Prevent spam form submissions

• When a visitor enters their email address into the default email field on a HubSpot form, if the email address isn't formatted correctly, or if the email has globally bounced, the form cannot be submitted.
• If a form is submitted with a URL or HTML tag in the first or last name field, it'll be flagged as spam. Learn more about managing your form's spam submissions. 
• If you exclude IP addresses or referrer domains from your site analytics, form submissions submitted from the excluded IPs or referrer domains will be automatically marked as spam. Learn more about excluding traffic from your site analytics.
• If you have a Content Hub Professional or Marketing Hub Professional subscription and have opted into the Improved AI-powered Gibberish detection for form submissions beta, any submission containing gibberish in any text field will be flagged as spam. Learn more about managing your form's spam submissions.

You can provide additional protection against spam form submissions by turning on CAPTCHA on your form or blocking specific email domains and free email providers. 

Turn on CAPTCHA

Turning on CAPTCHA adds a step to your form verifying that a visitor isn't a robot. When a form uses CAPTCHA, Google's invisible reCAPTCHA will appear on your form when you add the form to a page. If Google determines that a visitor is suspicious, they must solve a CAPTCHA challenge before they can submit the form. HubSpot uses reCAPTCHA v2 for spam prevention.

The steps to turn on CAPTCHA differ based on whether you’re using the updated form editor or the legacy form editor.

Please note: if CAPTCHA has been turned on in the form, form submissions from the Submit data for a form API or other form integrations will not be accepted. 

Use the updated form editor

1. In your HubSpot account, navigate to Marketing > Forms.

2. Create a new form or hover over an existing form and click Edit.

3. In the top left, click the + add icon.

4. In the left panel, click Other.

5. Under the Security & Privacy section, click and drag reCAPTCHA onto the form preview on the right to include this element on your form.

6. In the top right, click Review and update.

Use the legacy form editor

1. In your HubSpot account, navigate to Marketing > Forms.
2. Hover over a form and click Edit. 
3. In the left pane, under the Other Form Elements section, click to toggle the CAPTCHA (spam prevention) switch on.
4. In the top right, click Update or Publish. 

Please note: if your form (legacy) includes a follow-up email, a CAPTCHA will automatically be added to the form. To remove the CAPTCHA from the form, delete the follow-up emails in the Automation tab of the form editor.

Score-based bot detection

If you've turned on CAPTCHA, form submissions will be assigned a risk score ranging from 0.0 (high risk) to 1.0 (low risk). Any submission with a reCAPTCHA score between 0.0 AND 0.1 will be automatically marked as spam with the spam type Filtered by reCAPTCHA.

Block specific email domains or free email providers 

If you have a Content Hub or Marketing Hub Starter, Professional, or Enterprise subscription, you can block specific email domains or free email providers. This encourages your visitors to submit high-quality business email addresses. These settings are configured on an individual form level. Learn more about blocking email domains in your form.