WordPress 
Sender Click Authorization turns every protected Contact Form 7 submission into a verified conversation. Instead of delivering a message immediately, it asks the sender to confirm the email address with one click. Unverified submissions never reach your inbox, helping eliminate fake leads, disposable contact attempts, bot noise, and repeat abuse.
Zero Spam starts with a real sender
Traditional spam filters try to guess whether a message is legitimate after it has already been submitted. Sender Click Authorization changes the workflow: the sender must prove access to the email address before Contact Form 7 delivers the message. The result is a cleaner inbox and a stronger signal that every delivered inquiry came from someone willing and able to verify it.
Block repeat offenders automatically
Verification history connects form activity with validated IP addresses and abuse signals. Block an exact IPv4 or IPv6 address directly from the log, maintain administrator-managed rules, and use repeat-offender detection to stop recurring attacks. Automated Cloudflare rules can move enforcement beyond WordPress so known abusive traffic is challenged or blocked at the network edge before it keeps reaching your forms.
IP scanning and approximate geolocation
Every verification event can record the sender IP address and add approximate country, region, and city context when geolocation is enabled. Administrators can review the complete verification lifecycle, open additional IP details on demand, and act on suspicious sources without switching between disconnected tools. Geolocation is approximate and may not be available for every address.
Protect every form—or only the ones that need it
Enable sender verification across every Contact Form 7 form or choose individual forms. Selective coverage is ideal when public lead forms need protection but internal, login-gated, or trusted workflows should continue without an extra verification step.
Built for real administration
A dedicated pending-verifications queue lets administrators inspect submissions, send a verified message manually when appropriate, delete individual entries, or clear the queue. Configurable expiration removes abandoned submissions automatically. Verification email and post-submit message templates support common form placeholders, while message colors can be matched to the site design.
Blocked sender-domain controls reject unwanted email domains before a verification message is sent. Durable logs distinguish pending, verified and sent, administrator-sent, expired, blocked, deleted, and delivery-failure outcomes. Retention controls and hourly pruning keep that history manageable.
Integration and privacy controls
A site-key-protected REST endpoint can list, add, and remove IP block rules for security automation and centralized management. WordPress privacy-policy guidance plus personal-data export and erasure integrations help administrators account for stored sender emails, IP addresses, approximate locations, and verification history.
Simple pricing with lifetime updates
The plugin is $29. Future product updates are included free for life. One year of support is available for $19, and existing customers can renew support for another year at the same $19 price.
Ideal for
- Business and lead-generation sites that need real inquiries instead of inbox noise.
- Agencies protecting multiple public Contact Form 7 forms.
- High-abuse websites dealing with bots and repeat offenders.
- Security-conscious administrators who want visible logs, IP context, and actionable rules.
- Sites behind Cloudflare that want abuse signals converted into automated edge rules.
Important notes
- Contact Form 7 is required.
- A working WordPress email-delivery configuration is required for verification messages.
- Automated Cloudflare enforcement requires Cloudflare configuration and an eligible Cloudflare account.
- IP geolocation is approximate, may use configured third-party services, and may be unavailable.
- Site owners should disclose applicable email, IP-address, geolocation, and retention processing in their privacy policy.
