Prevent spam form submissions

HubSpot forms include automatic spam prevention features to help you maintain the quality of your contact data. When a form submission is detected as spam, it's separated from legitimate submissions and listed on the spam submissions index page, where you can manage spam without affecting your contacts. Learn how to manage spam submissions.

To further protect your forms:

• Verify form submissions with CAPTCHA.
• Use gibberish detection to filter out spam from your form submissions. 
• Block specific email domains or free email providers.

Understand form validation and spam detection 

When a visitor enters their email address into a form’s default email field, the formatting is checked right away. If the email address isn't properly formatted, or if the email has globally bounced, the form cannot be submitted.

Once a form is submitted, the submission is scanned for spam indicators. A form submission is marked as spam in the following cases:

• First and last name: an HTML tag or URL is included in the submissions first or last name fields. 
• Site domain: an embedded form ‌submitted from any external page has not been added to your tracked site domains. Learn more about adding external site domains to HubSpot. 
• Excluded IP address or referrer domain: a form is submitted from an IP address or referrer domain that your account has excluded from site analytics. This form submission setting is turned on by default. To turn this setting off, learn how to manage your form submission settings for excluded traffic sources.
• Gibberish detection (Marketing Hub or Content Hub Professional or Enterprise only): if you've opted into the Improved AI-powered Gibberish detection for form submissions beta, submissions containing gibberish in any text field, except Sensitive Data fields, will be flagged as spam.

When a form submission is marked as spam, a new contact will not be created from that submission. Learn more about what happens when a form submission is marked as spam. 

Verify form submissions with CAPTCHA

Turn on CAPTCHA to add a verification step that helps ensure submissions are made by people, not bots. HubSpot forms use Google’s invisible reCAPTCHA v2. If Google considers a visitor suspicious, the visitor must solve a CAPTCHA challenge before submitting the form.

Please note: if CAPTCHA has been turned on in the form, form submissions from the Submit data for a form API or other form integrations will not be accepted. 

Turn on CAPTCHA in the updated form editor

1. In your HubSpot account, navigate to Marketing > Forms.

2. Create a new form or hover over an existing form and click Edit.

3. In the top left, click the + add icon.

4. In the left panel, click Other.

5. Under the Security & Privacy section, click and drag reCAPTCHA onto the form preview on the right to include this element on your form.

6. In the top right, click Review and update.