topic Re: Booking calendar being spammed with bookings in Tips, Tricks & Best Practices

Booking calendar being spammed with bookings

RHaley — Fri, 30 May 2025 17:05:06 GMT

So we are running into an issue where a group of people is targeting our Hubspot booking pages, and blowing up the calendars they are connected to, with meetings to fake accounts.

Does anyone know if there is a way to secure the booking pages a little better? We have already blocked IP addresses from various regions (easily bypassed with VPN), enable reCAPTCHA, and blocked all free damains, as suggested by Hubspot.

we have determined that this denial of service is being done by people and not scripts or bots. I've had a ticket open with Hubspot for the last month, and we are just running around in circles.

I'm wondering if there is a best practice for forms that can help with or even put a process in place where we can review submissions before any calendar bookings are made to determine if they are real or part of the Spam campaign.

Re: Booking calendar being spammed with bookings

Josh — Fri, 30 May 2025 18:13:32 GMT

Hi @RHaley,

That's a really tough situation. Sorry you're having to deal with it. As far as available options go, anything you do will probably add some friction to the humans that aren't spamming you. Here are a few thoughts:

If you have Content Hub Pro, only make the booking page available to known contacts.
Connect an alternate calendar to the public page and manually move legit meetings to the actual calendar -- there's risk here in being double-booked and dealing with an alternate calendar.
This one may be far-fetched, but throwing it out there anyway. Charge $1 or a small amount to book a meeting. People who legitimately want to book may be willing to do this, but I can't imagine you'd get high volumes of spam even when charging a low $. Again, friction for the real people, but an option.
This is would probably be my choice: Use an alternate non-calendar form that sends the meeting link to the individual via email after they submit the first form allowing you to validate.

If this is a human doing this, I think that any of these solutions would only have to be temporary. Eventually, you should be able to go back to the traditional spam prevention methods.

Re: Booking calendar being spammed with bookings

RHaley — Fri, 30 May 2025 18:27:13 GMT

Hey @Josh

Thanks for the suggestions.

unfortunatley we are using these pages to try and get new contacts, so that part wont work in our current use case.

The charge to do the form is a very creative idea. I know the leadership team would shoot that down in a heartbeat though.
Currently what i've done is advised our team to remove their booking page link from our website, since it should be something that we send out, and not something that is attainable by anyone.

Next step was I built the team new bookings pages, changing the default name to something more "randomized"

I'll look into changing the form to not directly interact with the page, and see if the team is more willing to have more of a data collection, then a manual intervention to send out their booking page after the information has been verified.

Thank you for the suggestions, I appreciate it.

-RHaley

Re: Booking calendar being spammed with bookings

karstenkoehler — Fri, 30 May 2025 19:53:12 GMT

Hi @RHaley,

Have you considered using a Web Application Firewall (WAF) or a service like Cloudflare? These tools sit in front of your website and give you granular control over who gets access to your pages. For instance, you can create rules to challenge or block users based on behavior patterns, user agents, or IP reputation scores – not just static IP blocks. Cloudflare even lets you enforce “Managed Challenge” checks that are more sophisticated than standard CAPTCHAs, making it harder for even real users to spam you if they don’t pass basic legitimacy tests.

Beyond just blocking, these tools also give you insights into traffic patterns, which can help you understand where the abuse is coming from – like specific ASNs, regions, or even VPN providers. You can then set up tailored rules to rate-limit or throttle suspicious traffic. You can do all this without touching your core infrastructure or relying solely on Hubspot’s controls. It adds a powerful layer of defense that makes casual or even semi-determined attackers move on to easier targets.

Best regards!

Re: Booking calendar being spammed with bookings

RHaley — Fri, 30 May 2025 20:03:46 GMT

That's a wonderful idea, I'm currently looking into it. I'll have to pitch it, and test to make sure we can bring the bookingpage into it instead of using the provided one through hubspot. (example below)
Unfortunately the team is very adverse to change, but i'm hoping that the effective shutdowns of the booking page will help them along in a good decision.

https://meetings.hubspot.com/user-name (default)

Thank you for the suggestion.