Quick wins (try these first)
- Note the border color of the message box (orange = spam blocked, red = mail failed). This tells you where to look first.
- Open your browser console → Network while submitting. Look for blocked calls to
/wp-json/ or admin-ajax.php (403/406/500).
- Temporarily disable caching/minification on the form page and exclude
/wp-json/ from your CDN/WAF.
Step 1 — If the box is orange: spam filter blocked it
When Contact Form 7 marks a submission as spam, you’ll see an orange message. Common causes are reCAPTCHA v3 scoring too low or overly aggressive filters.
- Enable Spam Log in CF7 so you can see the exact reason:
- Go to Contact → Integration and enable the Spam log module (and ensure reCAPTCHA/Akismet are connected).
- Submit again and review the log; look for “reCAPTCHA score too low”, “Akismet: spam”, etc.
- Fix reCAPTCHA v3 issues:
- Verify keys under Contact → Integration → reCAPTCHA and remove any duplicate reCAPTCHA plugins.
- If the log shows low scores, try Cloudflare Turnstile integration or (if you prefer a challenge) a v2 checkbox via a companion plugin. Re-test.
- Reduce false positives:
- Remove suspicious words/URLs in your form temporarily and re-test.
- If using Akismet, ensure the site is properly connected and not rate-limited.
Step 2 — If the box is red: mail sending failed
Red usually means the form submitted but email delivery failed.
- Use a real SMTP mailer (don’t rely on
php_mail()):
- Install/configure an SMTP plugin (e.g., WP Mail SMTP, Post SMTP) with your mail provider (SendGrid, Mailgun, Amazon SES, or your host).
- Authenticate your domain (SPF/DKIM) at your DNS provider per your mailer’s docs.
- Set CF7 “Mail” tab correctly:
- From: use an address on your site’s domain (e.g.,
noreply@yourdomain.com).
- To: your recipient address(es).
- Additional Headers: set
Reply-To: [your-email] so replies go to the sender.
- Store messages as a safety net:
- Install “Flamingo” so every submission is saved in WordPress. This confirms the form works even if email is delayed.
Step 3 — REST API/AJAX blocked (403/406/500)
Modern CF7 submits via the WordPress REST API. If it’s blocked by a security rule, CDN/WAF, or server module, the form can’t send.
- Check the console → Network while submitting:
- Requests like
/wp-json/contact-form-7/v1/contact-forms/<id>/feedback or /?rest_route=/contact-form-7/v1/... should return 200.
- If you see 403/406/500, whitelist the REST paths in your security plugin, host WAF, or CDN (e.g., ModSecurity/Cloudflare).
- Exclude from cache:
- Exclude the form page and
/wp-json/ from page caching and HTML/JS/CSS minification.
- Test REST API quickly (replace domain and ID):
curl -I https://example.com/wp-json/contact-form-7/v1/contact-forms/123/feedback
You should get a 200 OK. If not, fix the block first, then re-test the form.
Best-practice CF7 mail settings (copy this pattern)
- From:
noreply@yourdomain.com
- To:
you@yourdomain.com
- Subject:
[your-subject] – New message from your site
- Additional Headers:
Reply-To: [your-email]
- Enable SMTP and authenticate your domain (SPF/DKIM) at your mail provider.
Still stuck? Use this decision tree
- Message is orange → check Spam Log → fix reCAPTCHA/Akismet → re-test.
- Message is red → set up SMTP + correct “Mail” tab + SPF/DKIM → re-test.
- Network shows 403/406/500 on REST → whitelist
/wp-json/ + disable caching/minify on form page → re-test.
- Install Flamingo to confirm submissions arrive even if email is delayed.
Helpful official links
Tip: After fixing, submit the form twice: once logged out (fresh browser) and once from a mobile network. This catches any session or IP-based filtering you might miss on your normal connection.