Protect your Pipeline CRM form from bots
In short: To stop spam on a Pipeline CRM web form, copy your W2LID from Settings › Other › Web-to-leads, put it into the form code from this guide, run it through the SpamKill Setup Wizard and paste the protected code on your page. SpamKill checks every submission without a CAPTCHA and real enquiries still become Pipeline leads. Forms built in Pipeline's Lead Forms builder can't be protected this way yet. It takes about 10 minutes.
Bots are filling your website form with fake leads for Pipeline CRM. Protect a Web-to-Leads form with SpamKill and real enquiries keep arriving in Pipeline as leads. One limitation to know first: this works for Pipeline's Web-to-Leads form, not for forms made in Pipeline's Lead Forms builder. Want your own fields and design? Build the form in SpamKill and pass leads to Pipeline with Zapier.
- About 10–20 min
- 2 ways to set up
- Copy and paste one snippet
Last verified on Pipeline CRM Grow trial (Web-to-Leads) with the SpamKill Setup Wizard
What changes, and what doesn't
- Enquiries still arrive in Pipeline as leads
- Lead source Web to Lead and owner assignment
- Your existing people and deals
- Every submission is checked before it reaches Pipeline
- Visitors land on your own thank-you page
- Undo it anytime by putting your old form code back
Before you start
Have these ready so nothing stops you halfway.
- A SpamKill accountNo account yet? Start a free trial.
- Access to Pipeline settingsYou need to open Settings › Other › Web-to-leads in Pipeline.
- A way to edit your page's HTMLYou'll paste HTML code, so use an HTML or code block in your site editor.
How do you want to set up your Pipeline CRM form?
Want your own fields and design without editing code? Pick the second option.
Pick the option that matches your form to see its steps.
Protect the Pipeline CRM form code
Not your setup? Choose another optionQuick setup
For returning users. Each line links to its full step.
- In Pipeline, open Settings › Other › Web-to-leads and copy the W2LID of the person who should own new leads. Step 1
- Copy the code below into a text editor. Replace YOUR_W2LID with your W2LID and put your thank-you page's address after thank_you_page. Step 2
- In the SpamKill Console, open Setup Wizard, click No to the WordPress question and paste the code. Step 3
- Click Generate Protected Code, check the email field is lead[email], then click Yes, protect my form. Step 4
- Copy the protected code, paste it where the form should go, publish the page, then click Next. Step 5
- Submit [email protected] and expect an error, then submit a real enquiry and check People. Step 6
Copy your W2LID
Where: PipelineSettingsOtherWeb-to-leads
In Pipeline, click Settings at the bottom left. Open the Other tab (1) and click Web-to-leads (2). In the table, copy the W2LID (3) of the person who should own new leads.
You should see: A short code of letters and numbers, such as 5a7b2c9d1e3f.
Several people in the table?
Pick the person who should own new leads. Pipeline's docs say a manager's W2LID shares leads among that manager's team.
Add your W2LID and thank-you page
Copy this form code into a text editor and make two changes. First, replace YOUR_W2LID with your W2LID, keeping the quotes around it. Second, set your thank-you page: put its full address, such as https://www.example.com/thank-you, between the quotes after thank_you_page. If you leave it empty, Pipeline sends visitors to your site's home page. The code has simple styling built in: labels above full-width boxes and a blue button. To match your site, change the colours and sizes in the <style> block, or delete the block and style the sk-form classes in your own CSS.
<style>
.sk-form { max-width: 480px; }
.sk-form-label { display: block; margin: 0 0 6px; font-size: 15px; font-weight: 600; line-height: 1.4; }
.sk-form-input { display: block; width: 100%; box-sizing: border-box; margin: 0 0 16px; padding: 10px 12px; border: 1px solid #c5cbd3; border-radius: 6px; background: #fff; color: #1f2937; font: inherit; font-size: 16px; line-height: 1.4; }
.sk-form-input:focus { border-color: #2563eb; outline: 2px solid #2563eb; outline-offset: 1px; }
.sk-form-textarea { min-height: 120px; resize: vertical; }
.sk-form-button { display: inline-block; padding: 12px 24px; border: 0; border-radius: 6px; background: #2563eb; color: #fff; font: inherit; font-size: 16px; font-weight: 600; cursor: pointer; }
.sk-form-button:hover { background: #1d4ed8; }
</style>
<form class="sk-form" method="post" action="https://app.pipelinecrm.com/web_lead">
<input type="hidden" name="w2lid" value="YOUR_W2LID">
<input type="hidden" name="thank_you_page" value="">
<label class="sk-form-label" for="pl_first_name">First name</label>
<input class="sk-form-input" type="text" id="pl_first_name" name="lead[first_name]">
<label class="sk-form-label" for="pl_last_name">Last name</label>
<input class="sk-form-input" type="text" id="pl_last_name" name="lead[last_name]">
<label class="sk-form-label" for="pl_company">Company</label>
<input class="sk-form-input" type="text" id="pl_company" name="lead[company_name]">
<label class="sk-form-label" for="pl_email">Email</label>
<input class="sk-form-input" type="email" id="pl_email" name="lead[email]" required>
<input type="hidden" name="note_title_1" value="Message">
<label class="sk-form-label" for="pl_message">Message</label>
<textarea class="sk-form-input sk-form-textarea" id="pl_message" name="note_1"></textarea>
<button class="sk-form-button" type="submit">Send</button>
</form>You should see: The code with your W2LID after w2lid and your thank-you page after thank_you_page.
Paste it into the Setup Wizard
Where: SpamKill ConsoleSetup Wizard
In the SpamKill Console, click Setup Wizard in the sidebar. If your site isn't on WordPress, click No under Is your website developed in WordPress?. Paste the form code with your W2LID into the box (1).
You should see: Tips under the box, then Generate Protected Code.
Generate the protected code
Where: SpamKill ConsoleSetup Wizard
Click Generate Protected Code. SpamKill asks you to check the email field: it should be lead[email] (1). Click Yes, protect my form (2).
![The Check the email field dialog with lead[email] selected and a Yes, protect my form button](https://spamkill.co/dist/images/integrations/pipeline-crm/step-4.png)
You should see: Replace the existing code with this code on your website, above your protected code.
Put the code on your page
Where: Your website editor
Copy the protected code. Open your contact page in your website editor and paste the code where the form should go, replacing any old form code. Save and publish the page. Then click Next in the wizard.
You should see: Your page shows the form with labels above the boxes and a blue Send button.
Want the form to match your site?
Change the colours and sizes in the <style> block before you run the code through the wizard, or delete the block and style the sk-form, sk-form-label, sk-form-input and sk-form-button classes in your own CSS. SpamKill keeps these classes, but renames each field's name and id.
Test it twice
Open your page in a private window. Submit the form with [email protected] (1). Then submit it again with your own details. You land on your thank-you page, and the enquiry appears under People (2) with Source set to Web to Lead (3). The message is saved as a note in its Activity Feed.
The first try shows That email address doesn't look right.
The second try appears under People with Source Web to Lead.
Back in the wizard, click Both Tests Passed.
You should see: Your thank-you page after the second try.
Your Pipeline CRM form is protected
- Bots are stopped before they reach Pipeline CRM.
- Real leads arrive exactly as before, with no extra steps for them.
- Every block is logged in your SpamKill dashboard.
Something not working?
Find what you're seeing.
Visitors land on my home page instead of a thank-you page
The thank_you_page value in the form code is empty. Put your thank-you page's full address there, run the code through the wizard again and replace the code on your page.
The form submits, but no lead appears in Pipeline
Check that w2lid holds a W2LID from Settings › Other › Web-to-leads. If it's wrong, Pipeline adds invalid_w2lid=true to the address it sends the visitor to.
A real visitor was told their email doesn't look right
SpamKill checks for missing @ symbols, extra spaces and common typos. The visitor can click Go back to the form, fix the address and send again.
I use Pipeline's Lead Forms builder
Those forms load with Pipeline's script, so the Setup Wizard can't protect them. Use the Web-to-Leads form code from step 2 in their place, or build the form in SpamKill (the second option at the top of this page).
Changed your mind? Undo in under a minute
- Open the page in your website editor.
- Delete the SpamKill code and paste your original form code back.
- Save and publish the page. Your form is back to how it was.
Build a SpamKill form for Pipeline CRM
Not your setup? Choose another optionQuick setup
For returning users. Each line links to its full step.
- In SpamKill, open Form Builder, click Create form and add your fields on the Build tab. Step 1
- On the Design tab, under Confirmation, choose Redirect to a URL and enter your thank-you page. Step 2
- In Zapier, start a Zap with Webhooks by Zapier › Catch Raw Hook. On SpamKill's Deliver tab, click Zapier, paste its URL and click Connect. Step 3
- In your Zap, add a Code by Zapier step that reads the JSON, then Pipeline CRM's Create Person action. Map the fields and turn the Zap on. Step 4
- Click Publish form, copy the code from the Embed tab and paste it where the form should appear. Step 5
Create your SpamKill form
Where: SpamKill ConsoleForm BuilderForms
In the SpamKill Console, open Form Builder and click Create form. On the Build tab, add the fields you want in Pipeline CRM, including an email field. Change colours and fonts on the Design tab.
You should see: Your form's fields on the Build tab.
Set your thank-you page
Where: Form BuilderYour formDesign
On the Design tab, find Confirmation. Choose Redirect to a URL and enter the full address of your thank-you page. To show a message instead, keep Built-in success page or choose Custom thank-you page.
You should see: Your thank-you page's address under Confirmation.
Connect a Zapier webhook
Where: Form BuilderYour formDeliver
Pipeline CRM has an app on Zapier, so use Zapier here. Create a Zap that starts with Webhooks by Zapier › Catch Raw Hook and copy its URL. In SpamKill, open your form's Deliver tab, click Zapier under Or deliver to a webhook (Zapier, Make.com, or your own), paste the URL and click Connect. Webhooks by Zapier needs a paid Zapier plan.
You should see: Zapier as the form's delivery on the Deliver tab.
Send each lead to Pipeline CRM
Catch Raw Hook passes each lead as unparsed JSON, so add a Code by Zapier step that reads it: each field arrives under a key named after its label, such as email. Then add Pipeline CRM's Create Person action, map the email and any other fields, and turn the Zap on.
You should see: Your test submission as a new person in Pipeline CRM.
Publish and add it to your page
Where: Form BuilderYour formEmbed
On the Deliver tab, click Publish form. On the Embed tab, click Copy, then paste the code on your page where the form should appear, replacing any old form code. Publish the page and submit the form once with your own details.
You land on your thank-you page.
Your test appears as a new person.
You should see: Your thank-you page after you submit.
Your Pipeline CRM form is protected
- Bots are stopped before they reach Pipeline CRM.
- Real leads arrive exactly as before, with no extra steps for them.
- Every block is logged in your SpamKill dashboard.
Something not working?
Find what you're seeing.
Leads show in SpamKill but not in Pipeline CRM
Check that your Zap is turned on, then open its history and look for an error on the Pipeline CRM step. Most often a field isn't mapped, or the email field is empty.
A real visitor was told their email doesn't look right
SpamKill checks for missing @ symbols, extra spaces and common typos. The visitor can click Go back to the form, fix the address and send again.
Changed your mind? Undo in under a minute
- Open the page in your website editor.
- Delete the SpamKill code and paste your original form code back.
- Save and publish the page. Your form is back to how it was.
- Optional: turn off the Zap.
Thanks! Glad your form is protected.
Sorry about that. Tell us which step tripped you up and we'll fix the guide.
Stuck? We'll set it up with you.
Free setup help for every plan. Send us a message and we'll walk through your Pipeline CRM form with you.
Get setup help