A bot finds your demo form on a Friday night and submits it four thousand times. By Monday, HubSpot has four thousand new contacts, and on Marketing Hub Professional that can mean a higher bill every month until your contract renews.
This post covers how HubSpot bills marketing contacts, the free setting that keeps form spam off that bill, and why that setting alone isn't the whole answer.
How HubSpot bills marketing contacts
Marketing Hub charges for marketing contacts, the contacts you can send marketing email and ads to. Non-marketing contacts are free. Each edition includes a number of marketing contacts and sells more in fixed bands. From HubSpot's product and services catalog, as of October 2026:
| Edition | Included | Each additional band |
|---|---|---|
| Starter | 1,000 | 1,000 contacts for $50/mo (cheaper at higher volumes) |
| Professional | 2,000 | 5,000 contacts for $250/mo (cheaper above 22,000) |
| Enterprise | 10,000 | 10,000 contacts for $100/mo (cheaper above 50,000) |
Three rules in HubSpot's billing documentation turn a spam flood into a lasting cost:
- One contact over is a full band. "If you exceed your current tier by even one marketing contact, you'll be upgraded to the next contact tier." The upgrade is automatic.
- Cleaning up waits for the update date. Setting contacts back to non-marketing takes effect on the next update date: the first of the month on yearly plans, or your renewal date each month on monthly plans.
- Tiers only go down at renewal. "Downgrades can only happen at renewal." Deleting the junk contacts doesn't lower a tier you've already been moved to.
Put together: a Professional portal sitting at 2,000 marketing contacts that takes one bot flood moves to the next band at $250 a month. On an annual contract, that band stays until renewal, even after every fake contact is gone.
Why form fills become marketing contacts
HubSpot forms set new contacts as marketing contacts by default. The per-form setting is called Set new contacts as marketing contacts, and it's on unless someone turns it off. Non-HubSpot forms that HubSpot collects have their own account-level switch, also on by default.
So every bot submission on a public form is, by default, a billable contact.
The free fix: turn the setting off
You can switch Set new contacts as marketing contacts off for any form. Open the form in Marketing > Forms, click Edit form, and find the setting in the form's settings. New contacts from that form are then created as non-marketing contacts, which don't count toward your tier and aren't billed.
For a form that only feeds sales, such as a demo request that a rep follows up by phone, this is often the right call and costs nothing. Do it today on any form where you never send marketing email to the submitter.
The catch
The setting protects the bill by making new contacts unmarketable. That trade has consequences a RevOps team should weigh before flipping it everywhere.
Real leads can't receive marketing email
Per HubSpot's documentation, marketing email only reaches marketing contacts, and that includes form follow-up emails. Turn the setting off on a gated content form and the ebook delivery email stops going out. Welcome series, nurture workflows and ad audiences built from those contacts stop working for every new lead, not just the fake ones. Sales emails, sequences and transactional email still work.
The workflow trap
Most teams who turn the setting off then add a workflow to set the leads they want back to marketing. HubSpot's Set marketing contact status workflow action does this, and the contacts "become marketable immediately" and count toward your tier.
If that workflow enrolls everyone who submits the form, a bot flood goes straight through it. The form setting did nothing, and you're back to the tier upgrade above. The workflow only helps if its enrollment criteria separate real leads from junk, and for most forms there's nothing in the submission that reliably does.
Non-marketing junk still costs money
A fake non-marketing contact is still a contact. Anything triggered by a form submission or a new contact still fires: Slack and email notifications to reps, lead rotation, sequence enrollment, tasks, dialer queues. Your conversion reporting counts the submissions. Someone still has to find the junk and delete it. The bill is protected; the pipeline isn't.
Keeping marketing contacts on, safely
The setting exists because HubSpot can't tell a real lead from a fake one at submission time. If something else can, you don't have to choose between marketing to your leads and protecting your tier.
That's what upfront verification does. FormVerify asks each visitor on a protected HubSpot form to confirm a one-time passcode sent to their phone over WhatsApp or SMS before the form submits. Bots and fake numbers can't complete it, so they never become contacts at all, marketing or otherwise. Real leads go through with marketing status intact, and your ebook email, nurture and ad audiences keep working.
Two details make this hold up:
- A verified flag in HubSpot. FormVerify can mark each verified contact with FormVerify verified = Yes. That gives the workflow trap a real enrollment criterion: keep the form setting off, and set contacts to marketing only when they're verified.
- Honest limits. FormVerify gates submissions in the visitor's browser. It isn't a server-side firewall, and someone posting directly to HubSpot's form endpoint can skip it. Those contacts never get the verified flag, so the workflow above leaves them as non-marketing and unbilled.
To put numbers on your own forms, count the junk submissions you deleted last quarter and check them against the band prices above. If you want to stop the next flood before it reaches HubSpot, FormVerify has a 14-day free trial and flat monthly pricing, with messages billed by your own provider at no markup.
For more on why HubSpot's phone field doesn't catch fake numbers, see HubSpot phone validation vs verification.