How to Create a Simple Contact Form with Captcha for WordPress

By /

There are many contact forms available for WordPress but most use a third party captcha service. The contact form on my website uses the following custom plugin that has a basic math captcha, no third party required.

Why Use Simon’s Simple Contact Form Plugin?

  • ✅ Easy to Use: Just install and use the shortcode [simple_contact_form] .
  • 📱 Mobile-Responsive: Works great on all screen sizes.
  • 🔒 Built-in Spam Protection: Includes a simple math captcha.
  • ⚡ Lightweight: No bloat, just a clean and functional contact form.

How to Install the Plugin

  1. Step 1: Open your WordPress Admin Dashboard and go to Plugins > Plugin File Editor or use an FTP client.
  2. Step 2: Create a new file in the wp-content/plugins folder called simons-simple-contact-form.php
  3. Step 3: Copy and paste the following PHP code into that file: 
    <?php
/*
Plugin Name: Simon's Simple Contact Form
Description: A simple mobile-responsive contact form with captcha. Use shortcode [simple_contact_form]
 to display the form.
Version: 1.0
Author: Simon Ward
Author URI: https://simonward.net
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
*/

// Prevent direct access
defined('ABSPATH') or die("No direct access allowed");

function scf_form_shortcode() {
    session_start();
    $_SESSION['captcha_num1'] = wp_rand(1, 9);
    $_SESSION['captcha_num2'] = wp_rand(1, 9);
    $_SESSION['captcha_answer'] = $_SESSION['captcha_num1'] + $_SESSION['captcha_num2'];
    
    ob_start();
    ?>
    <form method="post" action="">
        <?php wp_nonce_field('scf_contact_form', 'scf_nonce'); ?>
        <label for="scf_name">Name:</label>
        <input type="text" name="scf_name" required>
        
        <label for="scf_email">Email:</label>
        <input type="email" name="scf_email" required>
        
        <label for="scf_subject">Subject:</label>
        <input type="text" name="scf_subject" required>
        
        <label for="scf_message">Message:</label>
        <textarea name="scf_message" required></textarea>
        
        <label for="scf_captcha">Solve: <?php echo esc_html($_SESSION['captcha_num1'] . " + " . $_SESSION['captcha_num2']); ?> = ?</label>
        <input type="text" name="scf_captcha" required>
        
        <button type="submit" name="scf_submit">Send</button>
    </form>
    <?php if (!empty($_SESSION['scf_success'])) : ?>
        <div style="background-color: green; color: white;">Message sent successfully!</div>
        <?php unset($_SESSION['scf_success']); ?>
    <?php endif; ?>

    <?php if (!empty($_SESSION['scf_error'])) : ?>
        <div style="background-color: red; color: white;">Captcha incorrect. Please try again.</div>
        <?php unset($_SESSION['scf_error']); ?>
    <?php endif; ?>
    <?php
    return ob_get_clean();
}
add_shortcode('simple_contact_form', 'scf_form_shortcode');

function scf_handle_form_submission() {
    session_start();
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['scf_submit'])) {
        if (!isset($_POST['scf_nonce']) || !wp_verify_nonce($_POST['scf_nonce'], 'scf_contact_form')) {
            return;
        }

        if ($_POST['scf_captcha'] != $_SESSION['captcha_answer']) {
            $_SESSION['scf_error'] = true;
            return;
        }

        $to = get_option('admin_email');
        $subject = sanitize_text_field(wp_unslash($_POST['scf_subject']));
        $name = sanitize_text_field(wp_unslash($_POST['scf_name']));
        $email = sanitize_email(wp_unslash($_POST['scf_email']));
        $message = sanitize_textarea_field(wp_unslash($_POST['scf_message']));
        
        $headers = "From: " . esc_attr($name) . " <" . esc_attr($email) . ">\r\n" .
                   "Reply-To: " . esc_attr($email);

        wp_mail($to, esc_attr($subject), esc_textarea($message), $headers);
        $_SESSION['scf_success'] = true;
    }
}
add_action('wp', 'scf_handle_form_submission');
  4. Step 4: Go to Plugins in your WordPress admin and activate Simon’s Simple Contact Form.
  5. Step 5: Create or edit a page/post and add the following shortcode where you want the form to appear: 
    [simple_contact_form]

You’re Done!

Your simple, secure, mobile-ready contact form is now live on your site. Messages will be sent to the admin email address configured in your WordPress settings.

Scroll to Top