Secure Cookie Setting in HubSpot

Marketing & Content Hub Reporting & Analytics
1

Hey guys,
Our org is trying to optimize our attribution processes, specifically hunting down all the ways we can bypass Apples insane defaults which are destroying our attribution.
I randomly stumbled across a google result that suggested trying Hubspots Secure Cookie setting. We currently have it set to off, but I cannot find any information on what it does or what its impact might be and we are reluctant to just flip a setting without fully understanding it.
I would love any insight anyone could provide other than: “Using secure cookies allows HubSpot to only set cookies on pages that load securely over HTTPS.” that is located in the documentation.
All our pages are https as far as I’m aware so it feels like it would have no negative impact, but as I said, I cannot find really any information about what it will actually do.

2

Hi @MJohnson59,

There’s slightly more information here: Set up site tracking in HubSpot

Using secure cookies allows HubSpot to only set cookies on pages that load securely over HTTPS.

To use secure cookies:

  1. In your HubSpot account, click the settings icon in the top navigation bar.
  2. In the left sidebar menu, navigate to Tracking & Analytics > Tracking Code. If you have an account with HubSpot’s free tools, in the left sidebar menu, navigate to Tracking Code.
  3. Click the Advanced Tracking tab.
  4. Click to toggle the Use secure cookies only switch on.

The secure flag is a standard browser cookie attribute: https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies

When a cookie has this flag set, the browser will only transmit it over HTTPS connections, it will never send it over plain HTTP. HubSpot’s tracking cookies identify and track individual visitors. Enabling this toggle tells HubSpot to set the secure flag on those cookies.

If a visitor loads your site over plain HTTP, the browser will send the HubSpot tracking cookies over that unencrypted connection. Anyone on the same network can perform a passive eavesdropping attack and read those cookies in transit. This can be used to replay that cookie to impersonate that visitor in HubSpot’s eyes.

The only real reason not to enable it is if you still have HTTP pages you need tracked. In that case, the fix is to move those pages to HTTPS, not to leave secure cookies off. On these pages, HubSpot’s secure cookies would not be sent on those pages at all.

Hope this helps!

3

Hi @MJohnson59

You’re actually asking the right question here, because a lot of teams see that setting and assume it’s some kind of fix for Apple attribution issues when it really isn’t.

The Secure Cookies setting itself is pretty straightforward. It just tells HubSpot to only place tracking cookies on secure (HTTPS) pages. So if your entire site is already HTTPS, turning it on usually won’t hurt anything and is generally considered the better setting to use.

What it doesn’t do is bypass Apple’s tracking restrictions. The bigger attribution problems from Apple come from things like Safari shortening cookie lifetimes, blocking certain tracking behavior, and Apple Mail masking engagement data. That’s the stuff that tends to break attribution.

So, enabling Secure Cookies is more of a security/best-practice setting than an attribution fix.

You’re probably thinking about attribution the right way though. Most teams trying to improve tracking accuracy now are focusing more on first-party data, server-side tracking, hidden UTM capture, and CRM-level attribution instead of relying completely on browser cookies.

And honestly, if your team is digging into attribution quality right now, it’s usually worth doing a proper audit because there are often multiple small tracking gaps happening at once. The team at WebGuruz Technologies helps businesses review HubSpot attribution and tracking setups pretty regularly and can help spot where data is actually getting lost.

Hope this helped!