Why is Contact Form 7 marking real messages as spam?

One of four checks flagged it: a word in WordPress's Disallowed Comment Keys list, Akismet, CF7's own user-agent or nonce check, or another anti-spam plugin hooked into CF7. Install Flamingo to see the spam log, which names the check.

Does Contact Form 7 use the WordPress Disallowed Comment Keys list?

Yes. CF7 checks every form field, the sender's IP address and user agent against that list. Matching ignores case and works inside words, so short entries can block real messages.

Where do Contact Form 7 spam messages go?

Nowhere by default. Contact Form 7 doesn't store submissions. With the Flamingo plugin installed, spam-flagged messages are saved with their spam log.

Why does Contact Form 7 say "There was an error trying to send your message"?

CF7 shows that same default text when a message is flagged as spam and when the email fails to send. Change the spam message in the form's Messages tab so you can tell them apart.

Missed Form Alert / Guides

Contact Form 7

Contact Form 7 messages going to spam: what's actually blocking them

When Contact Form 7 marks a message as spam, one of four things did it: a word from WordPress's Disallowed Comment Keys list, Akismet, CF7's own basic checks, or another anti-spam plugin plugged into CF7, such as CleanTalk. The visitor can't tell. CF7's default spam message is the same one it shows when the email fails to send. To find out which check fired, install Flamingo. It keeps spam-flagged messages along with CF7's spam log, which names the check.

Last checked 27 Sep 2026

Two different problems share this name

"Going to spam" can mean CF7 flagged the message and never emailed it. It can also mean the email was sent and landed in your spam folder. If the email turns up in your junk folder, the form did its job and this is an email delivery problem. This page covers that one. The rest of this page is about CF7 flagging the message itself.

The four things that mark a CF7 message as spam

From reading Contact Form 7 6.1.7's code:

1. WordPress's Disallowed Comment Keys list

CF7 reuses the list at Settings → Discussion → Disallowed Comment Keys, even though it sits with the comment settings. It checks every field in the form, plus the sender's IP address and browser user agent. The match ignores case and works inside words. So an old entry like cialis also matches "specialist", and a short entry can match far more than you meant.

In our test, with casino on the list, CF7 blocked a message and logged Disallowed words (casino) are used. Clean up the list: take out short or common words, and anything added years ago for comments.

2. Akismet

Only if a field in the form has an akismet: option, such as [email* your-email akismet:author_email], and Akismet has a valid key. No akismet: options means Akismet isn't checking this form. When it flags one, the log says "Akismet returns a spam response." and nothing more. More on this in Akismet marking real messages as spam.

3. CF7's own checks

Two of them: a browser user agent shorter than two characters ("User-Agent string is unnaturally short"), and, for logged-in users only, an invalid security nonce.

4. Other anti-spam plugins

CleanTalk, OOPSpam and others hook into the same CF7 spam check. Some tools, including Turnstile, Maspik and WP Armour, work through CF7's validation step instead, so the visitor sees a validation error rather than the spam message. If you run one of these, check its own log first. For CleanTalk, see CleanTalk blocking real submissions.

How to find out which one it was

Install Flamingo
It's from CF7's developer. It saves submissions, including spam-flagged ones with their spam log. Without it, CF7 keeps nothing, and a flagged enquiry is gone.
Send a test enquiry
Log out first, then use the live form on your phone with a real email address. Write it like a customer would.
Read what the form says
By default CF7 shows "There was an error trying to send your message. Please try again later." for spam and for a failed email. If you change the spam message in the form's Messages tab to something different, you'll be able to tell the two apart from now on.
Check Flamingo's spam list
Each flagged message shows the agent and reason, for example disallowed_list or akismet. Fix that one check rather than loosening everything.

If you'd rather be told automatically

Missed Form Alert is a WordPress plugin we're building for exactly this. It keeps a copy of each submission when it reaches your site. If a spam filter blocked one that looks like a real enquiry, or the notification email failed, you get an email with the message in it, so you can judge it yourself.

Your current filter stays where it is and we never block anything. Contact Form 7 and WPForms are supported so far, and it's free while in early access. More on the home page.

Questions

Why is Contact Form 7 marking real messages as spam?: One of four checks flagged it: a word in WordPress's Disallowed Comment Keys list, Akismet, CF7's own user-agent or nonce check, or another anti-spam plugin hooked into CF7. Install Flamingo to see the spam log, which names the check.
Does Contact Form 7 use the WordPress Disallowed Comment Keys list?: Yes. CF7 checks every form field, the sender's IP address and user agent against that list. Matching ignores case and works inside words, so short entries can block real messages.
Where do Contact Form 7 spam messages go?: Nowhere by default. Contact Form 7 doesn't store submissions. With the Flamingo plugin installed, spam-flagged messages are saved with their spam log.
Why does Contact Form 7 say "There was an error trying to send your message"?: CF7 shows that same default text when a message is flagged as spam and when the email fails to send. Change the spam message in the form's Messages tab so you can tell them apart.