Best WordPress Contact Form Plugins: Choosing One Without Spam or GDPR Trouble

The best WordPress contact form plugin for most small sites is a free one that blocks spam without a puzzle for your visitors and does not keep personal data longer than you need it. Contact Form 7, WPForms Lite, Fluent Forms, Ninja Forms and Forminator all do that on a free plan. The right pick depends on how you want to handle two things: spam and stored messages.

Most lists of contact form plugins rank features and prices. This one is built around the two problems that actually cause trouble after launch. First, spam: bots find a new form within days and fill your inbox. Second, privacy: a form collects names and email addresses, and in many places the law says what you must do with them. If you already want a feature comparison of the paid builders, see our WPForms vs Gravity Forms vs Formidable comparison. If you would rather not install anything, read how to create a contact form on WordPress without downloading another plugin.

Every plugin fact below, such as version, installs and last update, comes from the WordPress.org plugin directory and was checked on 11 November 2026. Prices come from each vendor’s own pricing page (WPForms, Gravity Forms, Fluent Forms) on the same day. I did not install or test any of these plugins for this article, so where a claim comes from a plugin’s own description, the text says so. Nothing here is legal advice.

What a WordPress contact form plugin has to do

A contact form takes a message from a visitor and sends it to you. That sounds simple, and the free plugins do it well. A good one also does four other jobs:

• It delivers the email reliably, or saves the message so you can still find it if email fails.
• It stops spam before the message reaches you.
• It handles personal data in a way you can explain to a visitor.
• It stays updated, because a form plugin runs on a public page and takes input from strangers.

The last point is easy to miss. A form is one of the few parts of your site that anyone on the internet can send data to. A plugin that has not been updated for a year is a bigger risk than one that has a plainer design.

Quick picks: which plugin for which job

The sections below give the facts behind each pick.

The plugins side by side

This table shows what the WordPress.org directory said on 11 November 2026. “Active installs” is rounded by WordPress.org, so a figure like 5 million means “5 million or more”.

All six list WordPress 7.1.4 as the latest version they were tested with, and each was updated within the last month. That is a good sign. Check the “last updated” date on any plugin before you install it, because a plugin that was last touched years ago may not work with current WordPress.

Two notes on reading the table. The rating is the WordPress.org score out of 100, so 96 equals 4.8 stars out of 5. And install counts say how popular a plugin is, not how good it is, so use them as one signal and not the whole story.

Also note the PHP column. Contact Form 7 lists PHP 8.3 as its minimum, and its directory page lists WordPress 7.1 as the minimum version. If your host still runs an older PHP, that matters. WordPress.org’s own host requirements, at the time of writing, ask for PHP 8.3 or newer, so a host on an older version is worth a conversation anyway.

Stopping spam: four layers, from invisible to annoying

Spam on a contact form comes from bots, which are programs that find forms and fill them in. You can stop most of it without making real visitors solve puzzles. Think of it as layers, from the ones people never see to the ones they do.

Layer 1: the honeypot

A honeypot is a hidden field that people cannot see but bots fill in. If the field has anything in it, the plugin throws the message away. Real visitors are never bothered. Ninja Forms and Formidable Forms both list honeypot protection in their directory descriptions.

Layer 2: a spam filter service

Akismet is a service from Automattic that checks messages against known spam. It does the checking on its own servers, so it needs an Akismet key. Ninja Forms and Formidable Forms list Akismet support, and Gravity Forms lists an Akismet add-on in its Basic add-ons. If you already use Akismet for comments, our guide on stopping comment spam without Akismet covers the alternatives, and the same thinking applies to forms.

Layer 3: a CAPTCHA or Turnstile check

A CAPTCHA checks whether a visitor is a person. Google reCAPTCHA, hCaptcha and Cloudflare Turnstile are the three names you will see. The directory descriptions for WPForms Lite, Fluent Forms, Ninja Forms, Forminator and Formidable Forms all mention at least one of them, and Gravity Forms lists reCAPTCHA and Cloudflare Turnstile among its add-ons.

These checks can slow a real visitor, so pick the lightest one. Turnstile and the invisible versions of reCAPTCHA usually do not ask a person to click anything. Whichever you pick, test your own form from a phone after you set it up.

One privacy point belongs here. A CAPTCHA service loads code from another company on your page and sees some data about your visitor. In places with strict privacy rules, that third party may need to be named in your privacy policy, and in some cases your cookie banner. Our guide to GDPR, cookie consent and privacy plugins covers that side.

Layer 4: block lists and limits

You can also block certain email addresses, domains or country-style endings. Forminator’s listing says you can allow or block specific email addresses, domains or top-level domains. This is a blunt tool, so use it only to stop a spammer who keeps returning.

A sensible starting setup

Turn on a honeypot if the plugin has one. Add Turnstile or invisible reCAPTCHA. Add Akismet if the plugin supports it and you already have a key. Do not add a block list until you see a pattern. Then send three test messages, one from your phone, one from a different email provider, and one with a link in it, to confirm your own messages still arrive.

Privacy and GDPR: what a contact form puts on you

A contact form collects personal data, usually a name and an email address and often a phone number. If your visitors are in the European Union or the United Kingdom, the GDPR rules apply to you even if your business is somewhere else. Other regions have their own laws. I am not a lawyer, and this section is a list of questions to answer, not legal advice.

Question 1: where do the messages end up?

Every message exists in at least two places: your email inbox and, possibly, your WordPress database. Plugins differ here, and the difference matters.

Contact Form 7 does not store messages by default. The directory listing for Flamingo, a companion plugin, says it is “a message storage plugin originally created for Contact Form 7, which doesn’t store submitted messages”. Flamingo was at version 2.6.4 with 800,000 or more active installs on 11 November 2026, and was last updated on 18 August 2026. If you install it, you now store personal data in your database, and Flamingo’s own listing says so in its privacy notice.

That is not a bad thing. It means you have to decide how long to keep the data. A plugin that stores nothing is simpler to explain. A plugin that stores everything gives you a record in case an email goes missing.

Ninja Forms says in its listing that every submission is stored in your own WordPress database. Formidable Forms says every registration form and contact form submission is stored in your WordPress database. So with those two, you have a stored list of people to look after from day one.

Question 2: can you delete entries, and can you do it automatically?

Under GDPR you should not keep personal data longer than you need it. If a plugin stores entries, look for a way to delete them on a schedule. WPForms Lite’s listing mentions Entry Automation, described as a way to export and delete form entries on a daily, weekly or monthly basis. The Fluent Forms listing includes “auto-delete entries” in a feature list that mixes free and paid items, so check which tier you need. Formidable Forms says its plugin includes GDPR controls for IP tracking, saved submissions and consent fields.

Whichever plugin you use, write down a rule such as “we delete contact messages after twelve months” and make sure the plugin can do it. WordPress itself also has built-in tools under Tools for exporting and erasing personal data when someone asks, and form plugins that save entries should work with them. Test that with a sample entry before you rely on it.

Question 3: do you need a consent checkbox?

For a plain “send us a message” form, many sites add a short line under the button that links to the privacy policy. Some sites add a checkbox that the visitor must tick. Which one you need depends on your law and your lawyer’s advice, so ask. Forminator’s listing mentions GDPR-friendly opt-ins as a field type, and Formidable Forms mentions consent fields. WPForms Lite describes itself as “GDPR friendly” in its listing, which is the vendor’s claim and not a legal guarantee. No plugin can make your site compliant on its own. It can only give you the tools.

Question 4: does your privacy policy say what the form does?

Your policy should say what you collect through the form, why, how long you keep it, who can see it and which outside services touch it, such as an email provider, a spam filter and a CAPTCHA. A plugin that sends data to other services, such as an Akismet key, a mailing list tool or a payment gateway, adds lines to that policy.

Question 5: what about IP addresses?

Some plugins save the visitor’s IP address with each entry. In the EU an IP address can count as personal data. Formidable Forms says it has controls for IP tracking. If you do not need the IP address, turn the saving off.

Plugin by plugin: what the facts say

Contact Form 7

Contact Form 7 is the oldest and most installed of the group, at 10 million or more active installs, and it was updated the day before I checked. It is free, and its directory page describes it as a practical tool for people who follow the free and open source philosophy. It is plain: you write the form in a text box using tags, you do not drag and drop. It does not store messages without Flamingo. Its WordPress.org rating is 80 out of 100, lower than the others in the table. I did not test the plugin, so I cannot say why.

Best for: people who are comfortable editing a small bit of text and want a form that stores nothing by default.

WPForms Lite

WPForms Lite is the free version of a paid plugin. Its listing says spam protection is built in and mentions hCaptcha, Google reCAPTCHA and Cloudflare Turnstile. It has a drag and drop builder and templates. The paid plans on wpforms.com were listed on 11 November 2026 at these introductory prices per year: Basic $49.50 (normally $99), Plus $99.50 (normally $199), Pro $199.50 (normally $399) and Elite $299.50 (normally $599). The page calls them special introductory pricing and says they can be changed. Check what the plan costs on renewal before you buy. WPForms offers a 14-day money-back guarantee on its pricing page. Basic covers 1 site and Plus covers 3 sites.

Best for: a first site that wants a visual builder and an easy upgrade path.

Fluent Forms

The Fluent Forms listing mentions spam protection with reCAPTCHA, hCaptcha and more, and entry export in several formats. On fluentforms.com on 11 November 2026, the paid plans were $63 a year for one site (listed as $79 before a first-year discount of up to 20%), $127 for 5 sites and $239 for unlimited sites, with lifetime plans from $279 for one site. The page says all features are included in every plan. Because the directory feature list mixes free and paid items, check the comparison on the vendor page for each feature you need.

Best for: people who want a builder with many features and like the choice of a one-off lifetime price.

Ninja Forms

Ninja Forms’ listing says every submission is stored in your own WordPress database, with no limit on forms or submissions. It lists honeypot, reCAPTCHA, hCaptcha, Turnstile and Akismet spam protection as built in. It is a clear match for the spam question. Its rating is 88 out of 100, and its minimum WordPress version is 6.9, so older sites should check. I did not test its spam tools, and the directory text is the vendor’s description.

Best for: sites that want spam tools in the free plugin and are happy to have submissions in the database.

Forminator

Forminator’s listing says Google reCAPTCHA is free, and that its antispam tools include reCAPTCHA, hCaptcha and Cloudflare Turnstile. It also describes allow and block lists for email addresses, domains and top-level domains, and GDPR-friendly opt-ins as a field. It is a good fit if you expect to need to block repeat spammers.

Best for: sites that want a block list option in the free plugin.

Formidable Forms

Formidable Forms reads more like a data tool than a simple contact form, with views, surveys and calculators on its list. Its listing mentions invisible spam protection with honeypot, Akismet, reCAPTCHA, hCaptcha and Cloudflare Turnstile, and says every submission is stored in your WordPress database and can be exported to CSV. It also lists GDPR controls for IP tracking, saved submissions and consent fields. It is the least basic of the group, so it may be more than a simple contact page needs.

Best for: sites where the form is part of something bigger, such as a directory or a survey.

Gravity Forms

Gravity Forms has no free version. Its pricing page on 11 November 2026 listed three licenses: Basic at $59, Pro at $159 and Elite at $259, with support levels that differ by plan, and it says there is no trial version. The Basic plan’s add-on list includes Akismet, Cloudflare Turnstile and reCAPTCHA. It is more than a site with one contact page needs. It also says that a site hosted on WordPress.com needs the Business plan before it can install Gravity Forms.

Best for: a business that wants a paid plugin with support and many add-ons, and does not need a free tier.

Free or paid: when to pay for a WordPress contact form plugin

For a plain contact form, free is enough. The five free plugins above all handle a name, an email, a message and spam protection. Pay when you need one of these:

• Payments on the form.
• Connections to a CRM or email marketing tool.
• Multi-step forms or conditional logic with many branches.
• Priority support for a business site that cannot lose leads.
• File uploads from visitors, which need extra care for security.

Beware of one trap. A free plugin may let you build the form for free and charge for the part that makes it useful, such as viewing entries. Read the plan details before you build forty forms. Ninja Forms says in its listing that submission management ships in the core plugin. The other listings differ, so check each one.

Ten-minute setup that avoids the common problems

1. Choose the plugin with the quick-picks table. Check its last-updated date.
2. Build the shortest form you can. A name, an email and a message is enough. Every extra field is more data to look after.
3. Turn on spam protection in layers: honeypot first, then Turnstile or invisible reCAPTCHA.
4. Set where messages go. Use an email address you check, and send a test.
5. Fix email delivery. Many hosts send WordPress email poorly. If test messages land in spam or never arrive, use an SMTP plugin or your host’s mail settings, and do not blame the form plugin first.
6. Decide about storing. If the plugin stores entries, set a deletion rule. If it does not, keep your inbox tidy.
7. Add a line under the button that links to your privacy policy, and add a consent checkbox if your advisor says you need one.
8. Update your privacy policy to mention the form and every outside service it uses.
9. Test on a phone. Submit the form, check the confirmation message and check that you got the email.
10. Put a reminder in your calendar to check the plugin for updates every month.

Common mistakes

• Using the plugin’s name as a quality signal. A famous plugin can still be set up badly.
• Turning on every spam tool at once. You may block real people. Add layers one at a time and test.
• Storing entries forever. A list of old messages is a list of people’s data that you must protect.
• Forgetting email delivery. A form that looks fine but sends mail that never arrives is worse than no form.
• Leaving unused form plugins installed. Delete the ones you do not use.

Questions people ask

What is the best free WordPress contact form plugin?

There is no single best one. Contact Form 7 is the most installed at 10 million or more. WPForms Lite has the most ratings, with 14,393 at a score of 96 out of 100. For spam tools in the free plugin, Ninja Forms and Forminator list the most. Pick on spam handling and how your data is stored, not on name.

Do I need a plugin at all?

Not always. A simple form can be built with tools you already have, and a plain email link works for some sites. Our guide to a contact form without another plugin shows the options. For a step-by-step on the free route, see how to set up a contact form in WordPress without paying.

How do I stop contact form spam?

Use layers. A honeypot costs visitors nothing, a Turnstile or invisible reCAPTCHA check catches more, and Akismet adds a filter on top. Add them one at a time and test each.

Is a contact form plugin GDPR compliant?

A plugin cannot make your site compliant by itself. Some vendors call their plugin GDPR friendly, which is their claim. What counts is what you do: collect little, say what you do with it, delete it on a schedule and name every service involved. Ask a qualified person if you are unsure.

Does Contact Form 7 store messages?

Not by default. The Flamingo plugin listing says Contact Form 7 does not store submitted messages and that Flamingo adds message storage. If you add Flamingo you are storing personal data.

Why do my form emails go to spam?

Usually because the site sends mail from the web server in a way that mail providers distrust. The form plugin is rarely the cause. Use an SMTP plugin or your host’s mail tools, and test again.

How often should I update a form plugin?

As soon as an update appears, after a backup. Form plugins take input from the public, so they are worth keeping current.

What to do next

Pick one plugin from the quick-picks table, build a three-field form, switch on a honeypot and a Turnstile or reCAPTCHA check, and send yourself three test messages. Then write one sentence for your privacy policy about what the form collects and how long you keep it. That covers most of what goes wrong with contact forms. If you later need payments or a CRM link, move up to a paid plan then, not before.

Sources and dates. Plugin versions, installs, ratings, update dates and quoted descriptions: WordPress.org plugin directory listings, checked 11 November 2026. Prices: wpforms.com/pricing, gravityforms.com/pricing and fluentforms.com/pricing, checked 11 November 2026, in US dollars. Not confirmed: I could not read the Contact Form 7 documentation site, so statements about its spam and storage behavior come only from the WordPress.org listings. Prices and features change, so check the vendor’s page before you buy.