Spam form submissions

Academy Study Groups Study Group: HubSpot Marketing
1

Hello,

We have been receiving a lot of spam form submissions recently (not being flagged as spam) and want to prevent these. We are reluctant to enable CAPTCHA as worry that it might negatively impact conversions.

Does anyone know of any solves here/ any other settings etc. within hubspot which could help here?

Thanks

2

Hi @SHogan1,
Thank you for posting to the Community!
I’d like to tag in some of our Top Contributors to see if they have any ideas or workarounds here -- Hi @danmoyle @FazleRabbihx and @ArtyCele Do any of you all have any possible solutions for @SHogan1?
Thank you!
Cassie, Community Manager

3

Hey there @SHogan1. Definitely not a new issue with form submissions, here’s a post @karstenkoehler & I helped on a while back: Protect Against Spam Accounts.

  • For built-in HubSpot solutions, I’d look at a few of these, including CAPTCHA (I don’t see that detracting and negatively impacting submissions that much, honestly)
    Block Free Email Domains: HubSpot allows you to prevent submissions from free email providers (like Gmail, Yahoo, etc.) by adding domain restrictions in your form settings.​
  • Email Domain & Field Validation: Set validation rules for email fields, restrict certain domains, limit characters/length, or require specific formats (such as requiring “@” for emails).​
  • Enable Double Opt-In: This requires users to confirm their email address after submitting the form, helping weed out fake contacts.​
  • Invisible reCAPTCHA: HubSpot uses Google reCAPTCHA v2 Invisible by default, so visitors are only prompted if their behavior appears suspicious, reducing friction for legitimate users.

If you prefer non-CAPTCHA ideas, here are a few.

  • The honeypot / hidden fields option in the link above, distilled: Add a hidden text field to your form that is not visible to regular users. Bots often fill out all fields, so you can set up a workflow to auto-delete contacts who complete this field. I’d recommend adding a hidden field and enrolling those contacts in a workflow that either flags or deletes them.​​
  • Custom JavaScript filters may help. Adding custom JavaScript validation on the site can detect unusual activity (such as bots using outdated browsers or not interacting with fields as humans would).​
  • Regularly monitor where traffic is coming from (IP address, sudden surges) and set up automation to filter or flag suspicious behavior.​
  • Or you could try some third-party spam filters. Automation tools like Zapier, together with external spam-filter services (OOPSpam, Clearout), can help you evaluate submissions before they reach your HubSpot CRM. These can check spam scores, validate emails/numbers, and filter messages using custom criteria.

Regular list cleaning and contact audits, using lists and workflows to regularly cleanse your database, can help you flag repeated entries, incomplete records, or suspicious submission patterns and delete them manually.

I also saw this interesting idea buried in a Reddit thread. Persona Assignment for Known Spammers: Create a “spammer” persona in HubSpot and use workflows to automatically assign this persona to flagged contacts, preventing them from triggering further automations or communications.

To counter this in the longer term, I add a persona called “spammer” which is not visible on forms. When spam makes it through the form, the marketing team or whoever can mark the sender as a spammer. Have a workflow that sits behind the form that filters out enquiries from known spammers before they kick off automations / notifications. Imperfect but does reduce the load somewhat.

I hope that helps!

4

Spam submissions are unfortunately a common issue, especially when bots submit directly to forms. CAPTCHA helps, but it isn’t always enough because some bots can bypass it or use real-looking email addresses. One approach that has worked well is adding a validation layer before submissions reach HubSpot. This allows you to verify emails, validate phone numbers, detect disposable or suspicious addresses, and block likely spam before a contact is created. We’ve seen this approach significantly reduce spam while keeping the CRM much cleaner