Forms will need to be submitted from pages with registered domains (Starting May 16, 2024)

[JessieS]

Support has been getting a lot of questions about the recent email communication about the upcoming requirement that you'll only be able to accept forms from a domain registered in HubSpot and how to add trusted domains for external sites containing your forms. 

This further clarifies what that means and if you need to take action:

Starting May 16, 2024, you will only be able to receive form submissions from forms on pages with HubSpot system domains, a connected custom domain, or that are added as trusted domains in your advanced tracking settings as additional sites you own and want to be tracked in HubSpot.

What this means and when you need to take action: 

That means that if an external site is not registered as an additional trusted domain in your tracking settings, it will be considered spam.

How to add a trusted domain to your advanced tracking settings:

Settings > Tracking and Analytics > Tracking Code > Advanced Tracking > Additional Site Domains. You’ll add trusted domains there. Learn more here.

What domains should be added as "trusted domains"?

Any external domains that you are embedding HubSpot forms or non-HubSpot forms on that aren't already added to the Additional Domains in your tracking settings. If you are using a HubSpot form on a page created in HubSpot or a non-HubSpot form on a HubSpot page, then you shouldn't need to take action.

What if a form submission goes to spam that shouldn't have?

You would be able to manage in the spam tool and bulk release submissions if needed once you've added the trusted domain: https://knowledge.hubspot.com/forms/manage-form-spam-submissions

Why are these steps necessary?

This adds an additional layer of security to prevent rare instances where a bad actor manipulates your form to display on an unaffiliated domain. It would protect your HubSpot users from potential phishing attempts via forms submitted from an external site that is not a trusted domain.

Will HubSpot send notifications about spam submissions?Users would only receive notifications for form submissions that don't go to spam if they have that set up in their individual notifications settings and are included in the form's notification settings.

Is there a way to bulk-add trusted domains?

There is not currently accommodated, so you would need to add them individually.

Does that mean adding all email domains of form submitters?

This doesn't pertain to the contact's email domain submitted in the Email property, so no need to do that!

UPDATE: Does this apply to integrations and the Forms API?

No, not if the form integration has a direct connection in HubSpot syncing information via the Forms API. 

The forms spam tool will only apply to non-HubSpot forms or HubSpot forms added to external sites. In those scenarios, the external page the form is on would need to be registered as a trusted domain under the Additional Domains in the Advanced tracking settings. That's because HubSpot verifies the tracking code on the page contacts fill out forms on. 

UPDATE: What about if you're using the forms API for a form that's an embedded form and auto-filling via API?

In that case, yes you should register the site URL if you're using API for a form embedded as a non-HubSpot form on an external site tracked by HubSpot. 

[kincaidNA]

I'm working on this right now but am seeing an interesting error. I've seen two domains that are connected with my organization and added them to the trusted domain list. But there is a third option called "file." Not entirely sure where this is coming from... any thoughts? 

[JessieS]

Hi @kincaidNA! Apologies for the wait. That's an interesting question! 

Without seeing the form, I would check if the submitter tried uploading a file in the event you had a file field. The system would protect you from ones that look suspicious and block that from uploading: https://knowledge.hubspot.com/forms/troubleshoot-hubspot-forms#:~:text=File%20removed%20from%20conta...

But to get into specifics, I'd open a ticket with our amazing Support team! You can share that screenshot and an example submission meeting that category that went to spam, as well as a link to your form. Feel free to reference this thread in your support ticket! 

Here are all your help options - including web/chat and phones (for Professional level accounts and above!): https://help.hubspot.com/

Thank you and have a great day! 🙂 

[HGosai]

Hey Team, 

Do we need to add the subdomain to the list?

Thanks,

[JessieS]

If external, then I would to be safe 🙂 

[TGardner4]

But what if you send lead entries to forms via direct integration from 3rd party apps like Zapier or Airtable? How are you supposed to add those domain to tracking? 

To give you a better understanding of what I mean, here's a loom video: https://www.loom.com/share/547e707ef0a24c469f8cc1059ab11eb6

[JessieS]

It shouldn't affect integrations connected to HubSpot or the Forms API. It's just for forms on an external page to make sure it's owned and trusted by your account! 

[BérangèreL]

Hi @JessieS,

Thank you for sharing this clarifying information!

Have a great day!

Best,
Bérangère