“Solved” the problem after speaking to support. We were (and google was) passing an X-FRAME-OPTIONS : SAMEORIGIN header by default. We changed to X-FRAME-OPTIONS : ALLOW-FROM https://app.hubspot.com which now allows the page to load in the iframe (but does return an error from Hubspot saying that it is an unknown header so they are ignoring it).