Contact Form 7 submits data through an AJAX POST request to the WordPress REST endpoint /wp-json/contact-form-7/v1/contact-forms/*/feedback. Cloudflare sits between the visitor and the origin server and inspects every request.
Cloudflare firewall rules evaluate the request against patterns for bad bots, SQL injection, cross‑site scripting, and generic REST API protection. When a rule matches, Cloudflare returns a 403 response that includes the text “Form submission blocked by Cloudflare.” CF7 reads that response and shows the same message inside the form.
Rate‑limit policies or Bot Fight Mode may throttle repeated submissions from the same IP address. The edge server then replies with 429 or 403 status codes, which appear as a blocked form.
Missing or altered User‑Agent or Referer headers also trigger the firewall. Some security plugins strip these headers, causing Cloudflare to treat the request as suspicious.
Turnstile or reCAPTCHA integration that fails verification adds a firewall check. An invalid token or a mismatched SSL/TLS mode (Full vs Full Strict) leads Cloudflare to reject the request, and CF7 reports the block.