Per-form settings for Contact Form 7

Every form inherits the global settings. To change one form, open Contact → Contact Forms, edit the form and open the Formsieve tab of the form editor. An empty value, or Global setting, means the form follows Formsieve's global settings. Formsieve → Contact Form 7 → Settings → Forms lists every form with a link to this tab. Formsieve adds no menu under Contact Form 7's Contact menu; its card on Contact → Integration links to Formsieve's own settings.

Formsieve for CF7 screens forms only once an API key is saved or Test mode is on. Until then the tab shows a reminder, and forms get no hidden fields and no checks.

Settings

The settings in the order they appear in the tab:

Additional Settings

For forms managed in code, or to override the Formsieve tab, add these lines in the form's Additional Settings tab, one per line. They win over the Formsieve tab:

formsieve: off
formsieve_threshold: 0.9
formsieve_review_threshold: 0.6
formsieve_preset: high

• formsieve: off (or on) switches Formsieve off (or on) for the form.
• formsieve_threshold is the block (Spam from) threshold and formsieve_review_threshold the review (Possible spam from) threshold: a fraction from 0 to 1 (0.9) or a percentage from 1 to 100 (90 or 90%). 1 means 100%, so formsieve_threshold: 1 never blocks. A value that is not a threshold (250, -3, sixty) is ignored, so the tab's value or the global setting applies, and the Formsieve tab names it.
• formsieve_preset is low, medium or high.

Formsieve also leaves alone forms with Contact Form 7's demo_mode: on (no mail is sent for them).

Form-tag options

• formsieve:ignore in a form-tag keeps that field out of the check, for example [text your-reference formsieve:ignore]. formsieve:exclude, formsieve:skip and formsieve:off do the same.
• formsieve:<role> sets the role a field is sent as, for example [textarea your-question formsieve:message]. Roles: name, email, subject, message, phone, url, company, address, text, choice, number, date and other. Without it, Formsieve guesses the role from Akismet's akismet: options, the autocomplete: option, the field type and the field name.

What happens to a blocked submission

Formsieve uses Contact Form 7's native spam status:

• No mail is sent.
• The visitor sees the form's spam message from the Messages tab ("Submission was referred to as spam"), whose default text is "There was an error trying to send your message. Please try again later.", the same text Contact Form 7 shows when mail fails. The Messages tab also has a "Submission was blocked as spam by Formsieve" message: once you change its text, visitors blocked by Formsieve see that text instead, while spam caught by other tools (Akismet, reCAPTCHA, Turnstile, the Disallowed Comment Keys) keeps the form's spam message. Contact Form 7's response to the browser still carries the status spam, as it does for every spam filter, so a script can tell a spam refusal from a mail failure; the probability is never sent.
• Contact Form 7's spam log records Formsieve's reason.
• With Flamingo installed, the message is stored under Flamingo → Inbound Messages → Spam with "Spam log: …" and Formsieve's details (verdict, probability, category, model, route, request ID). You can read it and click Not spam to restore it.

We recommend Flamingo. Contact Form 7 stores nothing by itself: without Flamingo a blocked submission is not kept anywhere, and Formsieve's log holds only numbers, never the message. Forms that use Contact Form 7's do_not_store setting are not stored by Flamingo either. When a form uses do_not_store, or the visitor does not tick a consent_for:storage box, Formsieve's log keeps the verdict but no IP or e-mail hash.

When the check cannot run (a cap, the circuit breaker, missing credit or an API error) and When the API cannot answer is set to Fail closed, the submission gets the spam status with "Formsieve: not checked (reason)" in the spam log. With the default fail open, the mail is sent unchanged and the same note is kept in Flamingo and the Formsieve log.

Review band

Review-band submissions are delivered normally. The subject of each mail that is not addressed to the visitor gets the prefix "[Possible spam 62%]" (the number is the probability); a mail whose To, Cc or Bcc holds an e-mail address the visitor typed, such as an autoresponder in Mail (2), is never tagged. The site's own administration e-mail address (Settings → General) never counts as the visitor's, because spam often gives it as the sender, so mail to it keeps the tag. Flamingo stores the details. Set Possible spam to Treat as spam to treat them as spam instead.

Hidden fields

Formsieve adds two fields to each form it screens: a honeypot (_fsv_hp, hidden from people by a small stylesheet) and a signed time-to-submit token (_fsv_t). Contact Form 7 never passes fields whose names start with an underscore to mail, mail-tags or Flamingo, so they do not appear anywhere in your messages.

Working with other spam tools

Formsieve runs on wpcf7_spam at priority 20, after Contact Form 7's reCAPTCHA and Turnstile (priority 9) and its Akismet and Disallowed Comment Keys checks (priority 10). When one of them has already marked the submission as spam, Formsieve makes no API call. Keeping reCAPTCHA or Turnstile is optional: Formsieve judges the message, those tools judge the visitor.

Restoring and correcting

In Flamingo, move a message between Inbox and Spam as usual. Formsieve records each correction, labels its log row and learns the sender for next time (Feedback loop). This works for messages that still have a Formsieve log row; moving an older message (past the log retention period, or stored before Formsieve was set up) teaches Formsieve nothing. Contact Form 7 does not re-send mail for a restored message; reply from Flamingo or from your mail client. Without Flamingo, use Mark spam / Mark not spam in Formsieve → Log.