Prevent and filter spam in form submissions

HubSpot forms include automatic spam prevention to help you maintain the quality of your CRM data. When a form submission is detected as spam, it's separated from legitimate submissions and listed on the spam submissions index page, where you can manage spam without affecting your contacts. Learn how to manage spam submissions.

To further verify form submissions and increase spam detection:

• Turn on CAPTCHA to prevent bot form submissions.
• Use gibberish detection (BETA) to mark form submissions containing gibberish as spam. 
• Block specific email domains or free email providers from submitting your forms. 

Form validation and automatic spam detection 

When a visitor enters their email address into a form’s default email field, the formatting is checked right away. If the email address isn't properly formatted, or if the email has been globally bounced, the visitor can't submit the form.

Once a form is submitted, the submission is scanned for spam content. A form submission is marked as spam in the following cases:

• First and last name: an HTML tag or URL is included in the submission's first or last name fields. 
• Site domain: an embedded form ‌submitted from any external page has not been added to your tracked site domains. Learn more about adding external site domains to HubSpot. 
• Excluded IP address or referrer domain: a form is submitted from an IP address or referrer domain that your account has excluded from site analytics. This form submission setting is turned on by default. To turn this setting off, learn how to manage your form submission settings for excluded traffic sources.
  

New contacts are not created from spam form submissions. Learn more about what happens when a form submission is marked as spam. 

Verify form submissions with CAPTCHA

Turn on CAPTCHA to add a verification step that helps ensure submissions are made by people, not bots. HubSpot forms use Google’s invisible reCAPTCHA v2. If Google considers a visitor suspicious, the visitor must solve a CAPTCHA challenge before submitting the form.

Please note: if CAPTCHA has been turned on in the form, form submissions from the Submit data for a form API or other form integrations will not be accepted. 

Turn on CAPTCHA in the updated form editor

1. In your HubSpot account, navigate to Marketing > Forms.

2. Create a new form or hover over an existing form and click Edit.

3. In the top left, click the + add icon.

4. In the left panel, click Other.

5. Under the Security & Privacy section, click and drag reCAPTCHA onto the form preview on the right to include this element on your form.

6. In the top right, click Review and update.

Turn on CAPTCHA in the legacy form editor

1. In your HubSpot account, navigate to Marketing > Forms.
2. Hover over a form and click Edit. 
3. In the left panel, on the Existing properties tab, click to expand the Other form elements section.
4. Toggle the CAPTCHA (spam prevention) switch on.
5. In the top right, click Update or Publish. 

Mark form submissions from excluded traffic sources as spam

If you exclude specific IP addresses or referrer domains in your site analytics, any form submissions that come from those sources are excluded from your form analytics by default. In your form submission settings, set whether the form submissions are also marked as spam. 

To manage this setting across your forms: 

1. In your HubSpot account, click the settings icon in the top navigation bar.

2. In the left sidebar menu, navigate to Marketing > Forms.
3. Click the Submissions Settings tab.
4. Toggle the Mark form submissions from excluded IP/referrers as spam switch on or off. This setting is turned on by default. 
   • When this setting is turned on, form submissions from excluded IP addresses or referrer domains are marked as spam.
   • When this setting is turned off, form submissions from excluded IP addresses or referrer domains are captured as regular form submissions, but no analytics are recorded. 

Please note: form submissions originating from excluded IP addresses or referrer domains are not recorded in your traffic analytics.

Mark form submissions containing gibberish as spam

Please note: to access this feature, your Super Admin can opt your account into the Improved AI-powered Gibberish detection for form submissions beta.

Use AI-powered gibberish detection to filter form submissions containing a random series of characters. If gibberish is detected in text fields, except Sensitive Data fields, the submission is marked as spam. 

Gibberish detection is turned on by default when you opt in to the Improved AI-powered Gibberish detection for form submissions beta.

To manage this setting across your forms: 

1. In your HubSpot account, click the settings icon in the top navigation bar.

2. In the left sidebar menu, navigate to Marketing > Forms.
3. Click the Submissions Settings tab.
4. Toggle the Gibberish detection switch on or off. 
   • Once this setting is turned on, new form submissions are analyzed for gibberish.
     
   • Existing form submissions aren't retroactively analyzed.

Manage gibberish detection for custom properties

By default, single-line and multi-line text properties are included in gibberish detection, except for Sensitive Data properties. If you’re using custom properties in your form, you can customize whether the property is included or excluded in gibberish detection.

To manage gibberish detection for a custom property:

1. In your HubSpot account, click the settings icon in the top navigation bar.
   
2. In the left sidebar menu, under Data Management, navigate to Properties.
3. Click the Select an object dropdown menu, then select [Object] properties to edit a property for that object.
4. Click the name of the custom property you want to edit.
5. In the left sidebar menu, click the Rules tab.
6. In the Visibility options section, select or clear the Include property in Gibberish detection for form submissions checkbox.
• Once this setting is turned on, any new form submissions using this property are analyzed for gibberish.
• Existing form submissions aren't retroactively analyzed.
7. In the top right, click Save.

Block specific email domains or free email providers 

Block specific email domains or free email providers to encourage your visitors to submit high-quality business email addresses. These settings are configured on an individual form level. Learn more about blocking email domains in your form.