Prevent spam form submissions

HubSpot forms include automatic spam prevention features to help you maintain the quality of your contact data. When a form submission is detected as spam, it's separated from legitimate submissions and listed on the spam submissions index page, where you can manage spam without affecting your contacts. Learn how to manage spam submissions.

To further protect your forms:

• Verify form submissions with CAPTCHA.
• Block specific email domains or free email providers.

Form validation and spam detection 

When a visitor enters their email address into a form’s default email field, the formatting is checked right away. If the email address isn't properly formatted, or if the email has globally bounced, the form cannot be submitted.

Once a form is submitted, the submission is scanned for spam indicators. A form submission is marked as spam in the following cases:

• First and last name: an HTML tag or URL is included in the submissions first or last name fields. 
• Site domain: an embedded form ‌submitted from any external page has not been added to your tracked site domains. Learn more about adding external site domains to HubSpot. 
• Excluded IP address or referrer domain: a form is submitted from an IP address or referrer domain that your account has excluded from site analytics. This form submission setting is turned on by default. To turn this setting off, learn how to manage your form submission settings for excluded traffic sources.
• Gibberish detection (Marketing Hub or Content Hub Professional or Enterprise only): if you've opted into the Improved AI-powered Gibberish detection for form submissions beta, submissions containing gibberish in any text field, except Sensitive Data fields, will be flagged as spam.
  • To use gibberish detection, you must turn on the Give users access to generative AI tools and features setting. Learn how to manage your AI settings.

When a form submission is marked as spam, a new contact will not be created from that submission. Learn more about what happens when a form submission is marked as spam. 

Verify form submissions with CAPTCHA

Turn on CAPTCHA to add a verification step that helps ensure submissions are made by people, not bots. HubSpot forms use Google’s invisible reCAPTCHA v2. If Google considers a visitor suspicious, the visitor must solve a CAPTCHA challenge before submitting the form.

Verified form submissions receive a risk score from 0.0 (high risk) to 1.0 (low risk). Submissions with a reCAPTCHA score between 0.0 and 0.1 are automatically marked as spam with the spam type Filtered by reCAPTCHA. 

Please note: if CAPTCHA has been turned on in the form, form submissions from the Submit data for a form API or other form integrations will not be accepted. 

Turn on CAPTCHA in the updated form editor

1. In your HubSpot account, navigate to Marketing > Forms.

2. Create a new form or hover over an existing form and click Edit.

3. In the top left, click the + add icon.

4. In the left panel, click Other.

5. Under the Security & Privacy section, click and drag reCAPTCHA onto the form preview on the right to include this element on your form.

6. In the top right, click Review and update.

Turn on CAPTCHA in the legacy form editor

1. In your HubSpot account, navigate to Marketing > Forms.
2. Hover over a form and click Edit. 
3. In the left pane, under the Other Form Elements section, click to toggle the CAPTCHA (spam prevention) switch on.
4. In the top right, click Update or Publish. 

Please note: if your form (legacy) includes a follow-up email, a CAPTCHA will automatically be added to the form. To remove the CAPTCHA from the form, delete the follow-up emails in the Automation tab of the form editor.

Mark form submissions from excluded traffic sources as spam

If you exclude specific IP addresses or referrer domains in your traffic analytics, you can automatically mark form submissions from these sources as spam. For example, if you’ve blocked traffic for an IP address associated with spam, any form submission that comes from that IP address will automatically be listed on your spam submissions index page. Learn more about excluding traffic from your site analytics. 

To turn this setting on or off: 

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Marketing > Forms.
3. Click the Submissions Settings tab.
4. Toggle the Mark form submissions from excluded IP/referrers as spam switch on or off. This setting is turned on by default. 
   • When this setting is turned on, form submissions from excluded IP addresses or referrer domains will be marked as spam.
   • When this setting is turned off, form submissions from excluded IP addresses or referrer domains will be captured as regular form submissions, but no analytics will be recorded. 

Please note: all form submissions originating from excluded IP addresses or referrer domains will not be recorded in your traffic analytics.

Block specific email domains or free email providers 

Block specific email domains or free email providers to encourage your visitors to submit high-quality business email addresses. These settings are configured on an individual form level. Learn more about blocking email domains in your form.