---
title: HubSpot Domain Security Settings and Content Security Policy (CSP)
description: A practical guide to domain security and Content Security Policy (CSP) — protect any website from modern threats with clear setup examples.
image: https://webbro.cc/hubfs/blog/og-img/hs-domain-security-settings-and-csp.jpg
---

[![logo-black](https://webbro.cc/hubfs/logo-black.svg)](https://webbro.cc/)

- [Modules](https://webbro.cc/modules)
- [Themes](https://webbro.cc/themes)
- [Apps](https://webbro.cc/apps)
- [Blog](https://webbro.cc/blog)

# HubSpot Domain Security Settings and Content Security Policy (CSP)

 Published on September 7, 2025

 by Niko Yankovsky

- [HubSpot Dev](https://webbro.cc/blog/tag/hubspot-dev)
- [Security](https://webbro.cc/blog/tag/security)

Securing your website is not just about installing an SSL certificate — it’s about building multiple layers of protection that work together. From HTTPS and TLS to modern HTTP security headers like Content Security Policy (CSP), every setting contributes to protecting your visitors, your data, and your brand’s credibility. In this article, we’ll break down what each HubSpot domain security setting does, why it’s important, and how to configure them properly — even if you’re not a security expert.

## SSL Certificates: Foundation of a Secure Connection

When you connect a domain to HubSpot, the platform automatically provisions a standard SAN SSL certificate through Google Trust Services. This ensures that your site loads securely over HTTPS — encrypting data between the visitor’s browser and your server.

**Key points**:

- SSL provisioning is automatic and free.
- Certificates are renewed 30 days before expiration.
- To connect your domain, you must have a CNAME record (or A records for root domains) pointing to HubSpot’s secure servers.

If you prefer to use a custom certificate, you can purchase the Custom SSL Add-on, which allows you to upload your own certificates directly in HubSpot.

**Tip:** If your domain uses a Certification Authority Authorization (CAA) record, make sure it includes pki.goog. Otherwise, HubSpot won’t be able to provision or renew your SSL certificate.

## Pre-Provisioning and DCV Records

If you’re migrating your site to HubSpot, you can pre-provision your SSL certificate to avoid downtime. During the domain connection process, HubSpot provides DNS records you can add to your registrar before completing the setup.

### DCV (Domain Control Validation)

Sometimes HubSpot may ask you to add a DCV record. This ensures ongoing SSL validation, especially for reverse proxy domains.

**Steps:**

1. Go to **Settings → Content → Domains & URLs**.
2. Find the domain marked “Action required.”
3. Copy and add the DCV record from HubSpot to your DNS provider.
4. Wait up to 24 hours for the changes to take effect.

## Domain Security Settings in HubSpot

Once your domain is connected and secured with SSL, HubSpot allows you to customize additional domain-level security settings.

### 1. HTTPS Enforcement

Turning on **“Require HTTPS”** ensures all pages and assets load securely. Any mixed content (HTTP resources on HTTPS pages) will be blocked.

**Example:** If an image is loaded from http://example.com/image.jpg, it won’t display on a secure page. Always use https:// links.

### 2. TLS Version

HubSpot servers support TLS 1.0 and above by default. You can restrict connections to **TLS 1.2+** for stronger encryption and modern browser compatibility.

## Security Headers: The Second Line of Defense

Security headers tell browsers how to handle content and connections on your website. They prevent attacks such as cross-site scripting (XSS), clickjacking, and data injection. HubSpot allows you to enable these headers for each connected domain.

### HTTP Strict Transport Security (HSTS)

HSTS enforces HTTPS by telling browsers to automatically convert all HTTP requests into HTTPS.

**Recommended settings:**

- Duration (max-age): 31536000 (1 year)
- Enable preload
- Include subdomains

**Example Header:**

Copy

`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`

### X-Frame-Options

Protects your website from clickjacking attacks by controlling whether your pages can be loaded in <iframe> elements.

**Options:**

- deny — disallow embedding entirely.
- sameorigin — only allow iframes from your own domain.

**Example:**

Copy

`X-Frame-Options: sameorigin`

### X-XSS-Protection

Adds a basic layer of protection for older browsers by blocking pages when cross-site scripting is detected.

**Recommended setting:**

Copy

`X-XSS-Protection: 1; mode=block`

### X-Content-Type-Options

Prevents **MIME type sniffing**, which can lead to code execution vulnerabilities.

**Recommended setting:**

Copy

`X-Content-Type-Options: nosniff`

### Referrer-Policy

Controls how much referral data is sent when users navigate away from your site.

**Example:**

- strict-origin-when-cross-origin — recommended for most websites.
- no-referrer — for maximum privacy.

**Example Header:**

Copy

`Referrer-Policy: strict-origin-when-cross-origin`

### Permissions-Policy

Controls access to browser features such as camera, microphone, or geolocation.

**Example:**

Copy

`Permissions-Policy: geolocation=(self), microphone=()`

This tells the browser that only your site can request location data, and microphone access is disabled.

### Content Security Policy (CSP): The Core of Modern Web Security

A **Content Security Policy** is a powerful browser mechanism that helps prevent malicious code from executing on your site — even if an attacker injects it.

CSP defines **which content sources are trusted** for loading scripts, styles, images, frames, and other resources.

### Why CSP Matters

- Prevents **Cross-Site Scripting (XSS)** attacks.
- Blocks unauthorized scripts or iframes.
- Helps control integrations and third-party content.
- Significantly improves overall site security.

### Common CSP Directives and Meanings

| **Directive** | **Description** | **Example** |
| --- | --- | --- |
| default-src | Fallback for all other directives. | 'self' |
| script-src | Allowed sources for JavaScript. | 'self' https://js.hs-scripts.com |
| style-src | Allowed sources for CSS. | 'self' 'unsafe-inline' |
| img-src | Allowed image sources. | 'self' data: |
| frame-src | Allowed iframes or embedded content. | 'self' https://\*.hubspot.com |
| connect-src | Allowed AJAX or API calls. | 'self' https://\*.hubapi.com |

### Content-Security-Policy-Report-Only

If you’re testing your CSP configuration, enable **CSP Report-Only mode** first. This allows browsers to report policy violations without blocking content — a safe way to fine-tune your directives.

**Example:**

Copy

`Content-Security-Policy-Report-Only: script-src 'self' https://js.hs-scripts.com`

## HubSpot Plan Restrictions

Not all domain security settings in HubSpot are available to every account.  
If you have a **Content Hub Starter**, **Professional**, or **Enterprise** plan, you can enable a broader range of **security headers** to improve protection and compliance across your hosted content.

### X-Frame-Options

This header controls whether your pages can be embedded in <iframe>, <frame>, <embed>, or <object> elements. It helps prevent clickjacking attacks by restricting where your content can be displayed.

**Options:**

- deny — blocks your pages from being embedded anywhere.
- sameorigin — allows embedding only within your own domain.

**Setup:** Navigate to **Settings → Content → Domains & URLs → Actions → Update domain security settings → Security headers tab**, then select X-Frame-Options and choose the directive that best fits your needs.

### X-XSS-Protection

This header adds an extra layer of protection for users on older browsers by blocking or sanitizing pages that trigger **cross-site scripting (XSS)** detection.

**Options:**

- 0 — disables XSS filtering.
- 1 — sanitizes unsafe code if an attack is detected.
- 1; mode=block — prevents the page from loading when an XSS attack is detected.

**Setup:** Under **Security headers**, select **X-XSS-Protection**, choose a setting from the dropdown, and click **Save**.

### X-Content-Type-Options

Prevents browsers from **MIME type sniffing**, which can lead to executing unexpected or unsafe content types. Setting this header to nosniff ensures browsers only process files according to their declared MIME type.

 **Setup:** In **Security headers**, select **X-Content-Type-Options** and click **Save**.

### Content-Security-Policy (CSP)

The **Content-Security-Policy** header defines which resources (scripts, styles, images, iframes, etc.) are allowed to load on your website. This is one of the most powerful defenses against **cross-site scripting (XSS)**, **data injection**, and **content hijacking**.

**Setup:**

1. In HubSpot, go to **Settings → Content → Domains & URLs → Actions → Update domain security settings → Security headers tab**.
2. Enable **Content-Security-Policy**.
3. Add your **policy directives** (e.g., default-src 'self'; script-src 'self' https://\*.hubspot.com).
4. Optionally, enable the nonce option to allow scripts with a matching nonce value to execute safely.

**Important:** HubSpot automatically generates unique nonces for all HubSpot-hosted scripts.  
To maintain full platform functionality, include the required domains and directives in your policy.

Here’s a condensed version of the most essential domains to include:

| **Domain / Wildcard** | **Directive(s)** | **Purpose** |
| --- | --- | --- |
| \*.hubapi.com | connect-src | API requests, form submissions |
| \*.hubspot.com | script-src, img-src, connect-src, frame-src | Core HubSpot scripts and embedded tools |
| \*.hsforms.com | script-src, img-src, frame-src, connect-src, child-src | Forms and surveys |
| \*.hsadspixel.net | script-src | Ads tracking |
| \*.hs-analytics.net | script-src | Analytics tracking |
| \*.usemessages.com | script-src | Conversations and chatflows |
| \*.hubspot.net | script-src, img-src, frame-src | Static assets and hosted files |

*(For the full list, refer to [HubSpot’s documentation](https://knowledge.hubspot.com/domains-and-urls/ssl-and-domain-security-in-hubspot).)*

### Content-Security-Policy-Report-Only

Use this mode to test your CSP rules without enforcing them.  
Violations will be logged instead of blocked — ideal when experimenting with new directives.

**Setup:** Enable **Content-Security-Policy-Report-Only**, define your policy directives, and toggle the nonce option if needed.

### Referrer-Policy

Controls how much **referrer information** (the URL of the previous page) is shared with external sites. This is useful for privacy protection and analytics accuracy.

**Example directives:**

- no-referrer — sends no referrer data at all.
- same-origin — sends referrer only for same-domain requests.
- strict-origin-when-cross-origin — modern balanced option used by default in most browsers.

### Permissions-Policy

Defines which browser features and APIs can be used on your pages or embedded content — for example, access to camera, geolocation, or fullscreen mode.

**Example directive:** Select **Permissions-Policy** in your security settings and add directives according to your needs.Refer to Mozilla’s documentation for the full directive list.

### HubSpot Plan Restrictions Summary

These advanced security headers are **available only for Content Hub Starter, Professional, and Enterprise accounts**. When configured properly, they significantly reduce your exposure to attacks, ensure compliance with security standards, and give you fine-grained control over how browsers handle your content.

| **Security Header** | **Description** | **Available On** | **Key Options** |
| --- | --- | --- | --- |
| **X-Frame-Options** | Prevents your pages from being embedded in external sites (protects from clickjacking). | Content Hub Starter, Professional, Enterprise | deny, sameorigin |
| **X-XSS-Protection** | Adds protection against cross-site scripting in older browsers. | Content Hub Starter, Professional, Enterprise | 0, 1, 1; mode=block |
| **X-Content-Type-Options** | Prevents MIME type sniffing and enforces declared content types. | Content Hub Starter, Professional, Enterprise | nosniff |
| **Content-Security-Policy (CSP)** | Defines which resources (scripts, styles, images, etc.) are allowed to load. | Content Hub Starter, Professional, Enterprise | Custom directives, nonce option |
| **Content-Security-Policy-Report-Only** | Monitors CSP policy without enforcing it — useful for testing. | Content Hub Starter, Professional, Enterprise | Custom directives, nonce option |
| **Referrer-Policy** | Controls how much referrer information is shared with requests. | Content Hub Starter, Professional, Enterprise | no-referrer, same-origin, etc. |
| **Permissions-Policy** | Controls access to browser APIs and features (camera, location, etc.). | Content Hub Starter, Professional, Enterprise | Custom directives |

*Note: Basic accounts do not include advanced security header configuration.*  
*All plans, however, benefit from HubSpot’s automatic SSL provisioning and built-in security infrastructure.*

## Best Practices for Secure HubSpot Hosting

1. Always enforce HTTPS and use TLS 1.2+.
2. Enable HSTS with preload and subdomains.
3. Use strict CSP directives and test them in Report-Only mode first.
4. Avoid unsafe-inline and unsafe-eval unless absolutely necessary.
5. Review security headers regularly after adding new integrations.
6. Keep DNS and CAA records up to date for SSL renewals.

## Final Thoughts

Security is not a one-time setup — it’s an ongoing process. HubSpot gives you the tools to enforce modern web security standards without complex configuration. By properly setting SSL, enforcing HTTPS, enabling headers, and configuring a strong Content Security Policy, you can protect your visitors, data, and reputation while maintaining site performance and SEO integrity.

[Report an issue](mailto:support@webbro.cc?subject=Issue:%20HubSpot+Domain+Security+Settings+and+Content+Security+Policy+%28CSP%29&body=Page:%20https%3A%2F%2Fwebbro.cc%2Fblog%2Fhubspot-domain-security-and-csp-settings%0A%0ADescribe%20the%20issue:)

## Frequently Asked Questions

 What security headers can you configure in HubSpot CMS?

HubSpot allows configuring the following security headers per domain: HSTS (HTTP Strict Transport Security), X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Content-Security-Policy, and Content-Security-Policy-Report-Only. These are configured in Settings → Content → Domains & URLs → Actions → Update domain security settings → Security headers tab.

 What HubSpot plan is required to configure Content Security Policy?

Advanced security headers including Content Security Policy, X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options are available on Content Hub Starter, Professional, and Enterprise plans. Basic accounts receive HubSpot's automatic SSL provisioning and built-in security infrastructure but do not have access to custom security header configuration.

 Which HubSpot domains must be included in a Content Security Policy?

At minimum, a HubSpot CSP must include: \*.hubspot.com for script-src, img-src, connect-src, and frame-src (core scripts and tools); \*.hubapi.com for connect-src (API requests and form submissions); \*.hsforms.com for script-src, frame-src, and connect-src (forms and surveys); \*.hs-analytics.net for script-src (analytics); and \*.hubspot.net for script-src and img-src (static assets). Omitting any of these will break corresponding HubSpot functionality.

 How do you test a Content Security Policy without breaking a live site?

Use Content-Security-Policy-Report-Only mode. Enable it in HubSpot's domain security settings and define your policy directives. Browsers will report policy violations to the console without actually blocking any content — this lets you identify missing sources and refine your directives safely before switching to enforcement mode.

Stay in touch

## Notes on Web Development

New articles on web development, accessibility, and technical SEO.

Occasional deep dives into platform-specific topics like HubSpot CMS, based on real-world problems and solutions.

© 2026 webbro.cc

[Privacy Policy](https://webbro.cc/privacy-policy) [Terms of Service](https://webbro.cc/tos) [Data Privacy Request](https://na2.hs-data-privacy.com/request/UhG-FirgpF93gDbAxcZtxA)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Niko Yankovsky",
    "url" : "https://webbro.cc/blog/author/niko-yankovsky"
  },
  "dateModified" : "2026-06-15T17:55:10.000Z",
  "datePublished" : "2025-09-07T10:30:00.000Z",
  "headline" : "HubSpot Domain Security Settings and Content Security Policy (CSP)",
  "image" : [ "https://webbro.cc/hubfs/blog/og-img/hs-domain-security-settings-and-csp.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://webbro.cc/blog/hubspot-domain-security-and-csp-settings",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://webbro.cc/hubfs/logo-black.svg"
    }
  }
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "FAQPage",
  "mainEntity" : [ {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "HubSpot allows configuring the following security headers per domain: HSTS (HTTP Strict Transport Security), X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Content-Security-Policy, and Content-Security-Policy-Report-Only. These are configured in Settings → Content → Domains &amp; URLs → Actions → Update domain security settings → Security headers tab."
    },
    "name" : "What security headers can you configure in HubSpot CMS?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Advanced security headers including Content Security Policy, X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options are available on Content Hub Starter, Professional, and Enterprise plans. Basic accounts receive HubSpot's automatic SSL provisioning and built-in security infrastructure but do not have access to custom security header configuration."
    },
    "name" : "What HubSpot plan is required to configure Content Security Policy?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "At minimum, a HubSpot CSP must include: *.hubspot.com for script-src, img-src, connect-src, and frame-src (core scripts and tools); *.hubapi.com for connect-src (API requests and form submissions); *.hsforms.com for script-src, frame-src, and connect-src (forms and surveys); *.hs-analytics.net for script-src (analytics); and *.hubspot.net for script-src and img-src (static assets). Omitting any of these will break corresponding HubSpot functionality."
    },
    "name" : "Which HubSpot domains must be included in a Content Security Policy?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Use Content-Security-Policy-Report-Only mode. Enable it in HubSpot's domain security settings and define your policy directives. Browsers will report policy violations to the console without actually blocking any content — this lets you identify missing sources and refine your directives safely before switching to enforcement mode."
    },
    "name" : "How do you test a Content Security Policy without breaking a live site?"
  } ]
}
```