Prevent spam form submissions

HubSpot forms include automatic spam prevention features to help you maintain the quality of your contact data. When a form submission is detected as spam, it's separated from legitimate submissions and listed on the spam submissions index page, where you can manage spam without affecting your contacts. Learn how to manage spam submissions.

To further protect your forms:

• Verify form submissions with CAPTCHA.
• Block specific email domains or free email providers.

Form validation and spam detection 

When a visitor enters their email address into a form’s default email field, the formatting is checked right away. If the email address isn't properly formatted, or if the email has globally bounced, the form cannot be submitted.

Once a form is submitted, the submission is scanned for spam indicators. A form submission is marked as spam in the following cases:

• First and last name: an HTML tag or URL is included in the submissions first or last name fields. 
• Site domain: an embedded form ‌submitted from any external page has not been added to your tracked site domains. Learn more about adding external site domains to HubSpot. 
• Excluded IP address or referrer domain: a form is submitted from an IP address or referrer domain that your account has excluded from site analytics. 
• Gibberish detection (Marketing Hub or Content Hub Professional or Enterprise only): if you've opted into the Improved AI-powered Gibberish detection for form submissions beta, submissions containing gibberish in any text field, except Sensitive Data fields, will be flagged as spam.
  • To use gibberish detection, you must turn on the Give users access to generative AI tools and features setting. Learn how to manage your AI settings.

When a form submission is marked as spam, a new contact will not be created from that submission. Learn more about what happens when a form submission is marked as spam. 

Verify form submissions with CAPTCHA

Turn on CAPTCHA to add a verification step that helps ensure submissions are made by people, not bots. HubSpot forms use Google’s invisible reCAPTCHA v2. If Google considers a visitor suspicious, the visitor must solve a CAPTCHA challenge before submitting the form.

Verified form submissions receive a risk score from 0.0 (high risk) to 1.0 (low risk). Submissions with a reCAPTCHA score between 0.0 and 0.1 are automatically marked as spam with the spam type Filtered by reCAPTCHA. 

Please note: if CAPTCHA has been turned on in the form, form submissions from the Submit data for a form API or other form integrations will not be accepted. 

Turn on CAPTCHA in the updated form editor

1. In your HubSpot account, navigate to Marketing > Forms.

2. Create a new form or hover over an existing form and click Edit.

3. In the top left, click the + add icon.

4. In the left panel, click Other.

5. Under the Security & Privacy section, click and drag reCAPTCHA onto the form preview on the right to include this element on your form.

6. In the top right, click Review and update.

Turn on CAPTCHA in the legacy form editor

1. In your HubSpot account, navigate to Marketing > Forms.
2. Hover over a form and click Edit. 
3. In the left pane, under the Other Form Elements section, click to toggle the CAPTCHA (spam prevention) switch on.
4. In the top right, click Update or Publish. 

Please note: if your form (legacy) includes a follow-up email, a CAPTCHA will automatically be added to the form. To remove the CAPTCHA from the form, delete the follow-up emails in the Automation tab of the form editor.

Block specific email domains or free email providers 

Block specific email domains or free email providers to encourage your visitors to submit high-quality business email addresses. These settings are configured on an individual form level. Learn more about blocking email domains in your form.