Contact Form 7 Alternative: Nisuform vs Contact Form 7

Contact Form 7 has more than 10 million active installs on WordPress.org. It builds the form and validates it, then hands the message to WordPress to send. Delivery, storage and most spam filtering are your host's job or another plugin's.

Nisuform replaces the whole chain. The form posts to an endpoint, and Nisuform filters spam, stores the submission and sends the notification from its own mail service.

At a glance#

Where Contact Form 7 is ahead#

• Free with no cap. No monthly limit on messages and no account anywhere.
• Inside your admin. Forms, mail templates and messages live in WordPress next to the rest of your site.
• A huge add-on catalog. Conditional fields, multi-step forms, redirects and database storage all exist as add-ons, many of them free, and Stripe payments are built in.
• Your data stays on your server. With Flamingo, messages sit in your own database.

Where Nisuform is ahead#

• Email that arrives. Notifications come from an authenticated mail service, so there's no SMTP plugin, mail provider account or DNS setup to get right.
• Every submission is saved. Nisuform stores each submission before any email goes out.
• Spam filtering without a CAPTCHA. The honeypot and fill-time check stop automated posts without asking visitors to do anything, and Turnstile or reCAPTCHA is there if you need more.
• Lighter pages. The form is a few kilobytes of HTML on the page that has it. Contact Form 7 enqueues its scripts and styles site-wide unless you turn that off in wp-config.php, and when reCAPTCHA is connected, Google's script loads on every page too.
• One form for every site. The same endpoint works on WordPress, Webflow, a static site or a React app, so moving off WordPress doesn't mean rebuilding your forms.

Why Contact Form 7 stops sending email#

Contact Form 7 calls wp_mail(), and unless an SMTP plugin replaces it, WordPress sends through your host's PHP mail(). Shared hosts often throttle or block it. When the mail does go out, it claims to come from your domain but leaves from a server your SPF and DKIM records don't cover, so Gmail and Outlook file it as spam or reject it.

Visitors then see "There was an error trying to send your message. Please try again later." Or the form says thank you and the email never arrives. Without Flamingo, no copy of the message exists. Contact Form 7's own configuration check also warns when the From address in the Mail tab isn't on your site's domain, which is the first thing to fix.

The usual fix is an SMTP plugin connected to a provider like SendGrid or Mailgun. The WordPress page compares that route with taking WordPress out of the email path entirely.

Spam: honeypot, CAPTCHA and Turnstile#

Contact Form 7 has no honeypot of its own. Its built-in options are integrations with reCAPTCHA v3, Cloudflare Turnstile and Akismet, plus a disallowed list of words and IP addresses and a quiz field. reCAPTCHA v3 scores visitors in the background and needs Google keys. Turnstile needs Cloudflare keys. The image CAPTCHA tags only work once you install a second plugin, Really Simple CAPTCHA. The popular honeypot is another add-on, CF7 Apps, with more than 300,000 installs.

Nisuform runs a honeypot, a fill-time check, rate limits, and link and duplicate checks on every form with nothing to configure. Spam goes to its own folder, doesn't notify you and doesn't count toward your monthly limit. If spam still gets through, turn on Turnstile or reCAPTCHA with your own keys. Contact Form 7's reCAPTCHA integration uses v3 keys, and those work with Nisuform when your own code asks for the token. The styled embed uses the v2 checkbox, which needs a checkbox key.

Security updates#

Contact Form 7 6.2.4 shipped on October 29, 2026 with security fixes, and 6.2.4.1 followed the same day. If you run Contact Form 7, update it first, then check your Contact Form 7 add-ons for updates too. Plugins that extend file uploads have had their own vulnerabilities, and the core plugin had an unrestricted file upload flaw in 2020 (CVE-2020-35489), fixed in 5.3.2.

Uploads are where a form plugin is most exposed, because a stranger's file is written to your server. Contact Form 7 saves each upload to a temporary wpcf7_uploads folder, attaches it to the email and deletes it shortly after. With Nisuform, uploaded files go straight to private storage on Nisuform and never touch your WordPress install. You download them through signed links that expire after 15 minutes.

Contact Form 7 pricing#

Contact Form 7 itself costs nothing. Matching Nisuform's default setup usually means adding:

• An SMTP plugin and a mail provider, for email that reaches the inbox.
• Flamingo, free, to store messages.
• A honeypot add-on, free.
• More add-ons for redirects, webhooks or Slack, free or paid.

Nisuform Free is 100 submissions a month across 3 forms, with no credit card. Pro is $10 a month for 5,000 submissions, unlimited forms, file uploads, auto-replies, redirects and webhooks. See pricing.

Switching from Contact Form 7#

1. Create a form#

   Sign in at app.nisuform.com, create a form and copy its endpoint from the Setup tab.

2. Rewrite the form tags as HTML#

   Each Contact Form 7 tag becomes a normal input with the same name. An asterisk in the tag means required.

   <label> Your name [text* your-name autocomplete:name] </label>
   <label> Your email [email* your-email autocomplete:email] </label>
   <label> Your message [textarea your-message] </label>
   [submit "Submit"]

   <form action="https://api.nisuform.com/s/YOUR_FORM_KEY" method="POST">
     <label for="your-name">Your name</label>
     <input id="your-name" type="text" name="your-name" autocomplete="name" required>
     <label for="your-email">Your email</label>
     <input id="your-email" type="email" name="your-email" autocomplete="email" required>
     <label for="your-message">Your message</label>
     <textarea id="your-message" name="your-message" rows="5"></textarea>
     <input type="text" name="_gotcha" tabindex="-1" autocomplete="off" style="display:none">
     <button type="submit">Submit</button>
   </form>

   Or build the form in the Nisuform dashboard and paste its styled embed code instead.

3. Replace the shortcode#

   Edit the page, swap the [contact-form-7 id="..."] shortcode for a Custom HTML block and paste the form. Set the email subject in the form's Settings, Email, and leave out the reCAPTCHA tag. Nisuform filters spam on its own, and you can add Turnstile or reCAPTCHA in the form's Spam protection settings.

4. Send a test, then deactivate#

   Submit the form from the live page and check your Nisuform inbox and your email. Once no page uses a Contact Form 7 shortcode, deactivate it. Keep Flamingo if you want the old messages.

Sources#

• Contact Form 7 on WordPress.org and its source code at 6.2.4.1, checked October 30, 2026
• Contact Form 7 6.2.4 release
• CF7 Apps on WordPress.org
• CVE-2020-35489
• Nisuform pricing and limits