Message Filter for Contact Form 7

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 87% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. A declining trend compresses what a buyer would pay.

1. ★★★★★ BJ Harrington

   2.7y ago

   The Lite version worked great for keeping out most of the SPAM, phishing, and other breaches to our inbox. But I upgraded to the Pro version to block some additional SPAM that had started hitting us hard. I was getting emails from gmail and other accounts that had a lot of periods in the username area, like [email protected]. I added .a. .b. .c. and so on to the filter, and it is now blocking them quite efficiently. Thank you for creating this filter for CF7! It works great, easy to use, and the price for the Pro Version is great! This topic was modified 2 years, 2 months ago by BJ Harrington. Reason: Upgraded to the Pro version

   Read on wp.org ↗
2. ★★★★★ maowebsolutions

   2.8y ago

   This is a really great plugin if you are looking to stop spam.

   Read on wp.org ↗
3. ★★★★★ Arcelius

   3.0y ago

   Iv’e tried several plugins to stop spam but they still got through. This one actually works! This topic was modified 2 years, 11 months ago by Arcelius.

   Read on wp.org ↗
4. ★★★★★ alexander042

   3.1y ago

   Does exactly what it is supposed to do.

   Read on wp.org ↗
5. ★★★★★ darrenbb

   3.4y ago

   Since employing this plugin. The human spam has gone. Thank you. would a great idea to have option to block spam on convert kit or fluent form submit also and offer as premium.

   Read on wp.org ↗
6. ★★★★★ schmekis

   3.6y ago

   Been building sites with cf7 for 4 years, and recaptcha gets only part of the job done, honey pot gets only part of it done, and hcaptcha (for me) was a disaster because legit lead forms weren’t getting through. I was at a loss as to how to fill the gap. 95% of my spam still getting through was coming from digital marketers, and I wondered — why isn’t there a simple plugin that would filter out lead forms based on certain keywords? This plugin for some reason was hard to find, but fits the bill. I’m honestly surprised it doesn’t have at least a million users. If those using CF7 knew about it… it would. Honestly a no-brainer, one of those that is such common sense that you feel stupid you didn’t think of a lot earlier. Has lots of potential.

   Read on wp.org ↗
7. ★★★★★ salvatur77

   3.9y ago

   This plugin works exactly as I expected! The ability to block messages based on keywords, email domains and languages helps so much and currently blocks 99.9% of spam on my website. I made a request to the plugin developer to add a feature, and a couple of weeks later he replied to my message saying that the feature is now added. I’m impressed that this plugin is free. I really wish the developer could create a version that works with Gravity Forms as well 🙂

   Read on wp.org ↗
8. ★★★★★ ungern

   4.9y ago

   Lots of spam would get through via our contact forms despite simple “do the math” hurdle and Captcha too, and they all stick in this gem. Download, install, you won’t regret it. Super-de-luxe I must say!

   Read on wp.org ↗

9 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Message Filter for Contact Form 7 <= 1.6.3.9 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-27 CVE-2026-65438 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.3.9 Patched in 1.6.4.0
2. Medium · 6.1 Message Filter for Contact Form 7 <= 1.6.3.8 - Reflected Cross-Site Scripting ↗
   2026-07-08 CVE-2026-57423 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.3.8 Patched in 1.6.3.9
3. Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.3.2 Patched in 1.6.3.3
4. Medium · 4.9 Message Filter for Contact Form 7 <= 1.6.3.2 - Authenticated (Administrator+) SQL Injection ↗
   2025-04-22 CVE-2025-46252 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.6.3.2 Patched in 1.6.33
5. Medium · 4.3 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation ↗
   2024-12-06 CVE-2024-12026 Missing Authorization Affects <= 1.6.3 Patched in 1.6.3.1
6. Medium · 4.3 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions ↗
   2024-12-05 CVE-2024-12027 Missing Authorization Affects <= 1.6.3 Patched in 1.6.3.1
7. Medium · 4.3 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization ↗
   2024-12-05 CVE-2024-54254 Missing Authorization Affects <= 1.6.3 Patched in 1.6.3.1
8. Medium · 6.1 Message Filter for Contact Form 7 <= 1.6.1.1 - Reflected Cross-Site Scripting ↗
   2024-08-01 CVE-2024-39647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.1.1 Patched in 1.6.2
9. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
   2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.4.2 Patched in 1.4.3

Automated install-time checks, tested on PHP 8.1.12 · WP 6.8.2

Translated into 1 language, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-17 2K+ → 1K+ down after 2 days in tier
2. 2026-01-15 1K+ → 2K+ up after 13 days in tier
3. 2026-01-02 2K+ → 1K+ down after 1 days in tier
4. 2026-01-01 1K+ → 2K+ up after 1 days in tier
5. 2025-12-31 2K+ → 1K+ down after 777 days in tier
6. 2023-11-15 1K+ → 2K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) 80K+ installs · 4.5★ · 3 shared tags A
• ReCaptcha v2 for Contact Form 7 200K+ installs · 4.8★ · 2 shared tags A
• Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 8K+ installs · 4.7★ · 2 shared tags A
• WP Spam Question Filter 2K+ installs · 4.2★ · 2 shared tags D
• Anti-Spam Protection – No API Key, GDPR Friendly 1K+ installs · 4.5★ · 2 shared tags A
• Smart Phone Field For WPForms, Contact Form 7, Fluent Forms, Elementor Forms, WooCommerce, Formidable Forms, Ninja Forms 1K+ installs · 4.2★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Message Filter for Contact Form 7 into a readme, a review or a deck. It updates itself.

Message Filter for Contact Form 7: 1K+ active installs, 4.9★ (13 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/cf7-message-filter