HubSpot automatically provisions a standard SAN SSL certificate through DigiCert when you connect a domain to your account. This usually takes a few minutes, but can take up to four hours.
If you've purchased the custom SSL add-on, you can upload custom SSL certificates to HubSpot. You can also configure security settings for each connected domain, such as TLS version and security headers.
Please note: if you encounter errors during the SSL provisioning process, learn more about troubleshooting SSL certificate errors.
If you're moving your existing site to HubSpot, you may want to pre-provision an SSL certificate so there's no SSL downtime. You can pre-provision an SSL certificate while connecting a domain to HubSpot.
To pre-provision an SSL certificate:
Please note: if you're using Network Solutions, Namecheap, or GoDaddy, you do not need to copy the root domain. Your provider will add a root domain to the end of the DNS record automatically.
Once your certificate has been pre-provisioned, a confirmation banner will appear in the domain connection screen. You can then continue connecting your domain.
You can customize the security settings for each subdomain connected to HubSpot. Security settings include your website protocol (HTTP vs. HTTPS), TLS version, and your website security headers.
To update a domain's security settings:
You can require all pages on your site to load securely over HTTPS. Once this is enabled, content loaded over HTTP, such as images and stylesheets, will not load on your site. Content loaded over HTTP on an HTTPS site is referred to as mixed content. Learn how to resolve mixed content errors on your page.
To turn on HTTPS protocol, select the Require HTTPS checkbox.
By default, HubSpot servers will accept a connection using TLS 1.0 and above.
To change which TLS versions are supported, click the TLS version dropdown menu and select the lowest TLS version that you want to support. Connections attempting to use a TLS version lower than the minimum set will fail.
You can configure your domain security and turn on security headers for each domain.
You can add an extra layer of security to your website by enabling HTTP Strict Transport Security (HSTS). HSTS instructs browsers to convert all HTTP requests to HTTPS requests instead. Enabling HSTS adds the HSTS header to responses for requests made to the URLs on the subdomain.
Learn more about the HSTS header.
If you have a CMS Hub account, you can enable the additional security settings below.
Enable the X-Frame-Options response header to indicate whether or not a browser can render a page in <frame>, <iframe>, <embed>, or <object> HTML tags.
To enable X-Frame-Options, select the X-Frame-Options checkbox, then select a Directive from the dropdown menu:
Learn more about the X-Frame-Options header.
Enable the X-XSS-Protection header to add a layer of security for users of older web browsers by preventing pages from loading when cross-site scripting is detected.
To enable this header, select the X-XSS-Protection checkbox, then select an XSS setting from the dropdown menu:
Learn more about the X-XSS-Protection header.
Enable the X-Content-Type-Options header to opt pages out of MIME type sniffing. Enabling this setting tells the browser to follow the MIME types advertised in the Content-Type headers.
Learn more about the X-Content-Type-Options header.
Enable the Content-Security-Policy header to control resources that the user agent can load on a page. This header helps to prevent cross-site scripting attacks.
To enable the Content-Security-Policy header, select the Content-Security-Policy checkbox, then specify your Policy directives. For a list of available directives, check out Mozilla's Content-Security-Policy header guide.
To allow <script> elements to execute only if they contain a nonce attribute matching the randomly-generated header value, select Enable nonce.
Please note: HubSpot automatically generates a random value on each request for all scripts from HubSpot and all scripts hosted on HubSpot.
The following domains should be included to ensure full functionality on HubSpot-hosted pages:
cdn2.hubspot.net
*.hubspot.com
*.hubspotusercontentxx.net (where xx can either be 00, 10, 20, 30, 40)
js.hscollectedforms.net
js.hsleadflows.net
js.hs-scripts.com
js.hsadspixel.net
js.hs-analytics.net
js.hs-banner.com
js.hs-banner.net
*.hsforms.net
*.hsforms.com
static.hsappstatic.net
js.hubspotfeedback.com
feedback.hubapi.com
js.usemessages.com
*.vidyard.com
Enable the Content-Security-Policy-Report-Only header to monitor policy directives. Policy directives will not be enforced, but the effects will be monitored, which can be useful when experimenting with policies.
To enable this header, select the Content-Security-Policy-Report-Only checkbox, then enter your Policy directives.
To allow <script> elements to execute only if they contain a nonce attribute matching the randomly-generated header value, select Enable nonce.
Learn more about the Content-Security-Policy-Report-Only header.
Enable the Referrer-Policy header to control how much referrer information should be included with requests.
To enable this header, select the Referrer-Policy checkbox, then select a Directive from the dropdown menu.
Enable the Feature-Policy header to control the use of browser features on the page, including <iframe> element content.
To enable this header, select the Feature-Policy checkbox, then enter your Directives. For a list of directives, see Mozilla's Feature-Policy guide.