you've misunderstood the product; the restraint is the point.
How you actually build a form
There is no drag-and-drop canvas. You build a form by writing form-tags — a compact, shortcode-style markup — in a plain text editor, then drop the resulting [contact-form-7] shortcode or block into a page. A tag-generator toolbar helps assemble fields so you're not memorizing syntax, and the mail template that formats the notification email is configured on a separate tab.
For anyone comfortable with a little markup, it's quick and transparent — you can see exactly what the form is. For a non-technical user expecting to click and drag, it's the main friction point, and the most common reason people move to WPForms. Neither is wrong; they're different tools for different hands.
What it doesn't do — and how the ecosystem fills the gaps
Out of the box, CF7 doesn't store submissions, block spam, branch on answers, or take payments. Instead of building those in, it relies on an enormous ecosystem of companion plugins. Submission storage comes from Flamingo, written by the same author. Spam protection comes from Akismet, reCAPTCHA, or Cloudflare Turnstile integrations. Conditional logic comes from the Conditional Fields for CF7 add-on. Payments and CRM connections come from third-party bridges.
The trade-off is real: you assemble your own stack rather than getting a bundled one. That means more control and a lighter base, but also more moving parts to vet and maintain — the opposite of the all-in-one model WPForms and Gravity Forms sell.
Performance and security posture
The small footprint pays off in speed. In our reproducible Lighthouse testing, Contact Form 7 posts the highest score of the major form plugins — there's simply less code to load. On a performance-sensitive site, that headroom is a genuine reason to choose it.
Security-wise, CF7's ubiquity makes it a target, but its patch record is solid and disclosures are handled promptly. The realistic risk is misconfiguration rather than the core plugin — an unprotected file-upload field or a form shipped without any spam layer. Keep it updated, add anti-spam deliberately, and lock down file uploads, and it's as safe as anything in the category.
Who Contact Form 7 is for
CF7 is the pick for performance-conscious owners, developers, and anyone comfortable editing a bit of markup who wants a free, no-upsell, no-bloat form — and who's happy to add the two or three companion plugins that round it out. Its footprint and price (zero) are hard to beat.
If you want a visual builder and integrations working out of the box, WPForms is the friendlier path. If you need deep conditional logic, a mature add-on catalog, and commercial support, Gravity Forms is the heavier but more capable tool. Contact Form 7 wins when less is genuinely more.
Pros
- Genuinely free, no paid tier, no upsell flow
- Tiny footprint compared to WPForms or Gravity Forms
- Solo developer with nearly two decades of consistent maintainership
- Vast ecosystem of complementary plugins (Flamingo, Conditional Fields, etc.) for the features CF7 itself does not ship
Cons
- No drag-and-drop builder; forms are configured via shortcode-style markup
- Submission storage requires the companion Flamingo plugin
- Spam protection requires CAPTCHA or Akismet integration (not built-in)
Pick Contact Form 7 when you want a lightweight, free, no-frills contact form on a WordPress site and you are comfortable editing shortcode markup. The default safe choice for performance-conscious site owners.
Avoid if you need a drag-and-drop form builder, conditional logic, or integrated CRM connectors out of the box (look at WPForms, Gravity Forms, or Fluent Forms instead).
Frequently asked questions
- Is Contact Form 7 free?
- Yes, completely. No Pro tier, no upsell flow. Takayuki Miyoshi has maintained CF7 as fully free for nearly two decades. The plugin is funded by donations and remains GPL.
- Contact Form 7 vs WPForms?
- Contact Form 7 is lighter (smaller footprint, no UI builder) but requires editing shortcode markup. WPForms is heavier but has a drag-and-drop builder. CF7 for technical users who want speed; WPForms for non-technical users who want the GUI.
- How do I store CF7 submissions?
- Contact Form 7 doesn't store submissions natively — submitted forms email the form data and are not persisted. The companion Flamingo plugin (by the same author) handles submission storage. Many sites pair the two.
- Does Contact Form 7 have spam protection?
- Not built in. CF7 integrates with Akismet, reCAPTCHA, Cloudflare Turnstile, and similar via add-on configuration. The minimal-by-default stance is intentional; expect to add a spam layer separately.
- Is Contact Form 7 still maintained?
- Yes, actively. Takayuki Miyoshi still ships regular releases — security patches and WordPress-compatibility updates land on a steady cadence, with the most recent versions arriving in 2026. It remains one of the longest continuously maintained plugins in the WordPress directory, though it's a solo project, which is worth weighing if long-term bus-factor matters to you.
- Does Contact Form 7 slow down my site?
- No — it's the opposite. In our reproducible Lighthouse testing, Contact Form 7 scores highest of the major form plugins because it loads so little code. If you want to squeeze it further, you can dequeue its CSS and JavaScript on pages that don't contain a form, but for most sites the default footprint is already negligible.
- Can Contact Form 7 do conditional logic?
- Not on its own. Conditional logic — showing or hiding fields based on previous answers — comes from the free Conditional Fields for Contact Form 7 add-on. It works well, but it's one more plugin to install and maintain, which is the CF7 pattern: a lean core extended by companion plugins rather than a bundled feature set.
- How do I stop spam and add reCAPTCHA to Contact Form 7?
- CF7 has built-in integration points for spam tools even though it ships no filter itself. The common setups are Akismet (which CF7 supports natively if the Akismet plugin is active), Google reCAPTCHA, or Cloudflare Turnstile — each configured with API keys under the plugin's Integration settings. Adding one is strongly recommended, since an unprotected CF7 form is a frequent spam magnet.
Recent releases
- v5.9.6 April 18, 2026
Security patch, WordPress 6.8 compatibility
- v5.9.5 March 4, 2026
Patch release
- v5.9.4 January 22, 2026
Maintenance release
- v5.9.3 December 8, 2025
Translation updates
- v5.9.2 November 18, 2025
Security fix for file upload field
- v5.9.1 October 4, 2025
Patch release
- v5.9 September 15, 2025
Form tag generator improvements
- v5.8.7 August 12, 2025
Maintenance release
| Product | Category | Price | Lighthouse |
|---|---|---|---|
| | Forms | Free | 96 |
| | Forms | Free, Pro from $49 | 89 |
| | Forms | From $59 | 92 |
-
AI Engine
Most-featured AI plugin for WordPress. Chatbots, content generation, image generation, MCP server endpoints, multi-provider.
-
All-In-One Security (AIOS)
The most-installed free WordPress firewall and hardening plugin. Genuinely capable free tier from the UpdraftPlus team.
-
All-in-One WP Migration
One-click full-site export and import in the browser. The simplest way to move a WordPress site — installed on 5M+.
-
BackWPup
Scheduled WordPress backups to cloud storage — Dropbox, S3, FTP — with cloud destinations in the free tier.
Performance testing
Tested on Kinsta Starter (Google Cloud C3D, Iowa). Configuration: Contact Form 7 with one form on contact page, Twenty Twenty-Four theme baseline, mobile, 4G simulated, cold cache. 5 runs, median reported. Raw Lighthouse JSON downloadable on request.
Vulnerability tracking
Open and recently closed CVE counts pulled from Patchstack and Wordfence Intelligence on every build. Last disclosure date reflects the most recent public CVE for this plugin, not necessarily the most recent vendor patch.