Seatext library / BotRefund evidence
How to Prevent Bot Traffic from Skewing HubSpot Conversion Rates and Attribution
Bot traffic inflates HubSpot conversion metrics by triggering form submissions and conversion events that never come from real prospects. The fix requires filtering before data enters HubSpot, tagging suspicious sessions with custom properties, building...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Bot traffic skews HubSpot conversion rates when automated scripts submit forms, click buttons, or trigger conversion pixels that HubSpot records as legitimate leads. The result: inflated conversion counts, poisoned attribution models, and sales teams wasting time on fake contacts. HubSpot's built-in bot filtering excludes known crawlers from website analytics, but it does not stop sophisticated bots that mimic human behavior on your landing pages and still fire conversion events.
To protect your conversion metrics, you need a layer that evaluates visitor behavior before the conversion event reaches HubSpot. That means client-side behavioral detection, custom properties to flag traffic quality, calculated properties that filter out flagged records, and dashboards that report on clean data only. The steps below walk through implementing this end-to-end.
Why HubSpot's Native Filtering Isn't Enough for Conversion Protection
HubSpot's "Exclude traffic from your site analytics" setting blocks known bots and internal IPs from the traffic analytics reports. It does not prevent a headless browser from filling a form, submitting it, and creating a contact record with a "Form Submission" conversion event attached. That contact then flows into attribution reports, lead scoring, and pipeline dashboards.
The distinction matters: analytics filtering is retrospective and IP-based. Conversion protection must be real-time and behavior-based. Bots that use residential proxies, rotate user agents, or run on real devices with automation frameworks (Puppeteer, Playwright, Selenium) bypass IP lists entirely. They leave behavioral fingerprints—superhuman input speed, missing mouse tremor, linear pointer paths, absent focus events—that only client-side telemetry can catch.
Step 1: Deploy Client-Side Behavioral Detection on Every Conversion Page
Add a lightweight script to every page that hosts a HubSpot form, meeting link, or conversion pixel. The script should capture millisecond-level interaction data: keypress timing, mouse coordinate sequences, scroll depth, focus/blur events, and hardware rendering signals. This telemetry distinguishes human sessions from automated ones.
- What to measure: Time between field focuses, keystroke intervals, mouse path curvature, presence of micro-jitter, scroll velocity variance, and whether the page was rendered in a headless context (missing Chrome APIs, inconsistent canvas fingerprints).
- Where to place it: In the page
<head>so it loads before any form interaction. It must run on the same origin as the form to access DOM events. - Output: A traffic quality score (0–100) and a categorical flag (human / suspicious / bot) written to a first-party cookie or localStorage for the session.
BotRefund's detection layer does exactly this: it monitors click behavior, pointer behavior, motion behavior, speed behavior, path behavior, engagement behavior, and session behavior to identify robotic signals like superhuman input speed (<1ms), grid-aligned movement patterns, and absence of humanlike mouse tremor.
Step 2: Push the Quality Flag into HubSpot as a Custom Property
When a form submits, read the session's quality flag and include it as a hidden field mapped to a HubSpot custom contact property (e.g., traffic_quality_score and traffic_quality_tier). This tags every contact at creation time with the behavioral evidence.
- Create two custom contact properties in HubSpot:
traffic_quality_score(number, 0–100) andtraffic_quality_tier(dropdown: Human, Suspicious, Bot). - Add hidden fields to each HubSpot form:
traffic_quality_scoreandtraffic_quality_tier. - On form submit, populate the hidden fields from the client-side cookie/localStorage before the payload leaves the browser.
Now every contact carries a quality label. The Digitopia case study showed 19% of leads flagged as fake—those records entered HubSpot with a "Bot" tier, making downstream filtering trivial.
Step 3: Build Calculated Properties That Exclude Flagged Records
HubSpot calculated properties let you derive new metrics from existing ones. Create calculated properties that only count conversions where traffic_quality_tier equals "Human".
- Clean Form Submissions:
IF(traffic_quality_tier = "Human", 1, 0)— sums only human submissions. - Clean Conversion Rate:
Clean Form Submissions / Sessions— replaces the default conversion rate in dashboards. - Clean Lead Count: Roll up the clean submission flag to the company or deal level for pipeline reports.
These calculated properties become the source of truth for marketing reports, replacing the native "Form Submissions" metric that includes bot traffic.
Step 4: Suppress Conversion Pixels for Flagged Sessions
Beyond tagging contacts, prevent the conversion pixel from firing for bot sessions entirely. This stops the ad platforms (Google Ads, Meta) from receiving conversion credit for bot activity, which otherwise trains their bidding algorithms to find more bots.
- Wrap your HubSpot form embed and any Google Ads / Meta conversion pixels in a conditional check: only fire if
traffic_quality_tier === "Human". - For HubSpot forms, use the
onFormSubmitcallback to gate the pixel fire. - For meeting links and chat widgets, apply the same gate before the conversion event is sent.
BotRefund's approach: "Suspended conversion events for headless emulator signals, ensuring marketing AI optimized for real enterprise buyers." This suppression is what lifted Digitopia's conversion rate by 22%—the denominator (sessions) stayed the same, but the numerator counted only real conversions.
Step 5: Build Dashboards That Filter by Traffic Quality
Create HubSpot dashboards that use the calculated properties from Step 3 as primary metrics. Keep the raw metrics in a separate "Raw / All Traffic" dashboard for audit purposes, but make the clean dashboard the default for stakeholders.
- Primary dashboard: Clean Conversion Rate, Clean Lead Volume, Clean Cost Per Lead (using ad spend / Clean Lead Count).
- Audit dashboard: Raw Conversion Rate, Bot % (
COUNT(traffic_quality_tier = "Bot") / Total Contacts), Suspicious %. - Attribution reports: Rebuild multi-touch attribution using only clean conversions so channel credit reflects real buyers.
Share the primary dashboard with leadership. Keep the audit dashboard for the marketing ops team to monitor bot trends over time.
Step 6: Verify the Setup with a Controlled Test
Before relying on the clean metrics, run a verification cycle:
- Submit a test form as a human—confirm
traffic_quality_tier = "Human"and the conversion pixel fires. - Run a headless browser script (Puppeteer) that fills and submits the form—confirm
traffic_quality_tier = "Bot"and the pixel does not fire. - Check the contact record in HubSpot: the bot submission should exist (for audit trail) but carry the Bot tier.
- Verify the calculated properties: Clean Form Submissions increments only for the human test.
- Confirm the clean dashboard reflects only the human submission.
Repeat this test after any major site change (new form, new landing page builder, CMS migration).
Key Facts from BotRefund's Detection and Recovery Data
| Metric | Value | Source |
|---|---|---|
| Average bot click rate on paid campaigns | 19% | S1 |
| Ad spend refunded for Digitopia | $18,200 | S1 |
| Conversion rate increase after bot suppression | +22% | S1 |
| Refund success rate for high-volume advertisers | 83% | S2 |
| Bot clicks as share of Google/Meta ad budget | Up to 20% | S2 |
| Detection signals used | Click, trap, pointer, motion, speed, path, engagement, session behavior | S2 |
| Historical refund eligibility | Google Ads spend back to 2017 | S2 |
How Behavioral Detection Differs from IP-Based Filtering
IP filtering blocks known data centers, VPN exits, and proxy ranges. It fails against:
- Residential proxy botnets (malware on home devices)
- Click farms using real phones on mobile networks
- Headless browsers running on legitimate user machines
- Competitor click fraud from office IPs
Behavioral detection evaluates how the visitor interacts, not where they come from. A session from a corporate IP that fills a form in 400ms with zero mouse movement gets flagged. A session from a flagged VPN range that scrolls, hesitates, types with natural rhythm, and shows micro-jitter passes as human. The two layers complement each other; neither alone is sufficient.
Common Mistakes That Leave Gaps
| Mistake | Why It Fails | Fix |
|---|---|---|
| Relying only on HubSpot's "Exclude bots" analytics setting | Does not stop form submissions or conversion pixels | Add client-side behavioral detection + custom properties |
| Blocking bot IPs at the firewall / WAF | Misses residential proxies and click farms; no HubSpot tag for reporting | Use behavioral tags inside HubSpot for granular filtering |
| Deleting bot contacts instead of tagging them | Loses audit trail; can't measure bot % trends | Tag with custom property, exclude via calculated properties |
| Suppressing pixels but not tagging contacts | Ad platforms see fewer conversions, but HubSpot reports stay polluted | Do both: tag in HubSpot AND gate pixel fire |
| Testing only with simple bots (curl, basic Selenium) | Advanced bots mimic human timing and mouse paths | Test against Puppeteer Stealth, Playwright with human-like profiles |
Limitations and When This Approach Doesn't Apply
- HubSpot Starter/Free tiers: Calculated properties and custom behavioral properties require Professional or Enterprise. On lower tiers, you can still tag contacts via hidden fields but must filter in external tools (Excel, BI).
- Server-side only tracking: If your conversion events fire exclusively from your backend (no browser pixel), client-side detection cannot gate the pixel. You'd need to pass the quality score to your backend and filter there.
- Single-page apps with client-side routing: The detection script must re-initialize on each virtual page view; otherwise, it misses interactions on subsequent steps.
- Forms embedded via iframe on third-party domains: Cross-origin restrictions block the parent page's detection script from accessing the iframe's DOM. Host forms on your domain or use HubSpot's native embed code.
- Historical data: This setup only affects new submissions. Past bot-contaminated data remains in reports unless you backfill quality scores (not possible without session replay).
Terminology Quick Reference
- Traffic quality score: 0–100 numeric rating derived from behavioral signals; higher = more human-like.
- Traffic quality tier: Categorical bucket (Human / Suspicious / Bot) derived from the score thresholds you set.
- Pixel suppression: Preventing a conversion pixel (Google Ads, Meta, HubSpot) from firing for flagged sessions.
- Calculated property: HubSpot formula field that derives a value from other properties on the same object.
- Headless browser: Browser running without a GUI, controlled by automation scripts (Puppeteer, Playwright, Selenium).
- Mouse tremor / micro-jitter: Involuntary sub-pixel movements in human mouse paths; absent in linear bot paths.
- FBCLID / GCLID: Click IDs appended by Meta and Google; captured for refund evidence when bots click ads.
FAQ
Does HubSpot's built-in bot filtering protect my conversion rates?
No. HubSpot's "Exclude traffic from your site analytics" only removes known bots from traffic analytics reports. It does not stop bots from submitting forms, creating contacts, or firing conversion pixels that feed attribution and lead scoring.
Can I implement this without a third-party tool?
You can build a basic version: write JavaScript that measures keystroke timing and mouse movement, sets a cookie, and populates hidden form fields. But detecting advanced headless browsers, residential proxies, and click farms reliably requires maintained fingerprinting libraries and continuous signal updates—what BotRefund provides as a service.
Will tagging bot contacts hurt my email deliverability?
No, if you exclude them from marketing lists. Create an active list: traffic_quality_tier is not equal to Bot. Use that list for all marketing emails. The tagged bot contacts sit in your database for audit but never receive sends.
How do I recover ad spend from bot clicks?
BotRefund captures click IDs (FBCLID, GCLID) for flagged sessions, compiles behavioral evidence logs, and submits refund claims to Google and Meta on your behalf. Their reported success rate is 83% for high-volume advertisers, with eligibility back to 2017 for Google Ads.
What if my forms are on a Marketo / Pardot / custom landing page, not HubSpot?
The same pattern works: detect behavior client-side, push a quality flag into your MAP/CRM via hidden fields, build calculated fields that exclude flagged records, and gate conversion pixels. The HubSpot-specific steps (custom properties, calculated properties, dashboards) translate to equivalent features in other platforms.
How often should I re-verify the detection?
After any major site change (new form builder, CMS migration, A/B test variant), and quarterly as a routine. Bot frameworks evolve; detection rules need updating. BotRefund's continuous telemetry updates handle this automatically.
Does this slow down my page load?
A well-implemented behavioral script adds ~10–30KB gzipped and runs asynchronously. BotRefund's install is "about one minute" with no credit card required for the free audit. The performance impact is negligible compared to the cost of polluted conversion data.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.