Since around August 30, 2026, my portal has been receiving a steady stream of spam contacts labeled “Unidentified Form” in the activity timeline. Submissions include only an email address (no name), from a mix of disposable domains (e.g., sigismail.com) and legitimate-looking ones (gmail.com, yahoo.com, comcast.net, sbcglobal.net, tupmail.com).
Steps already taken, issue persists:
- Turned off “Non-HubSpot Forms” (Marketing > Forms > Submissions Settings)
- Turned off “Sync all forms on your website to HubSpot” (WordPress HubSpot plugin)
- Added known spam domains to the account-wide email domain block list
- Raised reCAPTCHA V3 threshold to 0.8
- Confirmed via Forminator’s own submission logs that these never touch my actual WordPress forms
Diagnostic findings on one affected contact (sandra@tupmail.com):
- Website activity shows 1 site visit, 0 pages viewed
- Both First Conversion and Recent Conversion show the identical generic label: “Executive Coaching & Business Consulting | Hartmetrics: Unidentified Form (2026-09-08 19:41:40)” — no distinct form GUID
- Clicking through the conversion page link redirects to my homepage, not the labeled page
- Record source: Forms
This pattern (tracked session with zero page views + unidentified form + no matching real form anywhere in my portal) suggests either spoofed submission metadata or a legacy/hidden tracked form path being hit directly, bypassing any visible form.
Has anyone else run into this specific combination? Support confirmed this needs account-level investigation into submission logs, since the form can’t be identified from my end.
Hi @micheled,
Have you checked with HubSpot support? One possible source are submissions through the authenticated form submission endpoint - which essentially leaves the door open for anyone who knows a form ID.
POST https://api.hsforms.com/submissions/v3/integration/submit/{portalId}/{formGuid}
You can request from HubSpot support that they disable this unauthenticated endpoint for you. If that was the reason for the submissions, they will inevitably stop.
Best regards
Yes same issue. increased the level on the filter. reconfirmed recaptcha on all forms. turned off the synce of non hubspot forms. added more security to dedect spam on the chat feature. I am still getting spam
I am a small business owner and am on the free version. I did work with the help desk via chat but unfortunately they were unable to help. They connected me to a sales person to talk about upgrading. That’s not the answer I was looking for. Hopefully it’s reported to a team that can identify the issue and get it resolved.
@micheled my recommendation would be to get any 14-day Professional trial to get access to HubSpot support to get this sorted.
Thank you. It seems like it’s a known issue that several people have reported. I don’t believe that will change much getting the free trial.
@micheled as I said in my previous reply, these submissions are likely coming from the unauthenticated endpoint which support can deactivate as part of a trial. There are good chances that this will be resolved by following those steps.
And will it stay deactivated?
@micheled the endpoint deactivation is permanent, yes. It might not be the reason here (only investigating in your portal will tell), but even if it isn’t, you would have HubSpot support access for two weeks to find out what the reason might be.