When I check the response at / _hcms/_worker/headers, I can confirm that both x-hs-public-host and x-hubspot-trust-forwarded-for are set correctly, and there are no duplicate values in x-forwarded-for.
Hi @deguchi,
Thank you for posting to the Community! I’d like to tag in some of our Top Contributors to see if they have any ideas on this one
Hi @Bryantworks@LMeert@Jonas_De_Mets I hope you are having a wonderful day! Do any of you all have any experience with setting up a reverse proxys from Cloudflare to Hubspot?
Thank you!
Cassie, Community Manager
The failed checks aren’t caused by anything inside your HubSpot account, they come from the proxy layer (Cloudflare or CloudFront) altering HubSpot’s special asset paths. HubSpot’s validator looks for specific test files under those paths, and if the proxy rewrites, caches, blocks them, the test fails.
To resolve this, your proxy must allow transparent pass-through of HubSpot’s asset directories. The key requirement is that these routes reach HubSpot exactly as requested, without caching, redirects, minification, or URL normalization applied.
On Cloudflare, that means:
-Configure rules so that those asset routes bypass cache completely.
-Turn off performance features like Auto Minify, Rocket Loader, and URL Normalization for them.
-Ensure SSL/TLS mode is set to “Full” or “Full (Strict)” so HubSpot sees unmodified HTTPS traffic.
After making these changes, check the failing URLs directly in a browser or with a simple header inspection. They should return a valid HubSpot response, including HubSpot-specific headers. If they still return errors, it means the proxy is not passing those routes correctly and needs adjustment.
Once the proxy is fully transparent for those paths, rerun HubSpot’s reverse proxy validation. The failures should clear. If they persist even with Cloudflare bypassed, the issue is in the reverse proxy rules themselves every required namespace must be proxied unaltered for validation to succeed.
I hope this helps clarify things and gives you the context you needed. If it resolves your question, please mark it as the accepted solution and give it an upvote so it can also support other members of the community.
Thank you very much for the detailed explanation. I went through the steps you suggested and applied the following settings on Cloudflare:
Auto Minify has already been deprecated on Cloudflare, so no action was required.
Rocket Loader is turned OFF (it was already disabled).
A Cache Rule was added to bypass cache for all incoming requests.
SSL/TLS mode is set to Full (Strict).
URL Normalization has been disabled for both incoming requests and traffic to the origin.
After making these adjustments, I re-ran the reverse proxy validation. Unfortunately, the same checks are still failing with no change in the results.
Do you have any further recommendations on what else I should check in Cloudflare, or adjustments that might be needed on the reverse proxy configuration itself?
