How to Stop HubSpot Spam Form Submissions and Fake Leads (2026)

To stop spam form submissions in HubSpot, turn on reCAPTCHA or honeypot bot detection on each form, block free email providers and bad domains, review the Spam Submissions index regularly, and add a screening layer for the fake leads and sales pitches HubSpot's filters miss.

If you're dealing with HubSpot spam and fake leads at volume, GoodInbound Lead Screen is a drop-in fix for HubSpot forms. It screens how every visitor fills in your form and stops automated list bombing, spam, and non-buyers sending unsolicited pitches from cluttering your pipeline, with five layers of protection:

• Rules: domains you always accept or always block.
• Behavior: how the form was filled in: typing, pasting, fill time, automation tells, and a built-in honeypot.
• Network: data centers, VPNs, proxies, Tor, and bursts from one IP or device.
• Identity: whether the email has a working inbox and isn't disposable or gibberish, and whether the phone number is real.
• Message: the whole submission read for intent, so sales pitches, recruiters, and link offers are caught.

Every submission is classified into five types (lead, review, spam, junk, and bot), and only the real leads, based on your filters, are reported to your HubSpot workflows and ad platforms. GoodInbound takes care of the entire flow end to end for you.

Use GoodInbound for free for up to 500 screened submissions a month.

Why HubSpot gets spam form submissions and fake leads

HubSpot forms get spam because they're public, easy to submit by script, and HubSpot's default checks only catch obvious signs like a URL in the name field. The junk comes from bots, agencies pitching through your demo form, and fake leads from paid campaigns; Google Ads comes up again and again in HubSpot Community threads as the source. Some arrive word for word from many addresses ("I saw your ad and am interested") with CAPTCHA already on.

Each one creates or updates a contact, can enroll it in workflows, and skews your conversion reporting. Our guide to fake leads covers why ads attract them and how they distort bidding.

Turn on HubSpot's built-in spam protection

HubSpot offers two built-in defenses on every plan: reCAPTCHA, which adds a verification step, and honeypot bot detection, which quietly traps bots with a hidden field. Use honeypot detection first because real visitors never see it.

Add reCAPTCHA to a HubSpot form

In the updated forms editor:

1. Go to Marketing → Forms and open the form.
2. Click the + icon, then Other.
3. Drag reCAPTCHA from Security & Privacy onto the form.
4. Click Review and update.

In the legacy forms editor, open the form, expand Other form elements, switch on CAPTCHA (spam prevention), and click Update or Publish.

CAPTCHA adds friction for real leads, and while it's on, HubSpot rejects submissions sent through its Submit data for a form API.

Use honeypot bot detection

HubSpot's honeypot detection adds a hidden field that bots fill in and people never see, and quarantines those submissions before they reach your CRM. It's available on every tier but only on forms built in, or migrated to, the new forms editor, so older forms need migrating first.

Honeypots stop simple bots. Automated browsers that render the page leave hidden fields empty, so they pass.

The DIY honeypot for legacy forms

If you can't migrate a form yet, the community workaround is:

1. Create a single-line text contact property, for example "Previous job title".
2. Add it to the form and set it to hidden.
3. Build an active list of contacts where that property is known.
4. Add the list as an unenrollment trigger on workflows that start from form submissions, and delete those contacts regularly.

The contacts are still created, so you're cleaning up after the fact.

Turn on gibberish detection

On Marketing Hub or Content Hub Professional and Enterprise, gibberish detection flags submissions with random strings in text fields. Manage it in Settings → Marketing → Forms → Submissions settings. It checks new submissions only, and single-line and multi-line text properties are included by default.

Review and release HubSpot spam submissions

HubSpot puts submissions it flags in a Spam Submissions index, keeps them for 90 days, then deletes them automatically. Check it every week or two so you don't lose real leads.

1. Go to Marketing → Forms.
2. Click the Spam Submissions number for a form.
3. Filter by form name, spam type, submitted date, or deletion date.
4. Release a real lead to move it to regular submissions. Releasing can create or update the contact, trigger workflows, and update the submission count.
5. Delete to remove a submission permanently. It can't be undone.

Bulk release and bulk delete are available. You need the View forms permission.

The Spam Type column tells you why HubSpot flagged each one: URL in name field, HTML in name field, blocklisted email address, malicious script, gibberish, filtered by reCAPTCHA, unregistered site domain, or excluded source.

Block free email providers and specific domains

On Marketing Hub or Content Hub Starter, Professional, or Enterprise, you can block submissions from free email providers like Gmail and Yahoo, and from specific domains you've seen spam from. Set it on the form's email field in the form editor.

This works well on B2B demo forms where a work email is a fair ask. It does nothing against bots using real company domains, and it turns away real buyers who use personal addresses, so leave it off on forms where consumers or small businesses sign up. To check a domain before blocking it, our free email domains list and disposable email checker cover the common ones.

Fix real submissions marked as spam in HubSpot

When real leads land in the spam index, check these in order:

1. Open the Spam Type column for the flagged submissions. It names the cause.
2. Unregistered site domain? List every domain and subdomain where the form is embedded, including landing page tools and staging sites, and register each one (below).
3. Excluded source? Check your excluded IPs and referrers for your office, agency, or VPN ranges (below).
4. Filtered by reCAPTCHA or gibberish? Check whether the form posts through the forms API with CAPTCHA on, or whether real answers in your language read as gibberish.
5. Release the real ones before the 90-day deletion.

The two most common causes:

Unregistered site domain

Since May 16, 2024, HubSpot only accepts form submissions from domains registered in your account. A form embedded on a domain HubSpot doesn't know is marked spam with the type Unregistered site domain. Add the domain in Settings → Account Setup → Tracking & Analytics → Tracking code → Advanced tracking → Additional site domains. There's no switch to turn the check off in the UI; HubSpot support or your customer success manager has to do it.

Excluded source

If a submission comes from an IP address or referrer you've excluded from analytics (often your own office or agency), HubSpot marks it spam with the type Excluded source. That setting, Mark form submissions from excluded IP/referrers as spam, is on by default. Turn it off in your submission settings and those submissions are captured normally, but still excluded from traffic analytics and workflow enrollment.

Stop the HubSpot fake leads and form spam that get through

HubSpot's filters look for bots and broken data, not for whether a submission is a real lead. So three kinds of junk get through: automated browsers that render the page, skip the honeypot, and come from residential IPs; sales pitches typed properly by people or AI; and click farm fills and stolen identities that pass every field check.

GoodInbound Lead Screen checks what HubSpot doesn't: how the form was filled in, the network it came from, whether the email and phone are real, and what the message says. Here's how to set it up on HubSpot forms:

1. Create a hidden property. In HubSpot, create a single-line text contact property named gi_label. Optionally add gi_reason too.

2. Add it to your forms as a hidden field. Visitors never see it.

3. Add the Lead Screen script to every page that embeds a HubSpot form:

   HTMLCopy

   1<script src="https://cdn.goodinbound.com/leadscreen.js" data-key="pk_live_your_key" async></script>

4. Route on the label in HubSpot. Build an active list where gi_label is spam, junk, or bot, use it to unenroll those contacts from nurture and sales workflows, and delete them on a schedule. Contacts labeled lead move on as normal; review can go to a person to check.

Each submission is screened in under a second. On forms HubSpot renders inside an iframe, it's screened as soon as HubSpot receives it, so the label shows in GoodInbound rather than on the contact. Either way, only accepted leads are sent to Meta and TikTok as conversions and pushed to Google Tag Manager as a goodinbound_lead event for your Google Ads tag, so HubSpot spam stops counting as ad conversions.

FAQ

How do I prevent spam form submissions from polluting HubSpot CRM data?

Screen submissions before they create contacts with GoodInbound Lead Screen, which writes a label to a hidden HubSpot property so spam stays out of workflows, lists, and reports. Also turn on honeypot bot detection or reCAPTCHA, and block free email domains on B2B forms.

Should I use reCAPTCHA or honeypot fields on HubSpot forms?

Start with HubSpot's honeypot bot detection, because real visitors never see it. Add reCAPTCHA only if bots still get through, since it adds friction and blocks submissions sent through HubSpot's forms API. Neither stops sales pitches or fake leads from real people. Screening with GoodInbound Lead Screen runs in the background, with no CAPTCHA, and catches both.

Where are spam submissions stored in HubSpot and when do they expire?

In the Spam Submissions index: go to Marketing → Forms and click a form's Spam Submissions number. HubSpot deletes spam submissions automatically after 90 days unless you release them.

Why are legitimate submissions being marked as spam in HubSpot?

Usually an unregistered site domain (the form is embedded on a domain HubSpot doesn't know) or an excluded source (the IP or referrer is on your exclusion list). Register the domain under Additional site domains, or turn off "Mark form submissions from excluded IP/referrers as spam".

How can I block Gmail and Yahoo addresses on HubSpot forms?

Use the email field's blocking options to block free email providers or specific domains. It needs Marketing Hub or Content Hub Starter, Professional, or Enterprise.

How do I stop HubSpot fake leads from training Google Ads and Meta Ads?

Stop firing ad conversions on HubSpot form submit. GoodInbound Lead Screen fires them only for screened leads, through the Meta Conversions API and a goodinbound_lead Tag Manager event for Google Ads. Set the old form-submit conversion in Google Ads to Secondary.

Does HubSpot stop sales pitches sent through forms?

No. HubSpot's filters catch bots, scripts, gibberish, and blocklisted addresses, but a sales pitch typed by a person is a valid submission. Catching pitches means reading the message, which GoodInbound Lead Screen does.