A
Acme Inc
Workflow infrastructure for ops teams
 Sign in
Live end-to-end demo

Set up protection from the original HubSpot form.

Start with Acme's public form, simulate the direct-submit path bots use, create a hidden destination form, then try the protected version on the same page.

1 Original form
Visible HubSpot form plus bot bypass simulator.
2 Setup
Create a hidden destination form.
3 Protected form
Submit through FormAegis and compare the outcomes.
1 Original HubSpot form

The public form bots already know about.

The form on this page is what humans see. The simulator shows the bot path: send data straight to HubSpot without loading the page or filling out the form.

Send us a message

Acme's existing HubSpot embed.

Bare HubSpot
Bot bypass simulator

Bots skip the form and send data to HubSpot.

The visible form is for humans. Once a bot has the HubSpot submission URL, it can skip the page form and send payloads straight to HubSpot.

HubSpot says — original form
Regular HubSpot submissions for the public source form. Direct bot posts can land here without filling the page form.
live
Connecting to HubSpot…
    2 Assisted setup

    Create the hidden destination form.

    Setup reads the original HubSpot form structure and creates a matching hidden destination. FormAegis then forwards clean submissions server-side.

    Read source
    Fields, required flags, and form configuration.
    Create destination
    A matching hidden HubSpot form.
    Route protected traffic
    This session's protected form sends through FormAegis.
    3 Protected version

    Try the same traffic through FormAegis.

    Clean submissions forward to the hidden destination. Risky submissions stay in FormAegis, where they can be reviewed and released without creating duplicates.

    Can bots still bypass after setup?

    Not through the protected path: the public page submits to FormAegis, and the hidden HubSpot destination form is only called server-side. The old public HubSpot form can still be hit directly until you retire or remove old embeds, which is intentionally opt-in because the same form ID may be used elsewhere.

    Run setup first to create the destination form and unlock this section.

    Protected Acme form

    Same fields. Submissions route through FormAegis before HubSpot.

    Protected
    Protected results
    Review FormAegis decisions first, then confirm what reached HubSpot.
    FormAegis says
    What FormAegis decided about each submission you made in this tab.
    this session
    • No submissions yet. Submit the form above to see what FormAegis does.
    Default setup

    Create a hidden destination form and route protected public traffic through FormAegis.

    Operator control

    Review held submissions in the same page and release false positives when needed.

    Optional hardening

    Retire or remove old public embeds only after checking dependencies that still rely on the original form ID.