Message Filter for Contact Form 7

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

34 searches this plugin appeared in over the last 90 days, 10 listed. 24 left out as unrelated or noise (years, numbers, stray words). 3 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 87% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 10 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ BJ Harrington

   2.8y ago

   The Lite version worked great for keeping out most of the SPAM, phishing, and other breaches to our inbox. But I upgraded to the Pro version to block some additional SPAM that had started hitting us hard. I was getting emails from gmail and other accounts that had a lot of periods in the username area, like [email protected]. I added .a. .b. .c. and so on to the filter, and it is now blocking them quite efficiently. Thank you for creating this filter for CF7! It works great, easy to use, and the price for the Pro Version is great! This topic was modified 2 years, 2 months ago by BJ Harrington. Reason: Upgraded to the Pro version

   Read on wp.org ↗
2. ★★★★★ maowebsolutions

   3.0y ago

   This is a really great plugin if you are looking to stop spam.

   Read on wp.org ↗
3. ★★★★★ Arcelius

   3.2y ago

   Iv’e tried several plugins to stop spam but they still got through. This one actually works! This topic was modified 2 years, 11 months ago by Arcelius.

   Read on wp.org ↗
4. ★★★★★ alexander042

   3.3y ago

   Does exactly what it is supposed to do.

   Read on wp.org ↗
5. ★★★★★ darrenbb

   3.6y ago

   Since employing this plugin. The human spam has gone. Thank you. would a great idea to have option to block spam on convert kit or fluent form submit also and offer as premium.

   Read on wp.org ↗
6. ★★★★★ schmekis

   3.8y ago

   Been building sites with cf7 for 4 years, and recaptcha gets only part of the job done, honey pot gets only part of it done, and hcaptcha (for me) was a disaster because legit lead forms weren’t getting through. I was at a loss as to how to fill the gap. 95% of my spam still getting through was coming from digital marketers, and I wondered — why isn’t there a simple plugin that would filter out lead forms based on certain keywords? This plugin for some reason was hard to find, but fits the bill. I’m honestly surprised it doesn’t have at least a million users. If those using CF7 knew about it… it would. Honestly a no-brainer, one of those that is such common sense that you feel stupid you didn’t think of a lot earlier. Has lots of potential.

   Read on wp.org ↗
7. ★★★★★ salvatur77

   4.1y ago

   This plugin works exactly as I expected! The ability to block messages based on keywords, email domains and languages helps so much and currently blocks 99.9% of spam on my website. I made a request to the plugin developer to add a feature, and a couple of weeks later he replied to my message saying that the feature is now added. I’m impressed that this plugin is free. I really wish the developer could create a version that works with Gravity Forms as well 🙂

   Read on wp.org ↗
8. ★★★★★ ungern

   5.1y ago

   Lots of spam would get through via our contact forms despite simple “do the math” hurdle and Captcha too, and they all stick in this gem. Download, install, you won’t regret it. Super-de-luxe I must say!

   Read on wp.org ↗

All 9 disclosed vulnerabilities are patched in the current version (1.6.4.1). Sites still on an older version should update.

1. Patched High · 7.2 Message Filter for Contact Form 7 <= 1.6.3.9 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-27 CVE-2026-65438 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.3.9 Patched in 1.6.4.0
2. Patched Medium · 6.1 Message Filter for Contact Form 7 <= 1.6.3.8 - Reflected Cross-Site Scripting ↗
   2026-07-08 CVE-2026-57423 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.3.8 Patched in 1.6.3.9
3. Patched Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.3.2 Patched in 1.6.3.3
4. Patched Medium · 4.9 Message Filter for Contact Form 7 <= 1.6.3.2 - Authenticated (Administrator+) SQL Injection ↗
   2025-04-22 CVE-2025-46252 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.6.3.2 Patched in 1.6.33
5. Patched Medium · 4.3 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation ↗
   2024-12-06 CVE-2024-12026 Missing Authorization Affects <= 1.6.3 Patched in 1.6.3.1
6. Patched Medium · 4.3 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions ↗
   2024-12-05 CVE-2024-12027 Missing Authorization Affects <= 1.6.3 Patched in 1.6.3.1
7. Patched Medium · 4.3 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization ↗
   2024-12-05 CVE-2024-54254 Missing Authorization Affects <= 1.6.3 Patched in 1.6.3.1
8. Patched Medium · 6.1 Message Filter for Contact Form 7 <= 1.6.1.1 - Reflected Cross-Site Scripting ↗
   2024-08-01 CVE-2024-39647 Improper Neutralization of Input During Web Page Generation Affects <= 1.6.1.1 Patched in 1.6.2
9. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
   2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects <= 1.4.2 Patched in 1.4.3

Automated install-time checks, tested on PHP 8.1.12 · WP 6.8.2

Translated into 2 languages, 0 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-17 2K+ → 1K+ down after 2 days in tier
2. 2026-01-15 1K+ → 2K+ up after 13 days in tier
3. 2026-01-02 2K+ → 1K+ down after 1 days in tier
4. 2026-01-01 1K+ → 2K+ up after 1 days in tier
5. 2025-12-31 2K+ → 1K+ down after 777 days in tier
6. 2023-11-15 1K+ → 2K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Message Filter for Contact Form 7 into a readme, a review or a deck. It updates itself.

Message Filter for Contact Form 7: 1K+ active installs, 4.9★ (13 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/cf7-message-filter