On every page Contact Form 7 loads its dependencies (wp-hooks, wp-i18n) and its CSS into the <head>, blocking first paint. This plugin fixes that:

Defer CF7 core — moves wp-hooks/wp-i18n to the footer (you cannot defer them: an inline wp.i18n.setLocaleData block runs synchronously and would throw “wp is not defined”). CF7’s scripts leave the critical path.
Async CSS — the form stylesheet loads via media=print + onload-swap.

Both optimizations are idempotent and safe on every page. Strict dependency: with Contact Form 7 inactive, the plugin does nothing.

Lightweight anti-spam

Two spam checks that need no external service and add no extra requests. Both are off by default — enable them under Contact Performance if you don’t already run another anti-spam plugin for your forms.

Honeypot field — a field hidden from visitors is added to every form; bots fill it in and the submission is marked as spam.
Time trap — submissions sent faster than a human could fill in the form (configurable, 3 seconds by default) or sent without JavaScript are marked as spam. The time is measured in the visitor’s browser, so it works with page caching.

The settings page shows how many spam submissions have been blocked.

A note on jQuery

This plugin does NOT defer jQuery — on purpose. Deferring jQuery is only safe when EVERY jQuery-dependent script on the site is also deferred or in the footer; on an arbitrary site that is not guaranteed and breaks inline scripts in the head.

Pro version

Defer for Contact Form 7 Pro adds lazy-loaded anti-spam captcha — spam protection without a PageSpeed hit. Pick one provider (they are not run at the same time):

Google reCAPTCHA v3 — score-based. api.js loads only on the first interaction with a form, so it never appears in Lighthouse/PSI. The score check is server-side; a fresh single-use token is fetched for every submission. The badge is hidden with the required Google disclaimer (GDPR-friendly); configurable score threshold and action label.
Yandex SmartCaptcha — invisible mode, no widget shown unless the visitor looks suspicious. Same lazy-loading approach, binary server-side check. A practical alternative for sites served from Russia, where Google’s services aren’t always reliable.
Cloudflare Turnstile — privacy-friendly and free; a “Verify you are human” checkbox appears under the form only if Cloudflare needs it. Same lazy-loading approach, binary server-side check. The site does not have to be on Cloudflare.

Switch from another captcha in one click. If the site already uses Contact Form 7’s built-in reCAPTCHA or Turnstile, or the “Captcha by Yandex for Contact Form 7” plugin, the settings page offers to move their keys over. All of them load their script on every page of the site; after the switch the captcha loads only when a visitor starts filling in a form. The keys on CF7’s “Integration” tab are cleared at the same time, leftover [yandex_captcha] tags in forms are hidden (and can be removed with one more click).

Pro also adds detailed spam statistics: a breakdown by reason (honeypot, time trap, captcha), a 30-day chart and a log of what bots typed into your forms. The log stores no IP addresses, cuts every value to 100 characters and keeps entries for 30 days.

The free version stays fully functional on its own.

External services

This plugin can connect to the following third-party services:

Freemius (free and Pro) — licensing, updates and the optional usage-data opt-in. Nothing is sent unless the site administrator opts in (or activates a Pro license). When enabled, it sends the site URL, WordPress/PHP/plugin versions and the administrator’s name and email. Terms, Privacy Policy.
Google reCAPTCHA v3 (Pro only, when selected and configured) — the visitor’s browser loads https://www.google.com/recaptcha/api.js on the first interaction with a form; on submit the site sends the captcha token and the visitor’s IP address to https://www.google.com/recaptcha/api/siteverify. Terms, Privacy Policy.
Yandex SmartCaptcha (Pro only, when selected and configured) — the visitor’s browser loads https://smartcaptcha.cloud.yandex.ru/captcha.js on the first interaction with a form; on submit the site sends the captcha token and the visitor’s IP address to https://smartcaptcha.cloud.yandex.ru/validate. Terms, Data processing notice.
Cloudflare Turnstile (Pro only, when selected and configured) — the visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js on the first interaction with a form; on submit the site sends the captcha token and the visitor’s IP address to https://challenges.cloudflare.com/turnstile/v0/siteverify. Terms, Privacy Policy, Turnstile privacy addendum.

Support

Questions, bug reports or feature requests: the plugin’s support forum on WordPress.org, or https://rowan-web.ru/en/blog/defer-for-contact-form-7/