I’m hoping to get some productive guidance from this community because I’m hitting a wall.
I just spent over an hour on a call with HubSpot Support trying to address something that should be a straightforward fix: preventing spam form submissions. Instead, I ended up in a very confusing loop of being instructed to build custom properties, filters, and workflows — none of which ultimately solved the issue.
What’s even more frustrating is that I’ve raised concerns about spam multiple times over the past few months, yet no one mentioned that HubSpot has a beta feature specifically designed to reduce spam submissions. That lack of clarity has cost a lot of time and unnecessary effort.
As a marketing leader without an internal dev or ops team to rely on, I’m often left trying to navigate technical solutions on my own. My goal isn’t to vent, but rather to understand:
Is anyone else experiencing this level of complexity around spam prevention?
Has anyone used the spam‑prevention beta feature successfully?
Are there best practices, configurations, or workflow setups that have worked well for you?
Is there a simpler, more reliable path I might be missing?
Any insights, lessons learned, or examples would be incredibly helpful. I want to ensure we’re using HubSpot effectively — and not over‑engineering something that should be much simpler.
Could you provide more details as to which spam issue exactly you are facing? What type of spam submissions are you receiving? What did HubSpot support instruct you to setup?
In general, the recent wave of spam submissions with contacts that have alphanumeric first and last names was solved in the portals that I manage through this beta: HubSpot Login and Sign in
Happy to provide clarity:
Typical marketing teams do not have a devops person dedicated to the build-out of Hubspot. So, like me, often times in the B2B space the goal is to drive form fills. With the rise of AI spam bots have increased capabilties to double opt-in and work around things like CAPTCHA.
My frustration is not with the Beta tool itself, that was overdue, but rather with the systems outside of Beta to mark spam (without building a complex workflow) and an improved supression list.
For instance, starting with the “mark spam”, I would like to see a feature that allows admins to categorize obvious spam - or nefarious phishing attempts with greater ease. We certainly do get a large amount of phishing form fills.
Secondly, regarding the supression list, I would like to see an option that is 2-fold. One where we do want to allow acceptable free emails (like Google) through while suppressing all others. Currently, there is only 1- built in option that is all encompassing. I’m recommending making that a 2-tier built-in, so widely-used acceptable emails are not caught in filters. Perhaps even adding logic that can identify “gibberish” within Gmail accounts.
I mentioned Google specifically as many businesses use this and Google Workspace as a cost effective means to operate.
The marketing team here, has followed most of the recommendations as provided above. However, as technology evolves with disruptors like AI, I would hope solutions also evolve as I know Hubspot is constantly rolling out new products.
Additional update here, I just checked the form in question and it is STILL receiving numerous submissions clogging up my metrics with massive duplicates that are not being caught nor marked as spam. Where would I see the beta testing on the spam tool and where to mark these as spam? So incredibly frustrated by this process.
Greetings,
Thank you for your ongoing support on this - I have connected with a Hubspot team member 1:1 offline, but I wanted to still share the knowledge we’ve discovered. I did see that other thread where you answered the form-fill spam preventative here: https://community.hubspot.com/t5/Lead-Capture-Tools/Forms-and-Spam-Submissions/m-p/1188301/highlight/true#M13109
We’re currently hosting our website through Hubspot, having switched from Wordpress last year. So based on the solution provided above through CloudFlare to protect from bots, we did lose that. Otherwise, Hubspot has been much better as far as the actual interface goes.
Some the other recommendations we tried:
• We did setup a “honey pot” field, but that does not appear to be useful in this case.
• We setup a static list to flag spam/bots, it was incredibly complex procress.
• We can prevent the “free” email address and known suppression list provided by Hubspot. However, it would be nice to have an option that allows “gmail” while blocking others. It’s just so easy for spammers to create fake urls into perpetuity.
• We do have a method for segmenting and blocking but it does not catch themall.
What we are seeing and here are the parameters that make these, and similar submissions, categorized as spam:
• The name submission does not match the email.
• Numerous consecutive submissions (in this case 3-4 a minute in quick succession)
• Numerous submissions, within minutes, from same url with generic names all for the same company. (In one case there were 13 submissions for astrawavetechnologies)
• Obvious free or inaccurate email URLs that impersonate legit .edu or .orgs (@yahoo, @instmail.uk, @g.austincc.edu)
• Out of country email URLs that are very close to gibberish and barely make sense. (@students.dkut.ac.ke)
With the rise of AI, bots and other programs can double-opt-in and bypass CAPTCHAs like never before. As a technology firm we’re seeing these concerns and others on the bleeding edge of our AI/DevOps service delivery.
The height of my frustration is not even that technology and systems like Hubspot are struggling to align, it’s the ease in which I can report spam and or flag contacts in my data sets. Although, it makes sense to me, are there internal challenges with piloting a universal spam marker? The theory being that there is a built-in setup for selecting contacts to automatically add to a supression list that can be applied without the use of custom building supression workflows, property types, and columns.
Having said that, here’s where this stands and the feedback from the product expert team and my Hubspot POC:
“I’ve escalated these specific examples and the parameters you identified to our Product Expert team. We are looking into the back-end logs to see if we can identify a common IP address or a specific “fingerprint” for these submissions. While our gibberish filter is designed for random text, your case highlights a more sophisticated type of spam that we want to ensure our systems are catching.”
Thank you again for your help and feedback!
We had the exact same issue with spam submissions flooding our forms and polluting our CRM. Here’s the full breakdown of what we implemented, it’s a layered approach so no single point of failure.
The Problem
Spam contacts flooding the database
Skewed reporting and analytics
Sales team wasting time on junk leads
Unwanted workflow enrolments from bot submissions
Our Solution: Multi-Layered Spam Defence
We built a test bot and multiple prevention layers that work together. Each layer catches a different type of attack:
Attack Vector How We Block It
Headless browser (e.g., Puppeteer, Playwright)
Time-on-form check real humans don’t fill forms in < 3 seconds
Direct HTTP POST (skipping the form entirely)
WP nonce validation rejects requests without a valid token
Fast fill bots
Time-on-form + interaction count must spend minimum time AND register mouse/keyboard events
Honeypot filler bots
Client-side honeypot check hidden field that only bots fill in; if populated → rejected
I think there are two separate problems getting mixed together here, which is why the guidance can feel circular:
1. Preventing bad submissions from creating contacts / triggering workflows in the first place.
2. Giving admins a simple way to mark, suppress, and review spam after it has already entered HubSpot.
The second problem is what a lot of the static-list / suppression-list / custom-property advice is trying to solve, but it still means the junk already exists in the CRM and may already have touched workflows, reporting, notifications, routing, etc. That is why it feels like over-engineering: you are building cleanup machinery after the submission has landed.
For the first problem, the pattern I would look for is pre-HubSpot review: route public submissions through a controlled endpoint, score them before HubSpot sees them, forward clean ones into a hidden HubSpot destination form, and hold risky ones in quarantine where an admin can release / delete / block. That way “mark as spam” becomes an operator action before CRM pollution, not only a cleanup step afterward.
This does not remove the need for HubSpot-native spam tooling, especially for global suppression and reporting. But if the pain is duplicate/phishing submissions clogging metrics and downstream workflows, I would prioritize the layer that decides before contact creation.
I’m working on a small HubSpot Forms-specific tool around this workflow. Basic setup uses forms scope only, not contacts read/write. Happy to share the checklist if useful.
*UPDATE* - There have so many great responses here and, in-short, all of them worked to some degree. Ultimately what I did was a combination of all of the above. Fast forward to today and we’re seeing a significant reduction in spam. Thank you for all the contributions.