Hi @CAT and thank you for sharing such a thorough look at your experience and for outlining your suggestions.
I can confirm that HubSpot provides CAPTCHA, free-domain blocking, specific-domain blocking, and the ability to turn off scheduling pages entirely.
However, I agree there appears to be a gap for blocking one exact email address from booking again, especially for free users who only have one default scheduling page and cannot simply rotate to another link without disruption. Here is the article about it " Manage scheduling pages ".
I’ve noticed a similar idea already present in our Ideas Forum: " Option to block free email providers from booking via Meetings link ". To contribute, you can upvote the existing idea and share more details about your specific use case in the comments.
And please know that I’ve also passed along your valuable feedback internally, it means a lot to us.
In the current situation, I’d recommend the following, even if I understand that’s not exactly what you are after, but I hope it can still help:
- Enable CAPTCHA,
- Block the attacker’s domain if stable/known (this blocks a domain, not one exact email address),
- Block free email domains if that fits their funnel,
- Or turn off the scheduling page if you need a hard stop right now.
Thanks again for taking the time to detail your experience and ideas. If there are other tools, resources, or workarounds we can help you find, please let us know, we’re here to support you and want to help you make the most of HubSpot.
Bérangère