HubSpot form spam: how to stop fake submissions and clean up the contacts

Spam on HubSpot forms often comes from bots filling in forms that have no CAPTCHA, or from people and scripts entering fake or throwaway email addresses. HubSpot already filters some of it. Anything it flags goes to the form's Spam tab and creates no contact. Fake contacts created by your forms come from submissions that passed those checks.

The first fix is reCAPTCHA on every form that's being hit. Before you change anything else, open the form's Spam tab to see what HubSpot already blocked and why, then compare it with the contacts the form created over the same days. The difference shows you which gap the spam is using.

Why spam gets through HubSpot forms

The form has no CAPTCHA

CAPTCHA is available on every HubSpot plan, as of October 2026 (preventing form spam). In the updated form editor it's a reCAPTCHA element you drag onto the form from the Other section. In the legacy editor it's the CAPTCHA (spam prevention) switch. You can choose reCAPTCHA v3, which checks visitors in the background, or v2, which shows a checkbox or an image puzzle.

One catch. With CAPTCHA on, HubSpot won't accept submissions to that form from the Forms API or other form integrations. If a developer or an app posts data into the form, talk to them before you switch it on.

The reCAPTCHA threshold is too lenient

Spam sensitivity is one account-wide number between 0.1, the least strict, and 0.9, the most strict. You'll find it on the Submissions Settings tab under Marketing > Forms in your settings. Raise it a little at a time if bots still get through, and lower it if real people start landing in spam.

Throwaway email domains aren't blocked

You can block specific email domains, or HubSpot's list of free email providers, on one form or across all forms. A visitor who enters a blocked address is asked for a different one before the form will submit. Enter only the root domain, such as example.com, with no www or @. This needs Marketing Hub or Content Hub Starter, Professional or Enterprise. Only block free providers on forms meant for business buyers, because it also turns away genuine customers with Gmail addresses.

Gibberish detection and bot filtering are off

On Marketing Hub or Content Hub Professional or Enterprise, gibberish detection marks submissions with random characters in their text fields as spam. It's a switch on the same Submissions Settings tab and only checks submissions that arrive after you turn it on. Separately, the Bot filtering switch on the Advanced Tracking tab of your tracking code settings removes known bots from your analytics (excluding traffic). HubSpot says their form submissions may also be marked as spam, depending on your submission settings.

The same sources keep sending it

If you know the IP addresses or referring sites the spam comes from, add them to the excluded lists on the same Advanced Tracking tab. With Mark form submissions from excluded IP/referrers as spam switched on, which is the default, those submissions become spam with the type Excluded source and create no contacts. Be careful with your own office IP, since staff tests from it will land in spam too. Form submissions not creating contacts covers that side.

The form isn't a HubSpot form

All of these settings apply to HubSpot forms. If the form on your site is built in your website platform and HubSpot only collects its submissions, add the spam protection to that form on the site.

How to clean up spam contacts already in HubSpot

1. Find them. Filter contacts by Create date and by First conversion or Recent conversion for the affected form, add the name and email columns so junk is easy to spot, and save the view.
2. Check that none of them has a real deal, ticket or conversation attached before you delete anything.
3. Delete them from the contacts index page, which uses the restorable delete. Anything removed by mistake can be restored within 90 days (deleting records). Deleting from an index page needs the Delete and Bulk delete permissions.
4. Leave permanent deletion alone for spam. It's meant for privacy requests and can't be undone.
5. Open the form's Spam tab and release any real submissions HubSpot caught. Releasing one can create or update the contact and trigger workflows that use form submission filters.

Spam contacts can cost you money as well. HubSpot forms set new contacts as marketing contacts by default (default marketing statuses), so fake signups can count toward your Marketing Hub contact tier. If that has already pushed you over, see over the marketing contacts limit.

How to stop it happening again

Add reCAPTCHA to every public form when you build it, apart from forms an integration posts into. Once a week, look at the Spam Submissions column on the forms list, adding it through Edit columns if it's missing, and open any form where the number jumps. The Spam type breakdown tells you which setting to tighten. Spam submissions you don't release are deleted automatically after 90 days, so review them before then.

If spam has already filled your database and you'd like help sorting real leads from fake ones, I can audit and clean it up.

Questions

Does reCAPTCHA stop all form spam?

No. It looks for bot behavior, so a person typing fake details can still get through. Domain blocking and gibberish detection cover some of what's left.

Do blocked spam submissions create contacts?

No. A submission marked as spam doesn't create or update records, trigger form automation or count in traffic analytics. It stays on the Spam tab until you release or delete it, or until it's deleted automatically after 90 days.

Why is a real lead on the Spam tab?

Check its Spam type. HubSpot names two common causes for real leads: Unregistered Site Domain, meaning the embedding site isn't in your tracked domains, and Excluded source.