# Use the Comment Blocklist for Contact Form 7

> Marks Contact Form 7 submissions as spam when they contain any word, IP address or email from WordPress's own Disallowed Comment Keys list, so one blocklist protects comments and forms.

- Type: PHP
- Runs: Run everywhere
- Category: [Forms](https://wpide.com/library/category/forms/)
- Tags: contact-form-7, spam, blocklist
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/cf7-disallowed-keys-spam/

## Code

```php
add_filter( 'wpcf7_spam', function ( $spam, $submission = null ) {
    if ( $spam || ! $submission ) {
        return $spam;
    }

    $keys = trim( (string) get_option( 'disallowed_keys' ) );
    if ( '' === $keys ) {
        return false;
    }

    $text = (string) $submission->get_meta( 'remote_ip' ) . ' ' . (string) $submission->get_meta( 'user_agent' );
    foreach ( (array) $submission->get_posted_data() as $value ) {
        $text .= ' ' . ( is_array( $value ) ? implode( ' ', $value ) : (string) $value );
    }

    foreach ( preg_split( '/\R/', $keys ) as $word ) {
        $word = trim( $word );
        if ( '' !== $word && false !== stripos( $text, $word ) ) {
            $submission->add_spam_log( array( 'agent' => 'wpide-disallowed-keys', 'reason' => 'Matches the Disallowed Comment Keys list.' ) );
            return true;
        }
    }

    return false;
}, 10, 2 );
```

## Notes

Manage the list under Settings > Discussion > Disallowed Comment Keys, one entry per line.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Use the Comment Blocklist for Contact Form 7" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/