SSL and domain security in HubSpot

HubSpot automatically provisions a standard SAN SSL certificate through Google Trust Services when you connect a domain to your account. Standard SSL provisioning usually takes a few minutes, but can take up to four hours.

If you've purchased the custom SSL add-on, you can upload custom SSL certificates to HubSpot. You can also configure security settings for each connected domain, such as TLS versions and security headers.

Please note: if you encounter errors during the SSL provisioning process, learn more about troubleshooting SSL certificate errors.

Pre-provision your SSL certificate

If you're moving your existing site to HubSpot, you may want to pre-provision an SSL certificate so there's no SSL downtime. You can pre-provision an SSL certificate while connecting a domain to HubSpot.

1. During the connection process for a domain, a banner will be visible if your site has an existing SSL certificate. Click pre-provisioning and follow the instructions in the dialog box to start the provisioning process.

2. In a separate browser window or tab, sign in to your domain provider's site (e.g., GoDaddy or Namecheap).
3. On your domain provider's site, navigate to the DNS settings where you manage your DNS records.
4. Create new DNS records, according to the Pre-provision your SSL certificate dialog box in HubSpot. Copy the Host, and Required Data values.
5. When finished, click Verify in the Pre-provision your SSL certificate dialog box. It can take up to four hours for your changes to process. If you get an error when clicking Verify, wait a few minutes, then click Verify to check again.

Please note: if you're using Network Solutions, Namecheap, or GoDaddy, you do not need to copy the root domain. Your provider will add a root domain to the end of the DNS record automatically.

6. After your certificate has been successfully pre-provisioned, a confirmation banner will appear on the domain connection screen. You can then continue connecting your domain.

Set up a Domain Control Validation (DCV) record

If you see an error in your domain settings stating that "Reverse proxy domains need your action to avoid website disruption," it's recommended to add a Domain Control Validation (DCV) record to keep your SSL certificate up to date. 

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. For each domain with an Action required label, click the Actions dropdown menu and select Show DNS records.
4. In a separate browser window or tab, sign in to your domain provider's site and access your DNS records. Learn more about DNS setup for the most common providers. 
5. On your domain provider's site, navigate to the DNS settings where you manage your DNS records.
6. Create new DNS records, according to the dialog box in HubSpot. Copy the DCV record values and paste them into the new record on your domain provider's site in the DNS settings.
7. When you add a new DCV record to your DNS account, it can take up to 24 hours for the DNS changes to finish updating.

Domain security settings

You can customize the security settings for each subdomain connected to HubSpot. Security settings include your website protocol (HTTP vs. HTTPS), TLS version, and your website security headers.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.

HTTPS protocol

You can require all pages on your site to load securely over HTTPS. Once this setting is turned on, content loaded over HTTP, such as images and stylesheets, won't load on your site. Content loaded over HTTP on an HTTPS site is referred to as mixed content. Learn how to resolve mixed content errors on your page.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, select the Require HTTPS checkbox to require all pages on the domain to load securely over HTTPS instead of HTTP.
5. When finished, click Save.

TLS version

By default, HubSpot servers will accept a connection using TLS 1.0 and above. Connections attempting to use a TLS version lower than the minimum set will fail.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the TLS version dropdown menu and select an option.
5. When finished, click Save.

Security headers

You can configure your domain security and turn on security headers for each domain.

HTTP Strict Transport Security (HSTS)

You can add an extra layer of security to your website by enabling HTTP Strict Transport Security (HSTS). HSTS instructs browsers to convert all HTTP requests to HTTPS requests instead. Enabling HSTS adds the HSTS header to responses for requests made to the URLs on the subdomain. Learn more about the HSTS header.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To enable HSTS, select the HTTP Strict Transport Security (HSTS) checkbox. 
   • To edit how long browsers should remember to convert HTTP to HTTPS requests, click the Duration (max-age) dropdown menu and select a duration.
   • To include the preload directive in the domain's HSTS header, select the Enable preload checkbox. Learn more about HSTS preloading.
   • To include the HSTS header in all subdomains under the selected domain, select the Include subdomains checkbox. For example, if HSTS is turned on for www.examplewebsite.com and the Include subdomains checkbox is selected, cool.www.examplewebsite.com will also have HSTS turned on.
6. When finished, click Save.

Additional domain security settings (Content Hub only)

If you have a Content Hub Starter, Professional, or Enterprise account, you can turn on the additional security settings below.

X-Frame-Options

You can turn on the X-Frame-Options response header to show whether a browser can render a page in <frame>, <iframe>, <embed>, or <object> html tags. Learn more about the X-Frame-Options header.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To turn on X-Frame-Options, select the X-Frame-Options checkbox, then click the Directive dropdown menu to select an option:
   • To prevent pages on your domain from being loaded on any page in the above tags, select deny.
   • To allow pages on your domain to load in the above tags across your domain only, select sameorigin.
6. When finished, click Save.

X-XSS-Protection

You can turn on the X-XSS-Protection header to add a layer of security for users of older web browsers. Turning on X-XSS-Protection prevents pages from loading when cross-site scripting is detected. Learn more about the X-XSS-Protection header.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To turn on the X-XSS-Protection header, select the X-XSS-Protection checkbox, then click the XSS setting dropdown menu and select an option:
   • To disable XSS filtering, select 0.
   • To remove unsafe parts of a page when a cross-site scripting attack is detected, select 1.
   • To prevent the rendering of a page if an attack is detected, select 1; mode=block.
6. When finished, click Save.

X-Content-Type-Options

You can turn on the X-Content-Type-Options header to opt pages out of MIME type sniffing. Enabling this setting tells the browser to follow the MIME types advertised in the Content-Type headers. Learn more about the X-Content-Type-Options header.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To opt pages out of MIME type sniffing, select the X-Content-Type-Options checkbox.
6. When finished, click Save.

Content-Security-Policy

You can turn on the Content-Security-Policy header to control the resources that the user agent can load on a page. This header helps to prevent cross-site scripting attacks.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To control the resource the user agent can load, select the Content-Security-Policy checkbox:
   • Enter directives in the Policy directives field.
     • To ensure full functionality on HubSpot-hosted pages, the domains and directives in the following table should be included.
     • For a list of other available directives, learn more about Mozilla's Content-Security-Policy header guide.
   • To use the Content-Security-Policy header with the web versions of marketing emails, enter unsafe-inline as a keyword described here. Otherwise, styling from the email will be blocked. 
   • To allow <script> elements to execute only if they contain a nonce attribute matching the randomly-generated header value, select the Enable nonce checkbox.
6. When finished, click Save.

Please note: HubSpot automatically generates a random value on each request for all scripts from HubSpot and all scripts hosted on HubSpot.

The following domains and directives should be included to ensure full functionality on HubSpot-hosted pages:

Content-Security-Policy-Report-Only

You can turn on the Content-Security-Policy-Report-Only header to monitor policy directives. Policy directives won't be enforced, but the effects will be monitored, which can be useful when experimenting with policies. Learn more about the Content-Security-Policy-Report-Only header.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To turn on this header, select the Content-Security-Policy-Report-Only checkbox, then enter your Policy directives.
6. To allow <script> elements to execute only if they contain a nonce attribute matching the randomly-generated header value, select the Enable nonce checkbox.
7. When finished, click Save.

Referrer-Policy

You can turn on the Referrer-Policy header to control how much referrer information should be included with requests. For a definition of the available directives, see Mozilla's Referrer-Policy guide.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To control how much referrer information should be included in requests, select the Referrer-Policy checkbox, then click the Directive dropdown menu, and select an option.
6. When finished, click Save.

Permissions-Policy

You can turn on the Permissions-Policy header to control the use of browser features on the page, including <iframe> element content.

1. In your HubSpot account, click the settings settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Actions dropdown menu and select Update domain security settings.
4. In the right side panel, click the Security headers tab.
5. To control the use of browser features, select the Permissions-Policy checkbox, then enter your Directives. For a list of directives, see Mozilla's Permissions-Policy guide.
6. When finished, click Save.