How to Avoid Direct Amazon S3 URLs for HubSpot CTA Redirects?

[Flaval]

Hi there,

The Security Scorecard tool has flagged a concern on our website (upply.com). One of the Call-To-Actions (CTA) in our navigation bar appears to reference an Amazon S3 URL directly:

https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/26644154/7d77efac-f858-4f82-8623...

This direct reference to Amazon S3 negatively impacts our global security score. As a best practice, it’s generally recommended to route such assets through a branded subdomain rather than exposing the raw S3 URL (e.g., hubspot-cta-redirect-eu1-prod.s3.amazonaws.com).

Our questions are:

1. Is there a way to configure HubSpot to use a custom/branded subdomain or CNAME for these CTA redirect links instead of the default Amazon S3 URL?

2. If not directly configurable via HubSpot, would this require intervention from our infrastructure/DevOps team, or is there a recommended workaround?

This issue was last observed on May 19, 2025, and is still open. We’ve reached out to HubSpot CSMs, but they haven’t been able to provide a definitive answer.

Any insights or recommendations would be greatly appreciated!

[Flaval]

Hey @TomM2, thanks for the answer! We tried to find without success where is located this screen you have exactly?

[TomM2]

Within the new CTA editor it should be under the "options" tab

[TomM2 · Accepted solution]

Hey @Flaval at the momenr there's no way to customise the redirect URLs used by CTAs as they're a part of the HubSpot infrastructure and not managed user side. 

Could you use the browser based tracking instead of the redirect based tracking instead?