Good morning!
Less of a question and more of a discussion thread. We’ve recently moved from Gravity Forms on our Wordpress sites to HubSpot Forms. We saw a reduction in spam submissions for some time but as expected in this cat-and-mouse game, illegitimate submissions have increased again.
I’m just looking for other ideas or workarounds people have tried in an effort to reduce spam submissions. Our marketing team has implemented the reCaptcha on to each form and a honeypot field, though the honeypot remains unfilled over 3 weeks.
I’m curious what tools or workarounds are available that we’re unaware of. I don’t expect to eliminate all spam submissions but defintely looking to reduce ours by a significant portion. TIA and looking forward to hearing from people! 
Hi @PHA_iPadag,
This is a tricky one and will always be a cat-and-mouse game.
As you already mentioned, you can enable Google CAPTCHA on your forms: Prevent and filter spam in form submissions
You can manually block email providers if you can identify a pattern: https://knowledge.hubspot.com/forms/prevent-spam-form-submissions#block-specific-email-domains-or-fr…
You could, as you mentioned, include a hidden field in your form, assuming that especially bots would accidentally fill this – and then filter out contacts where the hidden field is filled.
If there is any pattern in how contacts fill certain fields (e.g. within the message field, the email domain, first and last name), you can build an active contact list that finds these contacts and regularly delete contacts form the list. You would refine the criteria over time. Create segments
Lastly, on a hosting-level, you could check if you have settings to block bot traffic, see for example here: https://www.cloudflare.com/learning/bots/what-is-bot-traffic/
Hope this helps!
Thanks for the response Karsten! Yes, we have implemented the captcha already but unfortunately we work with consumers so we can’t turn on the domain blocking.
I’ve been working on identifying common characteristics for an active list to clean up our records.
Do you have any experience implementing the honeypot fields? I’m mainly curious why are hidden field has failed to capture anything over 3 weeks and looking at ways to use that more effectively. Again, appreciate your detailed response about our issue.
@PHA_iPadag Modern spam bots can detect hidden inputs via CSS, and they deliberately skip them to avoid detection. In that sense, a honeypot field will be one tool in the toolkit that could theoretically help identify some form submissions – but it’s not the most powerful one as bots get better and better.
One general tip would be to, instead of firstname_hidden or similar predictable names, use a random name or something generic like companyFax and rotate it server-side. While this does not help with advanced bots, it could be mistaken by a bot for an actual field more easily.
We have seen a big uptick in in Phishing attack style form submissions. Where they send a link to a sketchy PDF file saying download our requirements and the PDF has a virus in it, or they say email us back your catalog, when the catalog is right there on the website. Frequently these email addresses are from something that looks like a valid domain but it has a single character out of place that unless you look at it close it isn’t real. It seems like an AI could easily ferret these submissions out and quarantine them, but there isn’t really anything built into Hubspot that does this. I thought about doing something with the Claude connector to have it look at each submission and take some action? It’s annoying because we get lots of these types of submissions each week.