# Allow response headers to be customized

**URL:** <https://community.hubspot.com/t/allow-response-headers-to-be-customized/84128>\
**Category:** HubSpot Ideas\
**Tags:** design-manager\
**Created:** [June 26, 2023, 4:17pm UTC](https://community.hubspot.com/t/allow-response-headers-to-be-customized/84128 "2023-06-26T16:17:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![icheshire](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@icheshire](https://community.hubspot.com/u/icheshire)\
**Post date:** [June 26, 2023, 4:17pm UTC](https://community.hubspot.com/t/allow-response-headers-to-be-customized/84128/1 "2023-06-26T16:17:35Z")

</div>

For developers

I’m using partytown.js, and using Atomics for significantly better performance requires setting response headers `Cross-Origin-Embedder-Policy` and `Cross-Origin-Opener-Policy`, so I need hubspot to allow customizing any response header. It’s my website on my domain, so I think I should be able to!

---

<div class="post-metadata">

**Author:** ![AMakela](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@AMakela](https://community.hubspot.com/u/AMakela)\
**Post date:** [November 5, 2024, 9:36am UTC](https://community.hubspot.com/t/allow-response-headers-to-be-customized/84128/2 "2024-11-05T09:36:31Z")

</div>

We have the issue, when referencing to WebAssembly demos. Would need to setting Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy, but this is not supported by Hubspot. There’s a list of security headers we can edit, but these are not included.

---

<div class="post-metadata">

**Author:** ![BenDonaldson](https://avatars.discourse-cdn.com/v4/letter/b/ad7895/32.png) [@BenDonaldson](https://community.hubspot.com/u/BenDonaldson)\
**Post date:** [January 2, 2026, 4:22pm UTC](https://community.hubspot.com/t/allow-response-headers-to-be-customized/84128/3 "2026-01-02T16:22:15Z")

</div>

Hi, adding to this, we’re still not able to use the Hubspot tracking code and/or chat widget for our product and company effectively, because Hubspot has no support or solution for sites with COEP/COOP enabled. This feature has been adopted by more and more sites and tools; the inability to track, and to load Hubspot chat on the site, and the lack of any response on solutions, is a dealbreaker for my employer and other million/billion dollar companies we work with.

---

<div class="post-metadata">

**Author:** ![Pixelwerx](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/pixelwerx/32/89259_2.png) [@Pixelwerx](https://community.hubspot.com/u/Pixelwerx)\
**Post date:** [April 2, 2026, 2:17pm UTC](https://community.hubspot.com/t/allow-response-headers-to-be-customized/84128/4 "2026-04-02T14:17:01Z")

</div>

HubSpot has functionality that adds preload hints to response headers when a \<link rel=“preload”\> is used in HTML \<head\>. In addition to letting us customize the response headers, they should update that automated function to add the crossorigin attribute if the preload hint is a font. When preloading fonts the crossorigin attribute needs to be added, even when the font is local.