Bots bypassing HubSpot form spam protection (reCAPTCHA v2) – any better solutions?

Marketing & Content Hub Lead Capture Tools
1

Hi everyone,

Recently, we experienced a bot attack on one of our HubSpot forms that resulted in multiple submissions every few minutes.

The form already has HubSpot’s built-in invisible reCAPTCHA enabled, and the submissions were correctly flagged as spam. However, they were still enrolling into workflows, which created operational noise and unnecessary processing.

I tried several mitigation steps, including:

  • Adding a honeypot property
  • Implementing some basic spam-prevention logic
  • Adjusting workflow filters to try to prevent enrollment

Unfortunately, none of these stopped the submissions.

The only solution that successfully blocked the bot was adding a manual verification field asking users to type the word “Budgetly.” While effective, this introduces significant friction for legitimate conversions, which obviously isn’t ideal.

After speaking with HubSpot Support, I learned that HubSpot forms currently use Google’s invisible reCAPTCHA v2 and there isn’t an option to switch to reCAPTCHA v3 in the UI. The issue has been shared with the product team, but there’s no timeline for a v3 upgrade.

I’m curious how others in the community are handling this.

Questions:

  • Have you experienced bots bypassing HubSpot’s spam protection like this?
  • Are there low-friction approaches you’ve used to prevent bot submissions?
  • Has anyone implemented additional protection layers (custom validation, external CAPTCHA, middleware, etc.) that work well with HubSpot forms?

Any insights or best practices would be hugely appreciated.

Thanks!
Michael

2

HI @MPrantalos0,

@MPrantalos0 wrote:

the submissions were correctly flagged as spam. However, they were still enrolling into workflows

That sounds very strange and shouldn’t be happening, could you please elaborate on that?

See here: Manage spam form submissions on the spam submissions index page

  • CRM records associated with the form submission will not be created or updated.
  • Form automation will not be triggered based on the submission.
  • Traffic analytics will not be updated based on the submission.
  • The submission will automatically be deleted 90 days after the submission date.

Can you confirm you’re using HubSpot’s CAPTCHA or did you build your own solution? Prevent and filter spam in form submissions

Overall, these betas have improved spam detection a lot recently:

Best regards

3

If reCAPTCHA is enabled and you are still seeing spam submissions, I would check whether the spam is arriving through the page at all. A lot of HubSpot form spam is direct-to-Forms-API: the bot already knows the form GUID, posts straight to HubSpot, and never runs the browser path where your page-level controls live.

That also explains why the fixes feel contradictory. HubSpot’s native form CAPTCHA can block API submissions to that destination form, but it also blocks legitimate server-side forwarding to the same form. So if you put another layer in front of HubSpot, forwarding into a CAPTCHA-on destination will fail with FORM_HAS_RECAPTCHA_ENABLED.

The cleaner model is: public form posts to a protected endpoint first; clean submissions are forwarded into a hidden HubSpot destination form; risky ones sit in quarantine for review; and the old public form is archived/disabled after you have mapped workflow/report dependencies. Removing the embed alone only prevents future GUID exposure; it does not stop bots that already know the old GUID.

I’m validating a small tool for this exact HubSpot Forms workflow. It does not need HubSpot contacts read/write access, only forms scope for assisted setup. Happy to share the checklist if useful.