Webflow + Hubspot integration: CORS issue with leadflows.js

WebFlow website

Integration with HubSpot app

Everything was OK during ± 1 year.

Couple days ago, the CORS error appears for /leadflows.js:

Access to script at 'https://js-eu1.hsleadflows.net/leadflows.js' from origin '[MyWebSite]' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Any ideas?

Hi @AZhukouski,

Have you recently switched to HTTPS, changed domains, or begun loading the script through a tag manager/custom fetch?

You can try to fix pop-up loading by switching to the supported installation method.

In Webflow’s Project Settings > Custom Code > remove any direct script tags that load leadflows.js, e.g.,

<script src="https://js-eu1.hsleadflows.net/leadflows.js"></script>

  • Avoid mixed-protocol requests that trigger CORS blocks. Ensure your site and the HubSpot script both load over HTTPS. If your page is on HTTP, switch the page to HTTPS.
  • Don’t try to change headers on HubSpot assets. You can’t modify HubSpot’s Access-Control-Allow-Origin header, so avoid proxying or fetching the script via XHR/fetch; load it normally on the page.
  • Clear cache and test in a clean browser session (or incognito), and temporarily disable any ad blockers when testing.

Confirm the HubSpot tracking code is installed on every page (paste it just before the tag). This ensures pop-up forms load properly on external sites.

If this helps, feel free to mark it as the solution :check_mark: and give it an upvote :+1: !

Hello, @Jigar_Thakker

Thanks for the answer, but it doesn’t help.

“Have you recently switched to HTTPS, changed domains, or begun loading the script through a tag manager/custom fetch?” => no, nothing on that.

“In Webflow’s Project Settings > Custom Code > remove any direct script tags that load leadflows.js, e.g.,” => there is not a direct call to the leadflows.js, but it’s part of the HubSpot Embed Code script:
<!-- Start of HubSpot Embed Code -->
<script type=“text/javascript” id=“hs-script-loader” async defer src=“//js-eu1.hs-scripts.com/XXXXXXXX.js”></script>
<!-- End of HubSpot Embed Code -->

I have also reconnected webflow and hubspot - issue still exists.

Other ideas?

Hi @AZhukouski,

To better understand the issue at hand, can you provide your findings with screen recordings or screenshots?

I’ll try to explain with the next steps:

1. Webflow custom code in footer (copied from hubspot settings):

<!-- Start of HubSpot Embed Code -->
<script type=“text/javascript” id=“hs-script-loader” async defer src=“//js-eu1.hs-scripts.com/143014083.js”></script>
<!-- End of HubSpot Embed Code -->

=> you can check this .js file to get the details - js-eu1.hs-scripts.com/143014083.js

2. When I load my website, it’s an error in console (see screenshot).

I hope it will help to identify the reason

Hey @AZhukouski - thanks for posting all of this context in the Community!
Hoping that it assists @Jigar_Thakker with additional troubleshooting steps.
Shane, Community Manager

Thanks for providng the SS @AZhukouski, let me look into the errors and possible workaround for this.

cc @STierney

HI @Jigar_Thakker I am experiencing the same issue from couple of days. I believe that the portal embed script is trying to load

https://js-eu1.hsleadflows.net/leadflows.js

which is a solid 404 for me.

@Jigar_Thakker @STierney FYI:

I have also received reply from WebFlow support. I’m sharing it here in order if it will be helpful:

leadflow.js file is gone for couple of a couple of days. Can you please escale this and explain what is the impact on the website data.
https://web.archive.org/web/20250000000000*/https://js-eu1.hsleadflows.net/leadflows.js

Thanks for flagging this.

FYI: I have removed the tracking code from the website until a solution is found.

Hi @AZhukouski,

Now you have removed the code, but these were my findings before you did so.

After checking your website, I think the issue you were facing: an old tracking URL was 404, where you were getting the CORS. You added the new code to the website, but did not remove the old one.

And the tracking was also not above this tag </body>

This might have been the possible issue, but as we know, the leadflow file isn’t accessible for a couple of days now. Connecting with support for your specific use here is the best way forward.

Let me know if you need any further assistance. Happy to help!

If this helps, feel free to mark it as the solution :check_mark: and give it an upvote :+1: !

I don’t know why previous solution was marked as “accepted”. It wasn’t by me)

My case solved in the next way:

1. Remove HubSpot Tracking code from the website (basically to avoid CORS issue and impact on site performance and SEO)

2. Wait one week

3. Check HubSpot Script in one week: I see that “/leadflows.js” was removed by HubSpot (don’t know the reason, but anyway)

4. Put HubSpot Tracking code back

So, basically, issue solved by hubspot in silence)

Anyway, thanks for help!