Combine a bot filter with a content filter. The bot filter (a honeypot field, Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA) blocks automated submissions before they hit the database. The content filter (Akismet, Antispam Bee, or a similar service) inspects the payload of any submission that gets through and marks obvious spam. Neither layer alone stops enough; both together stop most of it.
The best time to set this up is before the form goes live. An unprotected form receives its first spam submission within days of going public, and cleaning up an inbox that has been receiving Viagra spam for a month is worse than adding a five-minute honeypot check on day zero.
The standard stack
Every mainstream contact form plugin supports at least three of these:
- Honeypot field. A hidden field that humans do not fill out but naive spam bots do. Any submission with a value in the honeypot field is silently rejected. This is the cheapest possible layer: no external service, no user friction, no accessibility problems. Contact Form 7 has honeypot support via the free CF7 Honeypot add-on. WPForms, Fluent Forms, Formidable, and Gravity Forms all include it natively.
- CAPTCHA challenge. A visible or invisible challenge that a bot cannot easily solve. Cloudflare Turnstile is the best current default: free, no user friction on the invisible mode, privacy-friendlier than reCAPTCHA. hCaptcha is a good alternative. Google reCAPTCHA v2 (the checkbox) and v3 (invisible scoring) are the most-deployed but carry privacy tradeoffs for European sites subject to GDPR.
- Akismet. WordPress’s official content-filter service, run by Automattic. Free for personal sites (with a nag screen), from around $10/month for commercial. Every submission is sent to Akismet’s API and scored; spam submissions are marked and stored separately from the notification stream. Contact Form 7 has native Akismet support via the
akismet:authorfield tags. Most other form plugins have an Akismet integration in their premium tiers. - Antispam Bee. Free alternative to Akismet, open-source, developed by German developers pluginkollektiv. Works as a comment-spam filter primarily but can be paired with form plugins that expose their submissions through the same filter hooks.
Pick one from each of the first two categories, plus a content filter. That is the standard stack. Adding all four does not meaningfully help; each layer has diminishing returns.
Which combination is right
The right choice depends mostly on the site’s audience and traffic:
- A low-traffic personal or hobby site. Honeypot plus Akismet (personal-use free tier). Nothing else. The honeypot handles the naive volume; Akismet catches the rare submission that gets through.
- A small business site with regular submissions. Honeypot plus Cloudflare Turnstile (invisible mode) plus Akismet. Turnstile handles more sophisticated bots without adding friction; Akismet catches the tail.
- A high-traffic site or one being deliberately targeted. Cloudflare Turnstile in the interactive mode (or hCaptcha), plus Akismet, plus a rate limit at the edge (Cloudflare’s WAF handles this). Honeypot is still worth having but no longer load-bearing.
- An EU-focused site with GDPR concerns. Skip Google reCAPTCHA. Use Cloudflare Turnstile or hCaptcha. Antispam Bee over Akismet if you prefer to keep submissions inside the EU entirely.
Setting each layer up
Honeypot. For Contact Form 7, install the 
CF7 Honeypot add-on and add [honeypot honeypot-name] to your form template. For WPForms, Fluent Forms, Gravity Forms, and Formidable Forms, toggle “Honeypot” or “Anti-spam” in the form’s settings; the plugin handles the hidden-field mechanics.
Cloudflare Turnstile. Register the site at 
cloudflare.com, get the site key and secret key. Install a bridge plugin that hooks Turnstile into your form (Simple Cloudflare Turnstile for CF7, WPForms’ built-in Turnstile in the paid tier, and so on). Paste the keys, save.
Akismet. Install the Akismet plugin from the WordPress plugin directory. Generate an API key at akismet.com. Enter it in the plugin settings. Enable Akismet in the contact form plugin’s settings (in CF7, add akismet:author_email to the email field tag).
Antispam Bee. Install from the plugin directory, enable, no configuration needed for basic use. Advanced options in Settings > Antispam Bee.
Related content-form protections worth considering
Two additional levers that are situational but sometimes decisive:
- Geographic filtering. If your business only serves customers in one region and the spam is coming from elsewhere, blocking submissions from other countries can reduce spam volume by 90% at no cost to legitimate users. See Block certain countries from Contact Form 7.
- Rate limiting. If a single IP is submitting your form dozens of times a minute, no content filter will keep up. Cloudflare’s WAF rules or a WordPress plugin like Wordfence can rate-limit submissions before they hit the form plugin.
The mail side of the form still matters. Even a well-protected form will drop notification emails if wp_mail() is not configured properly. See What is the best way to set up email on WordPress? for the sending side.