CloudFront Reverse proxy verification

[sarvani24]

Hi,

We’re migrating an existing website to HubSpot and have set up a reverse proxy via AWS CloudFront following HubSpot’s guidance. Most of the verification checks are failing, and we’re looking for help diagnosing why the asset-related tests return 404 while other checks succeed.

Reference guide: https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-sup...

Portal ID: [ID] (visible in the script loader URL)

The following checks are passing:

• DCV checks are passing.
• Diagnostics endpoint loads and shows headers flowing through the proxy: http://advertising.roku.com/_hcms/diagnostics
• Status endpoint returns OK: http://advertising.roku.com/_hcms/status
• Script loader is served for our portal: http://advertising.roku.com/hs/scriptloader/[ID].js

The following checks are failing

The asset validation test URLs return 404:

• https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test
• https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test
• https://advertising.roku.com/_hcms/_worker/headers
• https://advertising.roku.com/hs/hs-reverse-proxy-validation-test - says 403 forbidden
• https://advertising.roku.com/cs/c/hs-reverse-proxy-validation-test - says invalid click tracking URL

I reviewed the troubleshooting steps in HubSpot’s reverse proxy documentation, and our configuration appears to align with the guidance. https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-sup...

• From the diagnostics endpoint, we can see proxy-related headers present and trusted, e.g., X-HubSpot-Trust-Forwarded-For: true, x-hs-public-host: advertising.roku.com, and the request ultimately reaching Host: api-na2.hubspot.com. http://advertising.roku.com/_hcms/diagnostics

Could someone advise what typically causes the /hubfs and /hs-fs and static assets reverse proxy validation checks to 404 when the other checks (diagnostics, status, script loader, DCV) are passing?

Moderator note: The HubSpot Community is a public space. I have therefore edited your content for security & confidential reasons.

[BérangèreL]

Hi @sarvani24 and welcome 🎊, we are so glad to have you here!

Great question, thanks for asking the HubSpot Community!

I'd love to put you in touch with our Top Experts: Hi @Anton, @sylvain_tirreau and @Teun do you have suggestions to help @sarvani24, please?

Have a wonderful day and thanks so much!
Bérangère

[sarvani24]

Thanks Bérangère,

I’ve added the hsverify TXT record to our DNS, in addition to the records listed in Verify Reverse Proxy. I now see that the domain says, “Connected through reverse proxy” and the status check at /_hcms/status returns OK. But the static asset validation pages (hubfs, hs-fs etc.) are still resolving to 404 or File not found.

Could someone help me debug why asset validation pages says 404 Not Found.

Thank you!

[BérangèreL]

Hi @sarvani24 and thanks for sharing these updates!

For CloudFront reverse proxy with 404 errors on static assets (hubfs, hs-fs), ensure your cache behaviors explicitly allow these paths: /_hcms/*, /hs/*, /hubfs/*, /hs-fs/hubfs/*, /hs-fs/*, /cs/c/*, and /e3t/*.

Note that hs-fs/hubfs/* was added on December 2024.
 

- In CloudFront Behaviors tab, create separate behaviors for each required path pattern

- Set each behavior's origin to your HubSpot origin (e.g., 123456.sites-proxy.hscoscdn00.net)

- Verify your Origin Request Policy forwards cookies, query parameters, and headers (especially User-Agent)

- Check https://[yourDomain]/_hcms/diagnostics to confirm configuration

The 404s likely mean CloudFront isn't routing those specific asset paths to HubSpot's origin.

Here is the documentation for reference:

- Use a reverse proxy with HubSpot
- CDN path for static assets (CSS & JavaScript) changing

I hope this helps!
Bérangère

This post was created with the assistance of AI tools.

[sarvani24]

Thank you BérangèreL for the response, I checked all the points mentioned above and they looks right to me. Our /_hcms/diagnostics is returning 200 with all the details correctly including user-agent. 

Please check the screenshots of the CloudFront setup attached. Let me know if you want me to share the diagnostics results in here as well. 

Thank you!CloudFront behaviorsCloudFront request origin/_hcms/diagnostics result

[BérangèreL]

Hi @sarvani24 and thanks for sharing this additional information!

 if your /_hcms/diagnostics is returning 200 with all details correctly including user-agent, your CloudFront reverse proxy configuration appears to be working correctly.

You should verify that diagnostics returns proper headers.

If all checks pass, your setup is correct.

Let us know how it goes!
Bérangère

This post was created with the assistance of AI tools.

[sarvani24]

Hi BérangèreL, 

The headers looks correct too, yet 5 checks out of 10 checks in the Verify reverse proxy are failing for me. Could you please check if there is any issue from HubSpot side?
Here are the checks that are failing:
https://advertising.roku.com/hubfs/hs-reverse-proxy-validation-test - 404 not found
https://advertising.roku.com/hs-fs/hs-reverse-proxy-validation-test - "status":"error","message":"File Not Found"
https://advertising.roku.com/hs/hs-reverse-proxy-validation-test - going to HubSpot 404 page
https://advertising.roku.com/cs/c/hs-reverse-proxy-validation-test - Invalid click tracking url
https://advertising.roku.com/e3t/hs-reverse-proxy-validation-test - 404 That page is nowhere to be found

Could you please advise how to fix these checks?
Thank you!

[BérangèreL]

Hi @sarvani24 and thanks for getting back to us!

Based on the reverse proxy documentation, the failing checks you're seeing are expected validation tests.

According to the reverse proxy support guide, these specific paths (/hubfs/*, /hs-fs/*, /cs/c/*, /e3t/*) must be configured to proxy to HubSpot for assets to load properly.
 

The 404 errors you're seeing are not issues from HubSpot's side, they're validation tests checking if your reverse proxy is correctly forwarding these paths.

You can please try the following steps:
 

- Ensure your reverse proxy configuration allows all of these paths: /_hcms/*, /hs/*, /hubfs/*, /hs-fs/hubfs/*, /hs-fs/*, /cs/c/*, and /e3t/*
- Verify your proxy forwards all request/response headers and query strings as-is
- Visit https://[yourFullDomain]/_hcms/_worker/headers to view all headers HubSpot receives from your proxy and confirm proper configuration.

Thanks!
Bérangère

This post was created with the assistance of AI tools.