Bot Submission on HubSpot forms

[Ishan5]

Hi @All

Is there a way to create automation in HubSpot to block spam submissions? Someone has been submitting forms repeatedly, and I want to set up an automation to block the IP address and domain associated with the spam. I've already enabled CAPTCHA, but the spam continues. I want to create Automation for that in Hs and avoid manual adding Email. Domain or IP address 

[karstenkoehler · Accepted solution]

Hi @Ishan5,

This is a tricky one and will always be a cat-and-mouse game.

As you already mentioned, you can enable Google CAPTCHA on your forms: https://knowledge.hubspot.com/forms/prevent-spam-form-submissions#enable-captcha

You can manually block email providers if you can identify a pattern: https://knowledge.hubspot.com/forms/prevent-spam-form-submissions#block-specific-email-domains-or-fr...

You could include a hidden field in your form, assuming that especially bots would accidentally fill this – and then filter out contacts where the hidden field is filled. (This is also called a "honeypot".)

If there is any pattern in how contacts fill certain fields (e.g. within the message field, the email domain, first and last name), you can build an active contact list that finds these contacts and regularly delete contacts form the list. You would refine the criteria over time. https://knowledge.hubspot.com/lists/create-active-or-static-lists

Lastly, on a hosting-level, you could check if you have settings to block bot traffic, see for example here: https://www.cloudflare.com/learning/bots/what-is-bot-traffic/

Hope this helps!

[EmmaAtKiwi · Accepted solution]

Hey @Ishan5! Not a perfect solution, but there's a new beta that might help! Navigate to the Settings cog in the top right hand of your portal > under Account Manager in your left hand menu select Product Updates > use the search bar to look for the following beta:

Send form submissions from excluded IP and referrers to spam

What is it?

With this update, all form submissions from excluded IPs and referrers will be treated as spam and will be sent to the spam submissions tool. As a result, these submissions would not have any impact on the CRM data. This would ensure consistency between the CRM data and web analytics.

Why does it matter?

Customers have been able to exclude website traffic from excluded IPs and referrers from their site analytics.

Prior to this update, the form submissions from an excluded IP or a referrer were still collected and processed like regular submissions. This was confusing for customers as they would see the contact records created from a form submission and other CRM properties updated but relevant automations were not triggered and none of the corresponding analytics was available in the system.

How does it work?

• If an IP or a referrer was added to the exclusion list under Settings -> Account Management -> Tracking & Analytics -> Tracking code -> Advanced Tracking, any form submissions from these excluded sources will be treated as spam and will be sent to the spam submissions tool.
• Users can choose to release these spam submissions. Once released, these submissions will be processed like a regular form submission and will be synced into the CRM.
• All relevant workflows will also be triggered.
• Please note that releasing the excluded form submissions will not update web analytics such as "Views". However, the submissions count will be updated.

Who gets it?

All hubs and tiers

[Nhal · Accepted solution]

Ugh, spam like that can be such a time suck. Are the form hits coming from the same IP or email domain?

Quick fix: go to Settings → Data Management → Tracking & Analytics → Excluded IP Addresses and drop in the IPs. That won't stop form loads, but it keeps the submissions out of your analytics and workflows.

For domains, set up an Active List like “email contains @spammer.com” and use that list to block workflow actions.

I once had a bot hit us 100+ times, adding a hidden honeypot field helped a ton too 🙂

[EmmaAtKiwi · Accepted solution]

Hey @Ishan5! Not a perfect solution, but there's a new beta that might help! Navigate to the Settings cog in the top right hand of your portal > under Account Manager in your left hand menu select Product Updates > use the search bar to look for the following beta:

Send form submissions from excluded IP and referrers to spam

What is it?

With this update, all form submissions from excluded IPs and referrers will be treated as spam and will be sent to the spam submissions tool. As a result, these submissions would not have any impact on the CRM data. This would ensure consistency between the CRM data and web analytics.

Why does it matter?

Customers have been able to exclude website traffic from excluded IPs and referrers from their site analytics.

Prior to this update, the form submissions from an excluded IP or a referrer were still collected and processed like regular submissions. This was confusing for customers as they would see the contact records created from a form submission and other CRM properties updated but relevant automations were not triggered and none of the corresponding analytics was available in the system.

How does it work?

• If an IP or a referrer was added to the exclusion list under Settings -> Account Management -> Tracking & Analytics -> Tracking code -> Advanced Tracking, any form submissions from these excluded sources will be treated as spam and will be sent to the spam submissions tool.
• Users can choose to release these spam submissions. Once released, these submissions will be processed like a regular form submission and will be synced into the CRM.
• All relevant workflows will also be triggered.
• Please note that releasing the excluded form submissions will not update web analytics such as "Views". However, the submissions count will be updated.

Who gets it?

All hubs and tiers

[karstenkoehler · Accepted solution]

Hi @Ishan5,

This is a tricky one and will always be a cat-and-mouse game.

As you already mentioned, you can enable Google CAPTCHA on your forms: https://knowledge.hubspot.com/forms/prevent-spam-form-submissions#enable-captcha

You can manually block email providers if you can identify a pattern: https://knowledge.hubspot.com/forms/prevent-spam-form-submissions#block-specific-email-domains-or-fr...

You could include a hidden field in your form, assuming that especially bots would accidentally fill this – and then filter out contacts where the hidden field is filled. (This is also called a "honeypot".)

If there is any pattern in how contacts fill certain fields (e.g. within the message field, the email domain, first and last name), you can build an active contact list that finds these contacts and regularly delete contacts form the list. You would refine the criteria over time. https://knowledge.hubspot.com/lists/create-active-or-static-lists

Lastly, on a hosting-level, you could check if you have settings to block bot traffic, see for example here: https://www.cloudflare.com/learning/bots/what-is-bot-traffic/

Hope this helps!