Skip to content

Prevent spam form submissions

Last updated: August 4, 2025

Available with any of the following subscriptions, except where noted:

All products and plans
HubSpot manages spam form submissions by automatically validating the form's email, first name, and last name fields: 

You can provide additional protection against spam form submissions by turning on CAPTCHA on your form or blocking specific email domains and free email providers

Turn on CAPTCHA

Turning on CAPTCHA adds a step to your form verifying that a visitor isn't a robot. When a form uses CAPTCHA, Google's invisible reCAPTCHA will appear on your form when you add the form to a page. If Google determines that a visitor is suspicious, they must solve a CAPTCHA challenge before they can submit the form. HubSpot uses reCAPTCHA v2 for spam prevention.

The steps to turn on CAPTCHA differ based on whether you’re using the updated form editor or the legacy form editor.

Please note: if CAPTCHA has been turned on in the form, form submissions from the Submit data for a form API or other form integrations will not be accepted. 

Use the updated form editor

  1. In your HubSpot account, navigate to Marketing > Forms.

  2. Create a new form or hover over an existing form and click Edit.

  3. In the top left, click the + add icon.

  4. In the left panel, click Other.

  5. Under the Security & Privacy section, click and drag reCAPTCHA onto the form preview on the right to include this element on your form.

  6. In the top right, click Review and update.

Form editor showing the option to add reCaptcha as a form element.

Use the legacy form editor

  1. In your HubSpot account, navigate to Marketing > Forms.
  2. Hover over a form and click Edit
  3. In the left pane, under the Other Form Elements section, click to toggle the CAPTCHA (spam prevention) switch on.
  4. In the top right, click Update or Publish


Please note: if your form (legacy) includes a follow-up email, a CAPTCHA will automatically be added to the form. To remove the CAPTCHA from the form, delete the follow-up emails in the Automation tab of the form editor.

Score-based bot detection

If you've turned on CAPTCHA, form submissions will be assigned a risk score ranging from 0.0 (high risk) to 1.0 (low risk). Any submission with a reCAPTCHA score between 0.0 AND 0.1 will be automatically marked as spam with the spam type Filtered by reCAPTCHA.

Block specific email domains or free email providers 

If you have a Content Hub or Marketing Hub Starter, Professional, or Enterprise subscription, you can block specific email domains or free email providers. This encourages your visitors to submit high-quality business email addresses. These settings are configured on an individual form level. Learn more about blocking email domains in your form.

Was this article helpful?
This form is used for documentation feedback only. Learn how to get help with HubSpot.