# CloudFront Reverse proxy verification

**URL:** <https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657>\
**Category:** APIs & Integrations\
**Tags:** cms-content\
**Created:** [November 14, 2025, 5:49pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657 "2025-11-14T17:49:14Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sarvani24](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@sarvani24](https://community.hubspot.com/u/sarvani24)\
**Post date:** [November 14, 2025, 5:49pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/1 "2025-11-14T17:49:14Z")

</div>

Hi,

We’re migrating an existing website to HubSpot and have set up a **reverse proxy** via **AWS CloudFront** following HubSpot’s guidance. Most of the verification checks are failing, and we’re looking for help diagnosing why the asset-related tests return 404 while other checks succeed.

Reference guide: [Reverse proxy support overview - HubSpot docs](https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-support)

**Portal ID:** [ID] (visible in the script loader URL)

The following checks are passing:

- **DCV checks** are passing.
- **Diagnostics endpoint** loads and shows headers flowing through the proxy: [http://advertising.roku.com/\_hcms/diagnostics](http://advertising.roku.com/_hcms/diagnostics)
- **Status endpoint** returns OK: [http://advertising.roku.com/\_hcms/status](http://advertising.roku.com/_hcms/status)
- **Script loader** is served for our portal: [http://advertising.roku.com/hs/scriptloader/[ID].js](http://advertising.roku.com/hs/scriptloader/%5BID%5D.js)

The following checks are failing

The asset validation test URLs return **404** :

- [https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test](https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test)
- [https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test](https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test)
- [https://advertising.roku.com/\_hcms/\_worker/headers](https://advertising.roku.com/_hcms/_worker/headers)
- [https://advertising.roku.com/hs/hs-reverse-proxy-validation-test](https://advertising.roku.com/hs/hs-reverse-proxy-validation-test) - says 403 forbidden
- [https://advertising.roku.com/cs/c/hs-reverse-proxy-validation-test](https://advertising.roku.com/cs/c/hs-reverse-proxy-validation-test) - says invalid click tracking URL

I reviewed the troubleshooting steps in HubSpot’s reverse proxy documentation, and our configuration appears to align with the guidance. [Reverse proxy support overview - HubSpot docs](https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-support#troubleshooting)

- From the diagnostics endpoint, we can see proxy-related headers present and trusted, e.g., X-HubSpot-Trust-Forwarded-For: true, x-hs-public-host: [advertising.roku.com](http://advertising.roku.com), and the request ultimately reaching Host: [api-na2.hubspot.com](http://api-na2.hubspot.com). [http://advertising.roku.com/\_hcms/diagnostics](http://advertising.roku.com/_hcms/diagnostics)

Could someone advise what typically causes the /hubfs and /hs-fs and static assets reverse proxy validation checks to 404 when the other checks (diagnostics, status, script loader, DCV) are passing?  
_Moderator note: The HubSpot Community is a public space. I have therefore edited your content for security & confidential reasons._

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [November 17, 2025, 8:08am UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/2 "2025-11-17T08:08:28Z")

</div>

Hi @sarvani24 and welcome 🎊, we are so glad to have you here!  
Great question, thanks for asking the HubSpot Community!  
I’d love to put you in touch with our Top Experts: Hi @Anton, [@sylvain\_tirreau](https://community.hubspot.com/t5/user/viewprofilepage/user-id/601366) and @Teun do you have suggestions to help @sarvani24, please?  
Have a wonderful day and thanks so much!  
Bérangère

---

<div class="post-metadata">

**Author:** ![sarvani24](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@sarvani24](https://community.hubspot.com/u/sarvani24)\
**Post date:** [November 18, 2025, 5:22pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/3 "2025-11-18T17:22:24Z")

</div>

Thanks Bérangère,

I’ve added the hsverify TXT record to our DNS, in addition to the records listed in Verify Reverse Proxy. I now see that the domain says, “Connected through reverse proxy” and the status check at [/\_hcms/status](http://advertising.roku.com/_hcms/status) returns OK. But the static asset validation pages ([hubfs](https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test), [hs-fs](https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test) etc.) are still resolving to 404 or File not found.

Could someone help me debug why asset validation pages says 404 Not Found.

Thank you!

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [November 21, 2025, 12:50pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/4 "2025-11-21T12:50:22Z")

</div>

Hi @sarvani24 and thanks for sharing these updates!  
For CloudFront reverse proxy with 404 errors on static assets (hubfs, hs-fs), ensure your **cache behaviors** explicitly allow these paths: /\_hcms/\*, /hs/\*, /hubfs/\*, /hs-fs/hubfs/\*, /hs-fs/\*, /cs/c/\*, and /e3t/\*.  
Note that hs-fs/hubfs/\* was added on December 2024.

- In CloudFront **Behaviors** tab, create separate behaviors for each required path pattern  
- Set each behavior’s origin to your HubSpot origin (e.g., [123456.sites-proxy.hscoscdn00.net](http://123456.sites-proxy.hscoscdn00.net))  
- Verify your **Origin Request Policy** forwards cookies, query parameters, and headers (especially User-Agent)  
- Check https://[yourDomain]/\_hcms/diagnostics to confirm configuration  
The 404s likely mean CloudFront isn’t routing those specific asset paths to HubSpot’s origin.  
Here is the documentation for reference:  
- [Use a reverse proxy with HubSpot](https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-support)  
- [CDN path for static assets (CSS & JavaScript) changing](https://developers.hubspot.com/changelog/cdn-path-for-static-assets-css-javascript-changing)  
I hope this helps!  
Bérangère  
_This post was created with the assistance of AI tools._

---

<div class="post-metadata">

**Author:** ![sarvani24](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@sarvani24](https://community.hubspot.com/u/sarvani24)\
**Post date:** [November 21, 2025, 9:41pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/5 "2025-11-21T21:41:22Z")

</div>

Thank you BérangèreL for the response, I checked all the points mentioned above and they looks right to me. Our /\_hcms/diagnostics is returning 200 with all the details correctly including user-agent.

Please check the screenshots of the CloudFront setup attached. Let me know if you want me to share the diagnostics results in here as well.

Thank you!

 ![Screenshot 2025-11-21 at 1.30.10 PM.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/0/f/0f27262df33d55f551ea46fe30e40300de444342.png)  
CloudFront behaviors  
 ![Screenshot 2025-11-21 at 1.29.32 PM.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/a/f/af3e9fe2c91ed0d8a197ea28f31cfa9eafbdbfd5.png)  
CloudFront request origin  
 ![Screenshot 2025-11-21 at 1.36.53 PM.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/7/c/7cc7672ec95053df19c46e0872d2d2f01dbd2d87.png)  
/\_hcms/diagnostics result

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [November 25, 2025, 5:30pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/6 "2025-11-25T17:30:23Z")

</div>

Hi @sarvani24 and thanks for sharing this additional information!  
if your /\_hcms/diagnostics is returning 200 with all details correctly including user-agent, your CloudFront reverse proxy configuration appears to be working correctly.  
You should verify that diagnostics returns proper headers.  
If all checks pass, your setup is correct.  
Let us know how it goes!  
Bérangère  
_This post was created with the assistance of AI tools._

---

<div class="post-metadata">

**Author:** ![sarvani24](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@sarvani24](https://community.hubspot.com/u/sarvani24)\
**Post date:** [November 25, 2025, 7:08pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/7 "2025-11-25T19:08:09Z")

</div>

Hi BérangèreL,

The headers looks correct too, yet 5 checks out of 10 checks in the Verify reverse proxy are failing for me. Could you please check if there is any issue from HubSpot side?  
Here are the checks that are failing:  
[https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test](https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test) - 404 not found  
[https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test](https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test) - “status”:“error”,“message”:“File Not Found”  
[https://advertising.roku.com/hs/hs-reverse-proxy-validation-test](https://advertising.roku.com/hs/hs-reverse-proxy-validation-test) - going to HubSpot 404 page  
[https://advertising.roku.com/cs/c/hs-reverse-proxy-validation-test](https://advertising.roku.com/cs/c/hs-reverse-proxy-validation-test) - Invalid click tracking url  
[https://advertising.roku.com/e3t/hs-reverse-proxy-validation-test](https://advertising.roku.com/e3t/hs-reverse-proxy-validation-test) - 404 That page is nowhere to be found

Could you please advise how to fix these checks?  
Thank you!

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [November 26, 2025, 3:28pm UTC](https://community.hubspot.com/t/cloudfront-reverse-proxy-verification/142657/8 "2025-11-26T15:28:01Z")

</div>

Hi @sarvani24 and thanks for getting back to us!  
[Based on the reverse proxy documentation](https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-support), the failing checks you’re seeing are expected validation tests.  
According to the reverse proxy support guide, these specific paths (/hubfs/\*, /hs-fs/\*, /cs/c/\*, /e3t/\*) must be configured to proxy to HubSpot for assets to load properly.

The 404 errors you’re seeing are not issues from HubSpot’s side, they’re validation tests checking if your reverse proxy is correctly forwarding these paths.  
You can please try the following steps:

- Ensure your reverse proxy configuration allows **all** of these paths: /\_hcms/\*, /hs/\*, /hubfs/\*, /hs-fs/hubfs/\*, /hs-fs/\*, /cs/c/\*, and /e3t/\*  
- Verify your proxy forwards all request/response headers and query strings as-is  
- Visit **https://[yourFullDomain]/\_hcms/\_worker/headers** to view all headers HubSpot receives from your proxy and confirm proper configuration.  
Thanks!  
Bérangère  
_This post was created with the assistance of AI tools._