The short answer
HubSpot’s built-in tools, such as reCAPTCHA and blocking free email domains, filter out obvious spam. To catch fake leads that look real, add ClickCease Lead Shield. It checks every HubSpot form submission on the visitor’s behavior plus email and phone validation, then writes a Malicious, Suspicious or Benign verdict and a recommended action to the contact, so you can filter, route and report on real leads only.
TL;DR
- ClickCease Lead Shield protects standard HubSpot forms by connecting a CHEQ app to your HubSpot account. Setup takes a few minutes in Lead Shield → Form Management.
- Every protected submission gets a verdict (Malicious, Suspicious or Benign) and a recommended action (Deny, Challenge or Accept), written to the contact as cq_ properties you can filter and report on.
- It works alongside HubSpot’s own spam filters: they stop obvious junk, Lead Shield scores what gets through.
- Start in Monitoring Mode to review verdicts in ClickCease before anything is written to HubSpot.
- Lead Shield is included in every ClickCease plan, with no upgrade needed; protected submissions count toward your plan’s usage.
For many B2B teams, HubSpot is where lead generation ends up: the forms, the contacts, the workflows and the sales handoff. That also makes it where fake leads do the most damage. A bot fills in a demo request, a throwaway email lands in a nurture sequence, a sales rep calls a number that doesn’t connect, and your reports count all of it as pipeline.
This guide covers what HubSpot already does to stop form spam, where those filters stop, and how to add ClickCease Lead Shield so every HubSpot form submission carries a verdict you can act on. For the bigger picture across every platform, see our guide to fake leads.
What does HubSpot already do to stop form spam?
HubSpot includes several spam controls for its forms, and they’re worth turning on. According to HubSpot’s knowledge base, you can:
- Turn on CAPTCHA. HubSpot forms use Google’s invisible reCAPTCHA v2. Visitors Google considers suspicious must solve a challenge before submitting.
- Block email domains. Block specific domains or HubSpot’s list of free email providers (Starter plans and above).
- Use gibberish detection. Flag submissions full of random characters as spam (Professional and Enterprise plans).
- Exclude known IPs and filter known bots from form analytics.
These filters are good at the obvious cases: crude bots, gibberish, and free-email addresses on B2B forms. What they don’t do is judge the submission as a whole. A bot that behaves like a person, or a real-looking business email and phone number that belong to nobody, can pass all of them. And because they work by blocking or marking spam, they don’t give you a graded signal to route borderline leads differently.
What is ClickCease Lead Shield for HubSpot?
Lead Shield is ClickCease’s form and lead fraud protection. For each protected HubSpot form submission, it combines three checks into one final risk score:
- Behavior on your site, from the ClickCease tag: whether the visitor acted like a real person or like automation.
- Email validation: whether the address entered is real and trustworthy.
- Phone validation: whether the number entered is real and trustworthy.
That score becomes a verdict and a recommended action:
Lead Shield runs on the same CHEQ enterprise engine that protects hundreds of enterprise accounts, including Fortune 500 companies. It also works on WordPress forms; if part of your lead flow runs through Gravity Forms, WPForms or Contact Form 7, see our guide to Lead Shield for WordPress.
Which HubSpot forms are covered? Lead Shield supports standard HubSpot forms. HubSpot pop-up forms and non-HubSpot forms aren’t covered by the HubSpot connection.
How do you set up Lead Shield on HubSpot?
Lead Shield is included in every ClickCease plan, with no upgrade needed; protected submissions count toward your plan’s usage. Setup takes a few minutes. The full walkthrough is in the ClickCease help center; here’s the short version:
- Open Form Management. In your ClickCease dashboard, go to Lead Shield → Form Management.
- Connect your HubSpot account. Click Add Account. The CHEQ app installs and a HubSpot authorization page opens. Sign in, choose the HubSpot account you want to protect and click Connect app. You can connect as many HubSpot accounts as you need.
- Choose which forms to protect. Protect forms one by one, or turn on automatic protection so every form is covered, including forms you add later.
- Choose what to validate. Email and phone are both validated by default. Untick either field if you only collect one.
- Save. Lead Shield starts checking submissions on the protected forms.
Good to know: connecting the CHEQ app lets Lead Shield add hidden fields to the forms you protect; they’re needed for validation and are removed if you disconnect. HubSpot may also show a warning that the app is unverified and ask you to type “I accept the risk.” That label means the app hasn’t yet completed HubSpot’s partner review; it uses HubSpot’s standard secure authorization, and you can disconnect at any time. More on the warning.
Should you start in Monitoring Mode?
Usually, yes. Monitoring Mode lets you watch Lead Shield work before it changes anything in HubSpot. Every lead is still evaluated exactly as normal, but no verdicts or fields are written back to HubSpot; you review the results in your ClickCease dashboard instead.
Use that window to shape your policy: allow or block specific email domains in Custom Settings, and switch individual detection signals on or off in Signal Management. When the results match what you’d expect, turn Monitoring Mode off and the verdicts start flowing into HubSpot.
The toggle sits at the top of the HubSpot connection section in Form Management. Monitoring Mode is set separately for HubSpot and WordPress, so you can test one while the other is already live.
Where do Lead Shield verdicts appear in HubSpot?
Lead Shield writes its results to the contact as cq_ properties. To see them, go to CRM → Contacts → Edit columns and add the ones you need:
| Property | What it holds |
|---|---|
| cq_action | The recommended action: Accept, Challenge or Deny |
| cq_email_verdict | Benign, Suspicious or Malicious, for the email entered |
| cq_phone_verdict | Benign, Suspicious or Malicious, for the phone number entered |
| cq_threat_type / cq_threat_type_name | The most severe threat detected, such as Malicious Bots, Automation Tools, Click Farm or Malicious User Input |
| cq_signals | The signals behind the verdict, so you can see why a lead was flagged |
Lead Shield also adds two technical fields, cq_req_id and cq_tag_hash, which it uses to connect each submission to the visitor’s on-site behavior. You don’t need to do anything with them. Results from every protected form, HubSpot and WordPress, also appear in the Lead Shield dashboard in ClickCease, where the Detailed View lists every Malicious and Suspicious submission. Full field definitions are in the form validation guide.
How should you use Lead Shield verdicts in HubSpot?
Because the verdict is a contact property, you can use it anywhere HubSpot lets you filter on properties. A simple starting policy:
| cq_action | What it means | What to do in HubSpot |
|---|---|---|
| Accept | Real person, real contact details | Route to sales and sequences as normal |
| Challenge | Some risk signals, the grey zone | Send to a review list or lower-priority queue before a rep invests time |
| Deny | Bot, fake identity or known bad actor | Keep out of sales handoff, sequences and pipeline reporting |
In practice, that usually means a saved contact view or list for each action, a workflow branch on cq_action if your HubSpot plan includes workflows, and a report that counts only Accept leads, so you can measure cost per qualified lead instead of raw form fills.
Lead Shield vs Bot Mitigation on HubSpot: do you need both?
Yes, because they act at different points. Bot Mitigation stops malicious bots before they reach your HubSpot forms, so automated junk never becomes a contact in your CRM. Lead Shield scores the submissions that do arrive, including people entering fake or throwaway details, and writes the verdict to the contact. Pixel Guard keeps invalid visitors from firing your conversion tags, so fake form fills don’t teach your ad campaigns to find more of the same. For how the three layers fit together, see our guide to fake leads. For the ad side of the problem, see our guides to click fraud and invalid traffic.
The engine behind Lead Shield is already battle-tested
Lead Shield brings SMBs the same fake-lead detection technology CHEQ runs for enterprise teams as CHEQ Form Guard, on the same CHEQ enterprise engine that protects hundreds of enterprise accounts, including Fortune 500 companies. In one deployment, a leading B2B SaaS company found that more than 20% of its inbound leads were fake, with reps losing roughly an hour on each one. After rolling out Form Guard:
Results from a CHEQ Form Guard enterprise deployment (customer anonymized). Lead Shield is powered by the same CHEQ engine.
Frequently asked questions
Find out how many of your HubSpot leads are real
Try ClickCease free for 7 days. Protect your Google, Meta and Microsoft Ads, block bots on your site, and score every HubSpot form submission with Lead Shield.
Start your free 7-day trial →No credit card required · Cancel anytime · 15,000+ companies protected by CHEQ
Sources: ClickCease help center: Setting Up Lead Shield for HubSpot, Form Validation and Response Process, Lead Shield Threat Types and Why does HubSpot warn me about connecting the CHEQ app? (reviewed November 2026); HubSpot Knowledge Base, Prevent and filter spam in form submissions (updated September 2026); CHEQ, Form Guard enterprise case study (customer anonymized).
