Phone verification for HubSpot forms on a site that runs Google Tag Manager.
When a visitor submits a protected HubSpot form on a site that runs Google Tag Manager, FormVerify sends a one-time passcode (OTP) to their phone over WhatsApp or SMS. The form only reaches HubSpot once they enter it, so the leads your sales team gets have phone numbers that work.
Works with HubSpot’s legacy form editor
FormVerify protects HubSpot forms built in the legacy (classic) form editor and embedded with HubSpot’s embed code. On sites HubSpot doesn’t host, forms from the new editor load inside a HubSpot frame that FormVerify can’t reach. Forms your website builder makes itself aren’t covered either.
Set up on Google Tag Manager
About ten minutes, and your HubSpot form stays as it is.
- 1
Embed your HubSpot form
Your HubSpot form stays embedded the way it is now. Google Tag Manager only loads FormVerify.
- 2
Add FormVerify to Google Tag Manager
Copy one snippet from FormVerify and load it on every page. The Google Tag Manager guide shows exactly where.
- 3
Protect the form
In FormVerify, switch protection on for the form and pick the field that holds the phone number.
WhatsApp or SMS, from your own accounts
Every plan includes both. hubglo adds no markup to messages; plans start at $69/mo.
- Sent from your own WhatsApp Business number, connected through Meta in a few clicks
- FormVerify creates the OTP message template for Meta to approve
- Meta bills you per OTP delivered, at its rate for the visitor’s country
SMS
- Sent through your own Twilio account, to any mobile number
- Twilio bills you at its normal rates
- Connect it alongside WhatsApp and numbers not on WhatsApp get the OTP by SMS
Not sure which to use? WhatsApp OTP vs SMS compares cost, delivery and fraud risk.
Google Tag Manager gotchas
- Fire the tag on All Pages (a Page View trigger), not Window Loaded or a timer. FormVerify doesn’t need to load before HubSpot’s embed, but it must be running before a visitor can submit.
- If the tag waits for cookie consent, forms submitted before the visitor consents go through unchecked. Weigh that when you set the tag’s consent requirements.
What it doesn’t do
FormVerify checks submissions in the visitor’s browser. It isn’t a server-side firewall, and someone posting directly to HubSpot’s form endpoint can skip it. Verified contacts can be marked in HubSpot, so anything that skipped the check is easy to filter out.
Other platforms: WordPress · Webflow · Shopify · Squarespace
Protect the HubSpot forms on a site that runs Google Tag Manager.
14 days free, no credit card. Try it on a real form before you pay.
Start free trial