Contact Form 7 reCAPTCHA keys when you switch plugin

Where CF7 keeps them

CF7 stores its integration keys in its wpcf7 option, shown under Contact → Integration. When Contact Form 7 is uninstalled, that option is deleted along with all CF7 forms. If you've already deleted it, the keys aren't lost: they're still listed in your reCAPTCHA or Turnstile admin console, where you can copy them or create new ones.

Match the version

• reCAPTCHA v3 keys only work with v3; CF7 has used v3 since version 5.1. v2 checkbox keys can't be used for v3, and the other way round.
• Turnstile keys work anywhere Turnstile is supported.
• Check that your site's domain is listed on the key. A key made for a staging domain won't validate on the live site.

Taking them over in Mailbag

When you import Contact Form 7 forms under Mailbag → Import, Mailbag looks for CF7's CAPTCHA keys and offers to use them. It copies them only if you say yes, into Mailbag → Settings → Spam, where the secret is shown masked. CF7's own settings aren't changed, so both plugins can run side by side while you swap pages.

Once the keys are in, Mailbag loads the CAPTCHA script only on pages with a form — CF7 loads reCAPTCHA on every page of the site when the integration is on, which is one of the most common speed complaints about it.

What happens if the keys stop working

Keys get deleted, rotated or hit the free monthly limit. In Mailbag, a rejected secret or an exhausted limit doesn't block your visitors: entries are accepted and marked unverified, and a notice tells the administrator to fix the key. The honeypot, time trap and per-address limit keep catching the everyday bots — see when the CAPTCHA is down.