Contact Form 7
Updated September 13, 2026
Contact Form 7 can be protected in two ways: switch it on for every form at once, or place a form-tag in the individual forms you want covered. Both are configured from the Contact Form 7 panel on Settings › Cloudflare Turnstile.
Every form at once
Tick Enable on all CF7 Forms and save. The widget is added above the submit button on every Contact Form 7 form on the site, and no form editing is needed.
Individual forms
Leave that option off and add the form-tag to the forms you want, in the Contact Form 7 form editor:
[cf7_simple_turnstile]Put it wherever you want the widget to appear, usually just above the submit button. There is also a button in the form editor’s tag generator that inserts it for you.
The older shortcode [cf7-simple-turnstile] still works and does not need changing if you already have it in place.
Why it has to go in the form template
The tag must sit in the Contact Form 7 form template so that Contact Form 7 itself substitutes it during its own render. Running do_shortcode() over an already-assembled CF7 form will break form-tag handling, so avoid any approach that does that — including some page builders’ custom form rendering.
Error messages
A failed check produces the message from Custom Error Message, shown where Contact Form 7 normally puts validation errors. See Customise the error messages.
Logged-in visitors and the whitelist
When a visitor is whitelisted, the tag renders nothing at all and Contact Form 7’s own markup is left untouched. That is deliberate, but it does mean that testing while logged in with Logged In Users whitelisting enabled will look as though the integration is not working. Test in a private window.
Contact Form 7 submits through the REST API, which can drop the current user when no nonce header is sent. The plugin verifies the login cookie directly in that situation so logged-in whitelisting still behaves as expected on CF7 forms.
A note on older versions
A security issue in this integration was fixed in version 1.42.3, where a submitted field value could be executed as a shortcode. If you are running anything older, update.