Contact Form 7 uses a WordPress nonce to protect each submission from cross‑site request forgery. The nonce is generated when the form HTML is rendered and is checked when the AJAX request reaches the server.
If the nonce value no longer matches the one stored in the user session, WordPress returns a failure response. The mismatch appears as the error message on the front end.
Common reasons for mismatch include serving a cached version of the page, JavaScript that alters the hidden field, or a server clock that is out of sync with WordPress time calculations.
When multiple WordPress installations share a domain, differing salts generate nonces that cannot be validated across sites. Security plugins that replace wp_nonce_field may also break the flow.
HTTPS to HTTP transitions drop the authentication cookie, causing the nonce verification step to fail even if the hidden field is correct.