Support has been getting a lot of questions about the recent email communication about the upcoming requirement that you’ll only be able to accept forms from a domain registered in HubSpot and how to add trusted domains for external sites containing your forms.
This further clarifies what that means and if you need to take action:
Starting May 16, 2024, you will only be able to receive form submissions from forms on pages with HubSpot system domains, a connected custom domain, or that are added as trusted domains in your advanced tracking settings as additional sites you own and want to be tracked in HubSpot.
What this means and when you need to take action:
That means that if an external site is not registered as an additional trusted domain in your tracking settings, it will be considered spam.
How to add a trusted domain to your advanced tracking settings:
Settings > Tracking and Analytics > Tracking Code > Advanced Tracking > Additional Site Domains. You’ll add trusted domains there. Learn more here.
What domains should be added as “trusted domains”?
Any external domains that you are embedding HubSpot forms or non-HubSpot forms on that aren’t already added to the Additional Domains in your tracking settings. If you are using a HubSpot form on a page created in HubSpot or a non-HubSpot form on a HubSpot page, then you shouldn’t need to take action.
What if a form submission goes to spam that shouldn’t have?
You would be able to manage in the spam tool and bulk release submissions if needed once you’ve added the trusted domain: Manage spam form submissions on the spam submissions index page
Why are these steps necessary?
This adds an additional layer of security to prevent rare instances where a bad actor manipulates your form to display on an unaffiliated domain. It would protect your HubSpot users from potential phishing attempts via forms submitted from an external site that is not a trusted domain.
Will HubSpot send notifications about spam submissions?Users would only receive notifications for form submissions that don’t go to spam if they have that set up in their individual notifications settings and are included in the form’s notification settings.
Is there a way to bulk-add trusted domains?
There is not currently accommodated, so you would need to add them individually.
Does that mean adding all email domains of form submitters?
This doesn’t pertain to the contact’s email domain submitted in the Email property, so no need to do that!
UPDATE: Does this apply to integrations and the Forms API?
No, not if the form integration has a direct connection in HubSpot syncing information via the Forms API.
The forms spam tool will only apply to non-HubSpot forms or HubSpot forms added to external sites. In those scenarios, the external page the form is on would need to be registered as a trusted domain under the Additional Domains in the Advanced tracking settings. That’s because HubSpot verifies the tracking code on the page contacts fill out forms on.
UPDATE: What about if you’re using the forms API for a form that’s an embedded form and auto-filling via API?
In that case, yes you should register the site URL if you’re using API for a form embedded as a non-HubSpot form on an external site tracked by HubSpot.
