HubSpot announced changes to how you can accept form submissions from certain domains. This is what you need to know.
You might've received an email from HubSpot recently, notifying you that form submissions must come from registered domains, otherwsie they'll be sent to Junk Submissions.
The email is at the bottom of this page if you want to see it.
This left us with some questions, so we called HubSpot support to clarify several things. The documentation wasn't very clear that was linked in the email. Plus, it raised some doubts about integrations and external form tools.
Below is a breakdown of some Q&A from what we learned:
Question: What forms and submissions are impacted exactly?
Answer: Only HubSpot forms that are embedded into a site.
This means it's only when you use the embed code. You'll need to have that domain registered within your HubSpot portal.
Direct link HubSpot form submissions aren't impacted because these are hosted on one of your HubSpot domains that is already in your portal.
Question: Are form submission from integrations and external form tools (like Jotform) impacted by this?
Answer: No, only embedded HubSpot forms are impacted.
Integrations submit form information through the API, and therefore aren't impacted by this change.
Question: What are some situations that this change would impact?
Answer: Any embedded form outside of your registered domains (found in Settings > Account Setup > Tracking and Analytics > Tracking Code > Advanced Tracking > Additional Site Domains)
Subdomains and Partner sites are two big use cases.
If you have a subdomain that you embed your HubSpot form on, make sure it's registered.
If you have Partners that you share your HubSpot form embed code with, their domain will have to be registered in your HubSpot portal. Other options would be to change the implementation of how you collect form information from Partners. You could use an external form app like Jotform or have them send submissions from their own forms to your HubSpot account via API.
Question: What happens if I get form submissions outside of my Registered Domains in an embedded HubSpot form?
Answer: They will be put in the "Junk Submissions" section for 90 days.
You'll still be able to view and recover them, but they won't trigger workflows, contact creation, etc.
If you release the submission from the junk area, then it can trigger workflows and other configurations inside of your HubSpot portal.
Conclusion
The impact is big if you don't have domains registered inside of your HubSpot portal. And if you have arrangements with Partners that have your code directly embedded in their site.
The good news is that you have until May 16th, 2024 to update your settings!
Work with Our Team
The email
Hi {{your_name}}
We’re reaching out about an important update to how your HubSpot account processes form submissions. Starting May 16, 2024, you’ll be able to accept form submissions from registered domains only.
After this date, HubSpot will treat form submissions from unregistered domains as a potential security threat and will list them as spam in the Spam Submissions tool.
What steps do you need to take?
In your HubSpot account, go to Settings > Account Setup > Tracking and Analytics > Tracking Code > Advanced Tracking > Additional Site Domains. You’ll add trusted domains here.
Follow the instructions in this Knowledge Base article on how to add trusted domains to your account. Form submissions will continue to process for any domains added here.
Review the Knowledge Base article
Why is HubSpot making this change?
Today, bad actors have the ability to manipulate form submissions with the goal of deploying phishing attacks on HubSpot users. Accepting form submissions from registered and trusted domains only, greatly reduces this risk.
Can you release form submissions marked as spam from the Spam Submissions tool.
Yes. If you’ve determined a domain is trusted, add it to your account following the instructions above. You can then go into the Spam Submissions tool and release the submissions from that domain. Please note: HubSpot will automatically delete form submissions in the Spam Submissions tool after 90 days.
When should you make this change.
This change takes effect on May 16, 2024; however, we strongly recommend adding trusted domains to your account today. Any form submissions received from unregistered domains after this date will be listed as spam and sent to the Spam Submissions tool.
If you have questions, visit the HubSpot Help Center.
Best,
The HubSpot Product Team
P.S. You're receiving this email because your HubSpot account is impacted by this change. As a primary contact for your business, you may be the only one who received this message. Please forward along as needed.
