Is Contact Form 7 Safe? The Most-Installed Plugin on Earth
Contact Form 7 is free, everywhere, and probed by every bot on the internet. What being the most-installed form plugin really means for your site.
Contact Form 7 might be the most-installed plugin in WordPress history. It’s free, it’s been around forever, and it does one simple job. There’s a good chance it’s on your site right now — possibly from a developer you haven’t talked to in years.
Being everywhere has a price, and you’re the one paying it.
The most famous fields on the internet
Every spam script ever written knows Contact Form 7’s field names on sight. That’s why your inbox fills with “SEO services” messages and gibberish — bots aren’t finding your form by accident, they’re recognizing an old friend. So you add an anti-spam plugin. Then a CAPTCHA. Now three pieces of software guard one form, each one another thing to update, each adding weight to a site that’s already slow.
The security half of the story
Contact Form 7 has had security holes over its long life — including ones serious enough to make news, since a hole in the most-installed plugin is a hole in millions of sites at once. Its maintainers patch. The question, as always, is the gap: bots move within hours of a hole being published, and your site is only safe if you consistently move faster. On a plugin installed by a long-gone developer, “consistently faster” usually isn’t happening.
What Shmove does instead
When we convert your site, your contact form keeps working — same fields, same button, messages still arrive in your inbox. But the plugin is gone. The form is plain markup on a static page; submissions are received and filtered by our infrastructure, not by software running on your site.
No recognizable plugin for spam scripts to fingerprint. No version number for bots to check. No anti-spam plugin stacked on a CAPTCHA stacked on a form plugin. And no update you’ll ever be responsible for.
The form your customers use stays. Everything the bots use goes.
Quick answers
Why does my Contact Form 7 get so much spam?
Because bots recognize it instantly. It's the most-installed form plugin in the world, so every spam script ever written knows exactly how to find and fill its fields.
Has Contact Form 7 had security problems?
Like every long-lived plugin, it has had holes over the years — including serious ones — that were patched. Sites that updated quickly were fine. Sites that didn't were found by bots within hours.
It's free — what does it actually cost me?
Spam handling, an anti-spam plugin or two to go with it, script weight on every page, and the update treadmill. Free software still bills you in time.
How does a form work without a form plugin?
The form on a Shmove site is plain, safe markup. Submissions go to our servers, get filtered, and land in your inbox. Nothing runs on your site, so there's nothing to exploit or spam-probe.
Sixty seconds. Zero jargon.
See what's actually wrong with your site — speed, plugins, and every way in.
Check my site free