Form spam protection is the set of HubSpot form settings, such as CAPTCHA and email validation rules, that block automated or junk submissions before they create contacts, trigger workflows or send notifications.
Public forms attract bots. Without protection, a single form can create thousands of fake contacts in a day, each one with a made-up email address and sometimes links or scripts in the text fields. HubSpot forms offer a CAPTCHA option and settings that can block free email domains or specific addresses, depending on the form type and your subscription.
Spam submissions do damage well beyond the form. They create contacts that may count as marketing contacts, enroll in nurture workflows, receive emails and bounce, and fill sales queues with leads that waste reps’ time. Bounces from fake addresses hurt sending reputation. And cleaning thousands of junk contacts out of a portal takes far longer than preventing them.
Protection has a cost too. Strict CAPTCHA can frustrate real visitors, and blocking free email domains is wrong for businesses that sell to consumers or small companies. The right setup depends on who fills in the form: a demo request form for enterprise buyers can be strict, a newsletter form for consumers usually cannot.
Turn on CAPTCHA for every public form unless you have a reason not to, watch for sudden spikes in submissions, and keep a segment of contacts created by each form so you can spot and remove a bot wave quickly.
Summit Ridge Outdoor, a fictional retailer, found 12,000 new contacts in a weekend, all from its newsletter form and all with random addresses. Its welcome workflow had already emailed them, and the bounce rate spiked. The team enabled CAPTCHA on every form, deleted the junk contacts, and added an alert for any day with unusual form volume.
Yes. HubSpot forms include a CAPTCHA option in the form settings. Availability and configuration can vary by form type, so check each public form.
Build a segment that isolates them, for example by create date, source form and suspicious email patterns, review it carefully, and then delete in bulk. Fix the form first so new spam does not arrive while you clean up.
Ancil connects to HubSpot read-only in about 60 seconds. Nothing changes in your portal without your approval.