Add honeypot to form for spam protection.

[Vedant]

Hi, 

We've been experiencing a surge in spam form submissions and we are also looking at ways to detect and block leads that contain excessive profanity and the captcha doesn't seem to provide us the solution we are looking for at the moment. Is there a way we an add honeypot option for spam protection on HubSpot forms?

[HubSpotNerd]

Hello @Vedant, 

I got grouchy with there being no good honeypot solution so I decided to do a workaround. It's not perfect, but I created a test question and made it so a bot has to answer in a certain way in order to pass the *required* field and ultimately submit the form. It's a bit annoying to have to add a field for users to fill out when they are already doing a capcha but it truly crushed our spam problem so it's worth it for us.

Here are the steps we took to get it done:

1. Make a new ticket property for your test question – it will need to be a "number" type. I labeled mine "what_is_7_minus_2"
2. Go to your form and add the "what_is_7_minus_2" property to your form.
3. Make the "what_is_7_minus_2" field required
4. Go down and select the checkbox to "Set limits on the numbers accepted" and set it to the answer to our question "7-2" which equals "5" so make it so the lowest number submitable is "5" and the highest number submitable is also "5". This way, a user must input "5" in order to submit the form.
5. Save and publish! 

Hope this helps 🙌 

– HubSpotNerd

[danmoyle]

@HubSpotNerd that's a great simple idea to add - nice!

[FCorbaci]

Hey there,

Honeypot won't help with your problem either. The guides given by @jolle should be helpful, right now we are collecting forms with Elementor and using an add-on to block some domains, message field content etc. Spams usually have a pattern so by using active lists you should be able to block 90% of them. A quick google search can provide a list of domains to block, if you can't find anything, drop me an email and I will share with you what I have now and you can use that list of domains as starters.

Cheers

[jolle · Accepted solution]

Hey @Vedant, thanks for reaching out! This is a super valid concern and something that a bunch of other users have talked about. Unfortunately, there isn't a perfect solution here or a way to integrate anything other than CAPTCHA with HubSpot forms. Here are some (hopefully) helpful resources:

1. Another HubSpot Community thread on this topic with great insights from @danmoyle and @karstenkoehler 
2. HubSpot's Knowledge Base article on preventing spam form submissions

The big recommendations are:

1. Blocking free email providers/requiring a business email address (if you're able to do so)
2. Tracking spam submissions over time and blocking recurring email domains

You're always going to receive some level of spam submissions, but I would also encourage you to investigate the source of them if you haven't already. Maybe you're seeing a bunch of spam come in on a particular page or from a specific asset. I had a client receive a ton of spam submissions because they had a spam bot email address in their database that forwarded their email to a bunch of other bots that filled out the form. Make sure you have clean lists in place!

If it gets to this point, you can also potentially look at using non-HubSpot forms. As long as you have them connected to HubSpot somehow (either as non-HubSpot forms or through the forms API/an integration platform (i.e., Zapier), you should be able to use whatever forms and add-ons you want. Just keep in mind that you'd lose original source data for any leads created there since Hubspot would mark them as "Offline source" from an integration. Just wanted to throw this out there to let you know it's an option!

Hope this helps!!

[danmoyle]

Great advice and resources from @jolle here. +1 for all this ☝️