How to Add a Contact Form to WordPress for Free (and Keep the Spam Out)

WordPress does not ship with a contact form: the block editor has no form block, and a plain HTML form has nothing on the server to receive it, so nearly every site uses a plugin. The two most-installed form plugins are free, and a basic name-email-message form is a fifteen-minute job. Plugin facts below come from each plugin’s WordPress.org listing and documentation as of October 14, 2026.

Which free plugin should you use?

Contact Form 7 is open source, shows more than 10 million active installations, and is configured by editing a short text template. WPForms Lite is the free version of a commercial plugin, shows more than 5 million active installations, and uses a drag-and-drop builder with templates.

If you want to set up a form by clicking, start with WPForms Lite. If you prefer a lean plugin with no upgrade prompts, use Contact Form 7, but check your hosting’s PHP version first: its current release lists PHP 8.3 as the minimum. Our guide to choosing a WordPress plugin safely explains how to read a listing.

Set up the form in five steps

1. Install and activate the plugin

   Go to Plugins → Add New Plugin, search by name, click Install Now, then Activate. Contact Form 7 adds a Contact menu; WPForms adds a WPForms menu.

2. Create a form with only the fields you need

   Name, email, and message are enough for most sites; every extra field is one more reason to abandon the form and one more piece of personal data you are responsible for. Contact Form 7’s default form has name, email, subject, and message; in WPForms, choose the Simple Contact Form template.

3. Set where the message goes

   In Contact Form 7, open the Mail tab; in WPForms, open Settings → Notifications. Send to an address you read every day, and set the From address to one on your own domain, such as forms@yourbusiness.com, not the visitor’s address or a free Gmail address.

4. Add the form to your Contact page

   Edit the page, add a block, search for Contact Form 7 or WPForms, and pick the form you created; both plugins also provide a shortcode. Put your address, hours, and phone number on the same page, because a form alone makes some visitors hesitate.

5. Send a test message from your phone

   Fill the form in as a visitor would, on another device if you can, and check the inbox and the spam folder. If nothing arrives within a few minutes, go to the next section before changing the form.

Make sure the email actually arrives

Missing form messages are rarely the form’s fault. WP Mail SMTP, the most widely installed fix for the problem with more than 4 million active installations, explains it this way: “By default, WordPress uses the PHP mail function” to send email, “most WordPress hosting companies don’t have their servers properly configured for sending PHP emails,” and “if the proper authentication isn’t there, emails either go in the SPAM folder or, worse, disappear.”

The fix is to route WordPress mail through a service that authenticates it. An SMTP plugin connects WordPress to a transactional email service such as Brevo, Mailgun, Postmark, SendGrid, or SMTP.com, to a Google Workspace mailbox, or to any other SMTP server; check each service’s current free limits. If you set up a newsletter, you may already have an authenticated sending domain to reuse.

Stop the spam before it starts

An unprotected form usually starts receiving automated junk within days of going live. Both plugins offer several defenses; you need one, possibly two.

• Cloudflare Turnstile is, in Contact Form 7’s words, “Cloudflare’s smart CAPTCHA alternative” and “is available for free.” You create a widget in a Cloudflare account, copy the site key and secret key into Contact → Integration (or WPForms’ Settings → CAPTCHA), and most visitors see only a small widget that verifies them automatically; a higher-risk visitor may be asked to check a box, never to solve a puzzle.
• Akismet checks submissions against the service that filters WordPress comments. It needs an Akismet API key; on Akismet’s pricing page, personal, non-commercial sites name their own price, including $0, and commercial sites pay for a plan.
• Google reCAPTCHA v3 works like Turnstile, scoring each visitor in the background. It loads Google’s script on your pages and shows the reCAPTCHA badge, which some site owners prefer to avoid.
• Built-in checks. WPForms Lite enables its own anti-spam protection by default. Contact Form 7 rejects messages containing keywords or IP addresses you add to WordPress’s Disallowed Comment Keys list.

Whichever you choose, say so in your privacy policy. Contact Form 7’s privacy notices point out that when reCAPTCHA, Akismet, or Turnstile is active, the submitter’s data, “including their IP address, may be sent to the service provider.” And since the inbox behind the form is now a target, our guide to securing your online accounts is worth a read.

Common mistakes

Conclusion

A working contact form is three jobs, not one: build it with a free plugin, make sure WordPress can deliver the email through an authenticated service, and add a background spam check before bots find it. Done in that order, it fits in an afternoon and keeps working for years.