Simple Contact Form

Creating an accessible contact form for your website should be easy - without the risk of receiving spam all day long!

Simple Contact Form is an easy-to-use WordPress plugin with accessible forms, configurable email notifications and several efficient methods for preventing spam. The plugin deliberately does not include a complex form builder. On this page you will find more information about:

  • Installing the plugin
  • Creating and embedding contact forms
  • Configuring autoresponders
  • Collecting submissions
  • Plugin settings
  • Spam protection
  • Spam logs
  • Developer hooks

Do you need support for this plugin? Please post your question in the plugin support forum at WordPress.org.

Quick & Easy Installation

The plugin can be installed like any other plugin from the WordPress plugin directory.

  1. Go to Plugins > Add New Plugin in your WordPress dashboard.
  2. Search for Simple Contact Form – Accessible & Anti-Spam, click Install Now, and activate the plugin.
  3. Go to Contact form > Add New Form and click Publish. The default email addresses and settings are already filled in, but you can change them if needed.
  4. Open the page where you want to add the contact form and insert the Simple Contact Form block.
  5. Select your contact form and publish or update the page.

That’s it. Your contact form is ready to receive messages.

For users still using the old shortcode version

If you have used the plugin for a longer time, you may still have forms whose options are defined using shortcode attributes. Existing shortcodes continue to work, but new forms should be created through the form interface in the WordPress dashboard. This keeps the configuration readable and makes forms easier to maintain.

Create a new contact form

After activating the plugin, navigate to Contact form and click Add New Form. Enter a descriptive title for the form. This title is only used in the WordPress dashboard.

Contact form post options

Contact form post options

Form options

  • Email address (From): The email address used as the sender of notification and responder emails.
  • Add Reply-to header: Add the visitor’s submitted email address as the Reply-To address.
  • Email address (To): One or more email addresses that should receive notifications.
  • Email subject(s): Enter one or more subjects. When multiple subjects are entered, visitors can select a subject in the form.
  • Custom mail headers: Add additional headers when these are required by your email configuration.

Form fields

The name, email address and message fields are always included and required. The following fields can be hidden, optional or required:

  • Company name
  • Phone number
  • Website
  • Terms checkbox

The terms checkbox can be used for accepting terms and conditions, acknowledging a privacy statement or another form-specific confirmation. The following settings belong to the terms checkbox:

  • Label/text: The text displayed next to the checkbox.
  • Required error message: The message shown when a required checkbox has not been selected.

Additional settings

  • Thank-you page URL: Redirect visitors after a successful submission.
  • Thank-you message: Display a custom confirmation after the form has been submitted.
  • Responder email: Select an autoresponder that has already been created.

Advanced form settings

  • Save submissions: Choose whether submissions from this form should be stored in WordPress.
  • Add challenge: Add a simple and accessible spam challenge to the form.
  • Google Analytics: Track successful AJAX submissions as Google Analytics events.
  • Clicky: Track successful AJAX submissions using a Clicky goal.
  • CSS class: Add a custom class to the form element.

Click Publish to activate the form. The form screen displays a shortcode such as: [xfws_contact_form id="123"] Replace 123 with the ID of your form. You can also insert the form using the Simple Contact Form block in the WordPress block editor.

Set up autoresponders

An autoresponder confirms that the visitor’s message was received. It can also provide practical information about response times, opening hours or the next step. Creating an autoresponder consists of the following parts:

Autoresponder post example

Title

The responder title is also used as the subject of the email.

Email body

The content is sent using an HTML email template. You can use basic formatting, links and images supported by the WordPress editor. Use the variable %name% to include the visitor’s submitted name in the message.

Optional email fields

  • Email address (Bcc): Send a blind copy to one or more email addresses.
  • Preheader: Add preview text used by email clients such as Gmail and Fastmail.
  • Email footer: Add company information, an address or other footer content.

After saving the responder, return to the form and select it under Additional > Responder email.

Screenshot autoresponder email

Collecting submissions

Submissions can be stored globally or enabled for individual forms. Every stored submission is available in the WordPress dashboard. Stored information can include:

  • The submitted form fields
  • Date and time of submission
  • The page containing the form
  • The visitor’s IP address
  • The visitor’s user agent

Regularly review and delete submissions that are no longer required. Depending on your location and the information collected, privacy legislation may apply.

Plugin settings

The settings are available under Contact form > Settings and are divided into three tabs.

Configuration

  • Submission method: Choose AJAX with a non-JavaScript fallback or AJAX-only submission.
  • Maileroo Verification API: Verify submitted email addresses using Maileroo. No individual API key is required.
  • Turnstile Site Key and Secret Key: Enter both Cloudflare Turnstile keys to enable the integration.
  • Include CSS: Load the plugin’s default form stylesheet.

When the plugin stylesheet is disabled, make sure the honeypot field remains hidden. For example: #contactform div.form-group { display: none; }

Default form settings

Default settings are used when a form does not provide its own value. These include:

  • Default recipient address
  • Default sender address
  • Default email subject
  • Default thank-you message
  • Default thank-you page
  • Submission storage
  • Google Analytics tracking
  • Clicky goal tracking

Settings configured for an individual form can override the corresponding defaults.

Advanced anti-spam settings

  • Blocked country codes: Enter two-letter ISO country codes separated by commas.
  • Delay in seconds: Set the minimum time between loading and submitting a form.
  • Spam log size: Set the maximum log size in megabytes. Enter 0 to disable logging.
  • Block disposable email addresses: This option appears when Maileroo verification is enabled.
  • Block submissions containing URLs: Reject messages containing common URL formats.
  • WP Armour: This option appears when WP Armour – Honeypot Anti Spam is installed and active.

Submission methods

AJAX with a non-JavaScript fallback

When JavaScript is available, the form is submitted using AJAX. When JavaScript is unavailable or disabled, WordPress processes the form using the regular form action. This mode provides the broadest accessibility and compatibility.

AJAX only – JavaScript required

This mode only accepts AJAX submissions. Visitors must have JavaScript enabled. AJAX-only submission can be useful when Cloudflare Turnstile is required because Turnstile also depends on JavaScript.

How spam protection works

The plugin runs inexpensive local checks before checks that require an external request.

Honeypot

Every form contains a hidden field. Normal visitors do not complete this field, but automated bots frequently do. A submission is rejected when the honeypot contains a value.

Minimum submission time

The plugin records when the form was loaded. A submission made sooner than the configured delay is rejected. The default delay is 15 seconds and can be changed in the advanced settings.

Messages containing URLs

Many spam messages contain links. Enable this option to reject messages containing common URL formats. Use this option carefully when legitimate visitors may need to include a website address.

Accessible challenge

An individual form can include a simple question that must be answered with a number. The challenge is generated by the plugin and does not require JavaScript or an external service. Additional challenges can be added through the plugin’s challenge configuration.

Cloudflare Turnstile

Cloudflare Turnstile is an optional external verification service. Both a site key and secret key are required. Turnstile requires JavaScript. If you allow submissions without JavaScript, consider enabling the accessible challenge for that route.

Country blocking

When country codes are configured, the plugin sends the visitor’s IP address to Country.is to determine the country. If the returned country code is on the blocklist, the submission is rejected and recorded in the spam log when logging is enabled. A failed country lookup does not block a legitimate submission.

Maileroo email verification

When enabled, the submitted email address is sent to Maileroo for verification. The verification checks whether the domain has an MX record. The optional disposable-address check can additionally reject temporary email services. If Maileroo verification is disabled, the disposable-address option is not used.

WP Armour – Honeypot Anti Spam

When WP Armour – Honeypot Anti Spam is installed and active, an additional setting appears in the advanced anti-spam options. Enable that setting if you want Simple Contact Form submissions to be checked by WP Armour. The integration is not activated automatically.

External services and privacy

External requests are only made when the corresponding feature is configured and enabled.

  • Country.is: Receives the visitor’s IP address when country blocking is configured.
  • Maileroo: Receives the submitted email address when email verification is enabled.
  • Cloudflare: Receives Turnstile verification data when Turnstile is configured.

Review your privacy statement when enabling external services or storing contact form submissions.

Spam logs

Spam logging can help identify which protection methods are effective for your website. The Recent spam logs page displays the latest 25 attempts. Each entry includes the date, email address, name, IP address, a shortened message and the spam error code. The complete log can be downloaded using the protected download link available to administrators. The maximum log size is configured in megabytes. Enter 0 to disable spam logging.

Spam log file permissions

The plugin uses standard file permissions when creating the spam log. If the log cannot be created, ask your hosting provider which file permission is required. The FWSACF_CHMOD_FILE constant can be defined in wp-config.php using the value recommended by the hosting provider.

For developers

The plugin provides the following action hook: fwsacf_after_success_form The hook runs after a submission has passed validation and spam protection and the administrator notification has been sent. It can be used to send the submitted information to a CRM, newsletter service or another integration.

add_action(
	'fwsacf_after_success_form',
	function($form_data) {
		if (empty($form_data['email'])) {
			return;
		}

		// Send the submitted data to your integration.
	}
);

The submitted values are available in the $form_data array. Always validate and escape values according to how they are used by your integration.

Frequently Asked Questions

Does the form work without JavaScript?

Yes, when “AJAX with a non-JavaScript fallback” is selected. The AJAX-only mode requires JavaScript.

What is the difference between Turnstile and the accessible challenge?

Turnstile is an external Cloudflare service and requires JavaScript. The accessible challenge is generated locally by the plugin and can also work without JavaScript.

Can I add extra fields to my form?

The plugin intentionally provides a limited set of commonly used fields. If you require a complex form builder, conditional fields or extensive field types, a larger form plugin may be a better choice.

Can the plugin send emails through SMTP?

The plugin sends email using the WordPress wp_mail() function. You can use it with an SMTP plugin such as Maileroo SMTP.

What happens to my data when I remove the plugin?

Plugin data is retained by default to prevent accidental data loss during a manual reinstall. If the option to remove plugin data is enabled before uninstalling, the associated settings and stored plugin data are permanently deleted.