How to Stop Salesforce Web-to-Lead Spam: 7 Ways to Block Spam Leads (2026)

To stop Salesforce Web-to-Lead spam, turn on Salesforce's reCAPTCHA requirement, add a honeypot field backed by a validation rule, reject obvious junk with more validation rules, quarantine suspicious leads with a Flow, and screen submissions before they reach Salesforce at all.

If you're dealing with Web-to-Lead spam at volume, GoodInbound Lead Screen is a drop-in fix that works before Salesforce sees the submission. It screens how every visitor fills in your form and stops automated list bombing, spam, and non-buyers sending unsolicited pitches from cluttering your pipeline, with five layers of protection:

• Rules: domains you always accept or always block.
• Behavior: how the form was filled in: typing, pasting, fill time, automation tells, and a built-in honeypot.
• Network: data centers, VPNs, proxies, Tor, and bursts from one IP or device.
• Identity: whether the email has a working inbox and isn't disposable or gibberish, and whether the phone number is real.
• Message: the whole submission read for intent, so sales pitches, recruiters, and link offers are caught.

Every submission is classified into five types (lead, review, spam, junk, and bot), and only the real leads, based on your filters, are reported to Salesforce. GoodInbound takes care of the entire flow end to end for you.

Use GoodInbound for free for up to 500 screened submissions a month.

Why Salesforce Web-to-Lead gets so much spam

Salesforce's Web-to-Lead tool generates a block of HTML that posts form fields directly to Salesforce. That makes it quick to set up and easy to abuse:

• The endpoint and your org ID are in the page source. Anyone, or any script, can post to it without loading your site.
• There's no spam filtering beyond an optional reCAPTCHA.
• There's no duplicate handling. Every submission is a new lead.
• Spam uses up your limit. Web-to-Lead accepts up to 500 leads in 24 hours. Past that, new submissions wait in a pending queue, so a spam wave can delay real leads.

The fixes below run from built-in settings to screening every submission before Salesforce sees it. Our guide to fake leads covers why paid campaigns make the problem worse.

1. Turn on reCAPTCHA for Web-to-Lead

Salesforce can require a reCAPTCHA check on Web-to-Lead submissions:

1. Get a reCAPTCHA v2 ("I'm not a robot" checkbox) key pair from the Google reCAPTCHA admin console for your domain.
2. In Salesforce Setup, search for Web-to-Lead and click Create Web-to-Lead Form.
3. Tick Include reCAPTCHA in HTML, choose your API key pair, and regenerate the form HTML.
4. Replace the old form on your site with the new HTML.
5. In Web-to-Lead Settings, turn on Require reCAPTCHA Verification, so submissions without a valid token are rejected.

Step 5 matters most: without it, bots post straight to the endpoint and skip the checkbox. reCAPTCHA adds friction for real leads and modern bots get past it, so treat it as the first layer, not the last. See why reCAPTCHA isn't stopping spam.

2. Add a honeypot field with a validation rule

A honeypot is a field people can't see and bots fill in. In Salesforce, back it with a validation rule so filled-in submissions are rejected instead of created:

1. Create a custom text field on Lead, for example Website_Confirm__c, and don't add it to page layouts.

2. Find its field ID (it starts with 00N) in the field's detail page or the generated Web-to-Lead HTML.

3. Add it to your form, hidden from people but present for bots:

   HTMLCopy

   1<div style="position:absolute;left:-9999px" aria-hidden="true">

   2 <label for="00N000000000000">Leave this empty</label>

   3 <input id="00N000000000000" name="00N000000000000" type="text" tabindex="-1" autocomplete="off">

   4</div>

4. Add a validation rule on Lead: NOT(ISBLANK(Website_Confirm__c)), with an error message.

Validation rules run on Web-to-Lead, so the lead isn't created; Salesforce emails the default lead creator about the failure, which you can filter. Use an off-screen position rather than display:none, since some bots skip fields hidden that way. Bots that render the page in a real browser leave the field empty and pass.

3. Put Turnstile or reCAPTCHA v3 in front of the endpoint

Cloudflare Turnstile and reCAPTCHA v3 run without a puzzle, but Salesforce's Web-to-Lead endpoint can't verify their tokens. To use them:

1. Point your form at a small server function (a Cloudflare Worker, a Vercel or Netlify function) instead of Salesforce.
2. Verify the Turnstile or reCAPTCHA v3 token there, and reject low scores.
3. Forward valid submissions to the Web-to-Lead endpoint, or create the lead through the Salesforce API.

This also hides your org ID from the page source, which stops bots posting directly. It's more work to maintain, and like any CAPTCHA, it does nothing about people. Our Turnstile vs. reCAPTCHA guide compares the two.

4. Reject obvious junk with validation rules

Validation rules can block patterns your spam keeps repeating:

• URLs in name fields: OR(CONTAINS(FirstName, "http"), CONTAINS(LastName, "http"))
• Free or disposable email domains on B2B forms: CONTAINS(Email, "@mailinator.") and similar, or a check against a short list of domains you see in spam
• Gibberish: company names with no vowels or one repeated character, using REGEX()
• Missing context: a required description field under a minimum length

Keep rules narrow and test them, since a rejected Web-to-Lead submission is lost. Our disposable email domains list and free email domains list are good starting points.

5. Quarantine suspicious leads with a Flow

Instead of deleting, flag and park suspicious leads where sales won't see them:

1. Create a lead queue called Spam review and a Lead Status value Spam.
2. Build a record-triggered Flow on Lead, after create, filtered to Lead Source = Web.
3. Add decision criteria for what spam looks like in your org: free email on a B2B form, blank company, a country you don't sell to, keywords like "SEO" or "guest post" in the description.
4. When it matches, set Status to Spam and the owner to the Spam review queue, so assignment rules and alerts don't fire on it.
5. Add a scheduled Flow that deletes Spam leads older than 30 days.

This keeps false positives recoverable. It still creates the record, uses your daily limit, and can trigger anything that runs before the Flow.

6. Stop duplicate leads

Web-to-Lead has no duplicate handling. Salesforce's duplicate rules and matching rules can flag leads that match existing leads or contacts by email, phone, or name, and duplicate record sets show you what to merge. AppExchange tools such as DupeCatcher and DupeBlocker 3 go further and stop duplicates as they come in; DupeBlocker 3 costs $5,000 a year. Repeated submissions from one person are also a strong spam signal, which the next fix uses.

7. Screen submissions before they reach Salesforce

Every fix above either tests for bots or cleans up after the lead exists. Screening before Salesforce stops bots, fake leads, and pitches from becoming records at all, which is the only way to keep them out of your daily limit, your assignment rules, and your reports.

With GoodInbound Lead Screen there are two ways to do it:

Keep your Web-to-Lead form and add the script. Put this on the page with the form:

On submit, the script screens the form in under a second. Submissions labeled bot or spam can be blocked at the form, so they never reach Salesforce; everything else goes through as normal. Each submission's label and reason are kept in GoodInbound.

Or send submissions through GoodInbound first. Point the form at a GoodInbound form endpoint and add a workflow that creates the Salesforce lead through Zapier or Make, only for submissions labeled lead. Spam, junk, and bots never create records, and review waits in your GoodInbound inbox for a decision.

Either way, Lead Screen checks what Salesforce can't: how the form was filled in, the network it came from (VPNs, proxies, data centers, reused ad clicks), whether the email and phone are real, and whether the message is a sales pitch. Accepted leads can also be sent to Meta and TikTok as conversions, and to Google Ads through a Google Tag Manager event, so spam stops training your ad bidding.

Clean up Salesforce spam leads you already have

1. Build a list view of web leads matching your spam patterns: free or disposable email domains, blank company, links in the name, a burst of leads in one hour.
2. Change their status to Spam first, so reports stop counting them, and check a sample for real leads.
3. Delete in bulk with Setup → Mass Delete Records → Mass Delete Leads, or with Data Loader for larger sets.
4. Fix your reports. Exclude the Spam status from lead source and campaign reports, so attribution reflects real leads.

FAQ

How do you stop bot spam in Salesforce Web-to-Lead forms?

Turn on Require reCAPTCHA Verification in Web-to-Lead settings, add a hidden honeypot field with a validation rule that rejects filled-in submissions, and screen submissions with GoodInbound Lead Screen before they reach Salesforce. reCAPTCHA and honeypots stop simple bots; screening catches bots that behave like people, fake identities, and sales pitches.

What are the limitations of Web-to-Lead in Salesforce?

Web-to-Lead accepts up to 500 leads in 24 hours, with the rest held in a pending queue. It has no spam filter beyond optional reCAPTCHA, no duplicate handling, and its generated HTML exposes your org ID and endpoint in the page source, so bots can post to it directly.

How do I prevent duplicate and fake leads in Salesforce?

Use Salesforce duplicate and matching rules to flag duplicates, validation rules to reject obvious fakes, and a Flow to quarantine suspicious leads. To stop fake leads from being created at all, screen each submission's behavior, network, email, and phone before it reaches Salesforce, as GoodInbound Lead Screen does.

Should I replace Salesforce Web-to-Lead forms with a third-party form tool to stop spam?

You don't have to. Guides often suggest form builders like Formstack or Leadformly for better validation, but a new builder doesn't stop spam unless it screens submissions. Keep the Web-to-Lead form and add the GoodInbound Lead Screen script, or send submissions through GoodInbound, which creates the Salesforce lead only for real leads.

Does reCAPTCHA stop sales pitches in Salesforce?

No. reCAPTCHA checks whether a bot filled in the form. A sales pitch typed by a person passes. Catching pitches means reading the message, which GoodInbound Lead Screen does.