We’re reaching out about an important update to how your HubSpot account processes form submissions. Starting May 16, 2024, you’ll be able to accept form submissions from registered domains only. After this date, HubSpot will treat form submissions from unregistered domains as a potential security threat and will list them as spam in the Spam Submissions tool.What steps do you need to take?In your HubSpot account, go to Settings > Account Setup > Tracking and Analytics > Tracking Code > Advanced Tracking > Additional Site Domains. You’ll add trusted domains here.Follow the instructions in this Knowledge Base article on how to add trusted domains to your account. Form submissions will continue to process for any domains added here.
Why is HubSpot making this change?Today, bad actors have the ability to manipulate form submissions with the goal of deploying phishing attacks on HubSpot users. Accepting form submissions from registered and trusted domains only, greatly reduces this risk.Can you release form submissions marked as spam from the Spam Submissions tool?Yes. If you’ve determined a domain is trusted, add it to your account following the instructions above. You can then go into the Spam Submissions tool and release the submissions from that domain. Please note: HubSpot will automatically delete form submissions in the Spam Submissions tool after 90 days.When should you make this change?This change takes effect on May 16, 2024; however, we strongly recommend adding trusted domains to your account today. Any form submissions received from unregistered domains after this date will be listed as spam and sent to the Spam Submissions tool.If you have questions, visit the HubSpot Help Center.Best,The HubSpot Product Team
Are we expected to add tens of thousands of domains to this list? How would this factor in customers that have own their own domains?
If so, why does the Settings page read “Additional site domains.” The description text reads “We’ll count the domains listed here as part of your site. This will allow us to handle cross-domain traffic properly if you have multiple domains.”
This doesn’t align at all with the email that went out.
The email links to the Knowledge Base article, which doesn’t answer the questions raised in the email.
Hi @lexnicole , the “contact support” options can be located at the bottom right corner by clicking “Help” in-app, or for some portals, those are located at the top right corner by clicking on the question mark icon “?”. You can refer to this KB documentation to get further details on How to get Help with HubSpot
Hello team, thanks for your feedback. Currently, our team is actively working on providing clearer information to our users.
To further explain, the new form security process entails that if you utilize HubSpot forms on websites not hosted by HubSpot, it is important to register those website domains as trusted domains within HubSpot by following the provided KB documentation.
This process ensures that the form submissions from those domains are not considered spam under the new form spam feature. Essentially, this process relates to determining which domains are authorized to embed/send submissions for the HubSpot form, rather than restricting which contacts can submit the form.
I hope this explanation provides the clarification you were seeking. It would be greatly appreciated if you could mark this comment as the solution to close this thread. This way, other users in the community seeking clarification can easily find this information.
Is this change only for hubspot forms or does this process have to be followed for submissions you receive from non-hubspot forms like gravity forms as well?
Hi @IMantilla! I created a community forum post on this in case it’s helpful! https://community.hubspot.com/t5/Lead-Capture-Tools/Forms-will-need-to-be-submitted-from-pages-with-registered/m-p/924207
One question I’ve gotten a couple times that I wasn’t finding addressed in documentation is what does this mean for form integrations that are feeding into HubSpot but aren’t on an external page?
My understanding is this only applies to external pages that would need to be added as additional domains in advanced tracking settings to validate they own that page and to exclude potential manipulations of forms on other external pages a HubSpot account doesn’t own.
Does that mean users don’t need to do anything with standalone forms feeding into HubSpot from integrations that aren’t on an external page (meaning they share a direct link to the form in that app for the form, given the external form app wouldn’t be their own site)?
Thank you!
Got clarity from @IMantilla:
- “The form spam tool does not apply to integrations that have a direct connection through HubSpot to pass information via the API form.”
- “For Non-HubSpot forms or HubSpot forms added to external sites, the tool does apply. In this scenario, HubSpot verifies the tracking code on the conversion page, and the page must be designated as a trusted domain.”
I have the same question as jjanek. On the Settings page, it says that additional site domains are counted as part of your site.
Do I understand correctly that if we use Hubspot forms or non-HubSpot forms on our website pages or landing pages built in HubSpot, we don’t need to do anything in regard to this change. If we use/embed HubSpot forms on a 3rd party website, for exampe a partner, we will have to add partner’s domain to Additional domains in order to allow form submissions. In this case, is partner webiste going to be counted as a part of our website?
I have to say this was extremely poorly worded. It makes it sound like all leads converting via HS forms will be tagged as spam, requiring registering every single company domain as trusted manually (or otherwise) which just sounds insane.
Please enable email notifications when our company receives a spam submission. Without this, we have to manually check for new ones on a regular basis. In addition, on the spam submission review page, please display the page where each form was submitted so we can better understand what was requested.
