Works with your stack
Cookie consent for Contact Form 7
no enquiry lost to spam
Contact Form 7 sets no cookie of its own. Its reCAPTCHA does, and once its keys are saved it loads on every page of your site. When reCAPTCHA waits for consent, a message sent without it is filed as spam and no email goes out.
By Rock Lobster, LLC · contactform7.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Contact Form 7
WordPress plugin
- Tested version
- 6.2.4.1
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 6.2.4.1 tested
- Active installs
- 10,000,000+
What Contact Form 7 adds to your visitors’ browser
No trackers In our test of Contact Form 7 6.2.4.1 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What Contact Form 7 puts on your pages
- The form
- Its script and styles, served by your site. No cookie and no request to another site.
- reCAPTCHA, once you add keys
- Loads Google reCAPTCHA on every page, not only where a form is, and checks each visit in the background. It sets Google cookies, so it waits for consent by default.
- Turnstile, once you add keys
- Cloudflare’s captcha, built into Contact Form 7. It also loads on every page. It is used for security only and is treated as necessary.
- Stripe, if you set it up
- Loads Stripe for payment forms.
- Akismet and mailing lists
- Akismet, Constant Contact and Brevo are reached by your server when a form is sent. Nothing of theirs runs in the visitor’s browser.
What matters for consent with Contact Form 7
No token, no email
Without a reCAPTCHA token, Contact Form 7 files the message as spam and sends no email. The visitor thinks it went through. Cookie Rocks stops the send until reCAPTCHA is allowed, and says why on the form.
The question sits on the form
Each Contact Form 7 form gets a short note at its top, with a button that allows reCAPTCHA alone. The page then reloads and what the visitor typed comes back. Passwords, files and hidden fields are left out.
recaptcha.net, not google.com
Cookie Rocks tells Contact Form 7 to load reCAPTCHA from recaptcha.net, so the visitor’s google.com cookies are not sent with it.
Held on every page, asked on forms only
reCAPTCHA is held wherever Contact Form 7 loads it. The question appears only on pages with a form, where it makes sense.
A form without the question
Cloudflare Turnstile or a honeypot field protect a form without asking for consent. With them, Cookie Rocks adds no note and nothing waits.
Cookie Rocks with Contact Form 7
- When reCAPTCHA or hCaptcha waits for consent, shows an “Allow” request at the top of its forms.
- Holds sending until reCAPTCHA is allowed, and puts back what the visitor typed after the page reloads.
- Serves reCAPTCHA from recaptcha.net, without the cookies of google.com.
What our tests found on Contact Form 7
Good to know · Drag and Drop Multiple File Upload for Contact Form 7What Drag and Drop Multiple File Upload for Contact Form 7 stores in browsers
Drag and Drop for CF7: dnd_wpcf7_session_id and dnd_cf7_token_* (necessary, 24 h, upload field only).
Name Kept in Category What it is for dnd_wpcf7_session_idlocalStorage Necessary Keeps the visitor's upload folder for the form, 24 hours dnd_cf7_token_*localStorage Necessary Keeps the token of the visitor's upload folder, 24 hours *_count_fileslocalStorage Necessary Counts the files added to the upload field Read in its code, 4 November 2026, Drag and Drop Multiple File Upload for Contact Form 7.
Full detail
On a page with its upload field, the plugin keeps in local storage dnd_wpcf7_session_id (a random upload folder and the time it was made), dnd_cf7_token_<folder> (a random token for that folder) and <field>_count_files. It deletes the folder and token after 24 hours. They let the visitor's files reach the form; nothing is sent elsewhere. The Audit 2.9.11 shows the observed dnd_cf7_token_<uuid> under the site's own name as an identifier to check, although the same plugin's code pattern dnd_cf7_token_* is in its list.
Good to know · Contact Form 7, WPForms Lite, Forminator, Fluent Forms, Ninja FormsFive form plugins set nothing on a default home page
by default: Default settings
With default settings and no form on the page, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, store nothing and load no known third-party tool.
Seen in our tests, 17 October 2026, Contact Form 7, WPForms Lite, Forminator, Fluent Forms, Ninja Forms 6.2.2, 2.0.2.2, 1.58.2, 6.2.16, 3.15.6.
Full detail
On a fresh WordPress home page with default settings, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, keep nothing in the browser's storage and load no known third-party tool, before or after Accept all (no form or captcha placed on the page).
Set before the choice · Contact Form 7Contact Form 7 loads reCAPTCHA on every page, not only form pages
Once keys are saved, reCAPTCHA runs on each page load. Turnstile also loads on every page, and Stripe wherever CF7 scripts load. A filter can switch reCAPTCHA to www.recaptcha.net.
Read in its code, 16 October 2026, Contact Form 7 6.2.2.
Full detail
Once reCAPTCHA keys are saved, Contact Form 7 enqueues google-recaptcha (api.js?render=) and wpcf7-recaptcha on every page, not only pages with a form, and calls grecaptcha.execute on each page load. Turnstile (challenges.cloudflare.com/turnstile/v0/api.js) also loads on every page once its keys are saved, and js.stripe.com/v3/ wherever CF7 scripts load when Stripe is set up. The filter wpcf7_use_recaptcha_net switches reCAPTCHA to www.recaptcha.net.
Good to know · Contact Form 7Cookie Rocks asks for reCAPTCHA permission above Contact Form 7 forms
Sending waits until reCAPTCHA is allowed, the page reloads without losing what was typed, and reCAPTCHA loads from recaptcha.net. A setting can treat it as necessary.
Read in its code, 16 October 2026, Contact Form 7 6.2.2.
Full detail
On Contact Form 7 forms protected by reCAPTCHA, Cookie Rocks shows a permission request above the form, holds the send until reCAPTCHA is allowed, reloads without losing what was typed, and loads reCAPTCHA from recaptcha.net. A setting can treat reCAPTCHA as necessary.
Good to know · Contact Form 7Contact Form 7 sets no cookie and contacts no other site by default
Other sites are contacted only when reCAPTCHA, Turnstile, Akismet, Stripe or a mailing tool is on. A submission records time, IP address, port, browser and page address.
Read in its code, 16 October 2026, Contact Form 7 6.2.2.
Full detail
Contact Form 7 reads and sets no cookie and sends nothing to other sites unless reCAPTCHA, Turnstile, Akismet, Stripe or a mailing tool is turned on. A submission records timestamp, IP address, port, user agent and page URL. The nonce is added only for logged-in users, so a cached form page stays valid for visitors. It does not use WP Consent API.
Good to know · Contact Form 7Without reCAPTCHA loaded, Contact Form 7 files messages as spam
The form is then sent without a token, filed as spam and no e-mail is sent. An empty Turnstile token is also treated as spam.
Read in its code, 16 October 2026, Contact Form 7 6.2.2.
Full detail
If grecaptcha is missing, Contact Form 7's wpcf7-recaptcha script stops with an error before it wraps the submit, so the form is sent without a token and CF7 files it as spam ('reCAPTCHA response token is empty.') and sends no email. An empty Turnstile token is also treated as spam.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Contact Form 7 6.2.4.1, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Contact Form 7 6.2.4.1 on 7 November 2026, with WordPress 7.1.3.
Forms and captchas
Other plugins of the same kind.
Questions
Can I treat reCAPTCHA as necessary?
Yes, in the Cookie Rocks settings. reCAPTCHA then loads for everyone, without the question. Authorities disagree on that exemption, and the free Audit reminds you of it.
Does a visitor have to accept all cookies to write to me?
No. The button on the form allows reCAPTCHA only. Other marketing cookies stay refused.
Does Contact Form 7 read WP Consent API?
No. It has no consent setting either: its acceptance checkbox is a form field, not a cookie choice.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For Contact Form 7 sites
Every message reaches your inbox.
the spam folder stays honest
Every feature of the complete plugin for 30 days, no card. Your forms keep working as they do today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.