Nonces and CSRF Protection in CF7 Addons — a practical guide to Contact Form 7 nonces CSRF with clear examples you can reuse in real projects.
Contact Form 7 Tutorial Series (91/100). Prefer one article? Read the complete Contact Form 7 tutorial.
Short description
CF7 forms include their own protections; your addon endpoints still need WordPress nonces.
Nonce check
check_ajax_referer('acme_cf7', 'nonce');
if (! current_user_can('manage_options')) {
wp_send_json_error(null, 403);
}