Your HubSpot blog, at /blog.
HubSpot can serve a blog at yourdomain.com/blog while the rest of the site lives elsewhere, through a reverse proxy it documents in detail and explicitly does not support. This is every requirement from HubSpot's own docs, in the order you will hit them, plus the plan-tier check most tutorials skip.
The short answer
- It works: HubSpot's reverse proxy overview names SEO consolidation under subdirectories as a reason to use one.
- It is on you: per HubSpot, reverse proxy setup is not supported by its support team. Help comes from the community or a partner.
- The proxy must send three headers, cache nothing from HubSpot, forward eight asset paths, and run on a CDN or distributed environment, never a single server.
- Moving an existing blog off a subdomain means changing its root URL, which HubSpot's blog settings docs say requires Marketing Hub Enterprise.
What does HubSpot require from the proxy?
Six non-negotiables, all from HubSpot's reverse proxy setup guide. Miss one and the failure is usually quiet: a page that loads but does not update, or analytics that stop making sense.
X-HS-Public-Host header
Your public domain, e.g. www.yourdomain.com
Tells HubSpot which domain it is serving content for. Without it, HubSpot cannot match the request to your site.
X-Forwarded-For header
Add or prepend the visitor’s IP
HubSpot uses it to tell visitors apart. Missing, every visitor looks like your proxy.
X-HubSpot-Trust-Forwarded-For
Static value: true
Needed for location-based personalization to see the real visitor, not the proxy.
Caching on HubSpot paths
None
HubSpot manages its own CDN cache. Per HubSpot, if your proxy caches responses, pages may not update for hours or days after you publish.
Methods, query strings, headers
Forward all, including cookies
Forms, tracking, and personalization depend on requests arriving unmodified.
Proxy topology
CDN or distributed environment
HubSpot’s CDN runs on Cloudflare. Thousands of visitors arriving from one server’s IP looks like an attack and triggers 429 or 403 responses.
The paths that must reach HubSpot
Routing only /blog/* is the most common first attempt, and it produces unstyled pages. HubSpot serves files, forms, and tracking from these paths at your domain root, so each one needs a route of its own:
- /_hcms/*
- /hs/*
- /hubfs/*
- /hs-fs/hubfs/*
- /hs-fs/*
- /cs/c/*
- /e3t/*
- /events/*
How do you set it up, step by step?
- 1
Check the plan before the plumbing
If your blog already lives at blog.yourdomain.com, moving it means changing the blog’s root URL. HubSpot’s blog settings documentation states that Marketing Hub Enterprise is required to change a blog root URL. Confirm your subscription allows it before anyone touches DNS.
- 2
Find your origin hostname
The proxy forwards to <HubID>.<suffix>, where the suffix depends on your account’s data center (for example sites-proxy.hscoscdn-eu1.net for the EU; US East accounts add a number based on the last two digits of the Hub ID). Do not use the <HubID>.groupXX.sites.hubspot.net value from the SSL step. HubSpot is explicit that it is only for domain verification.
- 3
Configure the proxy route
Route /blog/* plus every asset path listed above to the origin, with the three headers set and caching off for those paths. Everything else on yourdomain.com keeps going to your main site.
- 4
Prove it with HubSpot’s diagnostics page
Load yourdomain.com/_hcms/diagnostics through the proxy. The current time must change on every reload (no caching), the leftmost X-Forwarded-For IP must be yours, the protocol must be https, and the cookie value must not be blank. A 404 here usually means extra or duplicated headers.
- 5
Add the domain in HubSpot, with the CDN switch off
In domain settings, connect the domain as Primary or Secondary and toggle off “Connect with HubSpot’s built-in content delivery network (CDN)”. The brand domain and subdomain must match what the proxy serves. You add HubSpot’s verification records at your DNS provider, but no CNAME pointing the site at HubSpot. Verification can take up to 4 hours.
- 6
Point the blog at the new root URL
In the blog’s settings, pick the proxied domain and enter blog as the slug. HubSpot notes that changing a root URL automatically creates redirects for published posts. Those redirects are served by HubSpot, so the old hostname has to keep reaching HubSpot for them to fire.
Plan tier and settings wording checked against HubSpot's blog settings documentation on September 25, 2026. HubSpot changes tiers and menus; re-check before you plan a migration around them.
What breaks, and what it looks like
Images and CSS missing, page text fine
An asset path is not routed. Re-check your rules against HubSpot’s current list: /hs-fs/hubfs/* was added on December 20, 2024 to replace /hs-fs/hub/*, and configs that enumerated exact subpaths instead of the broader /hs-fs/* rule miss it.
Published an update, old version still showing
Your proxy is caching HubSpot paths. HubSpot invalidates its own cache on publish; it cannot reach yours.
Visitors hit a JavaScript challenge or 429s
All traffic is leaving through one IP. A single nginx box in front of HubSpot is the documented cause, which is why HubSpot lists a CDN or distributed environment as a prerequisite.
Every click marked as a bot in reports
On CloudFront, the default behavior sends CloudFront’s own User-Agent. HubSpot’s setup guide says to forward the visitor’s User-Agent instead so clicks are not recorded as bot events.
The blog is missing from your sitemap
HubSpot’s overview warns that when only a subpath is proxied, your main sitemap.xml will not include the HubSpot pages. The fix is below.
Which SEO signals need checking after cutover?
Two, and both follow from the blog now living on a host HubSpot does not control.
Canonicals. View source on a few posts and confirm the canonical reads https://www.yourdomain.com/blog/post-name, not the old subdomain. For the recommended setup, where the domain in HubSpot matches the proxied domain, HubSpot advises absolute URLs in your content, and Google's canonicalization guidance also recommends absolute rather than relative canonical URLs. If the domains match, this usually just works. If they do not, it is the first thing to break.
Sitemaps. Your main site's sitemap does not know the blog exists. Google's sitemap documentation allows multiple Sitemap: lines in robots.txt with no limit, and sitemap index files that group several sitemaps. Either lets the main site and the HubSpot blog each publish their own list of URLs under one domain.
Should you build this yourself?
If you already run CloudFront or Cloudflare Enterprise, HubSpot's guide gets you most of the way, and it includes provider-specific instructions for both CloudFront and nginx (the latter still behind a distributed layer). If you do not, the requirements above are the job description for whoever owns the proxy: headers, path rules, per-path caching, TLS, and staying current when HubSpot adds a path, as it did in December 2024.
Whichever route you take, managed or DIY, hold the provider to HubSpot's list. Ask whether it can set custom request headers, skip caching on HubSpot paths, and forward traffic from more than one IP. That includes asking us.
HubSpot subdirectory FAQs
Can I host a HubSpot blog on a subdirectory like yourdomain.com/blog?
Yes. HubSpot documents a reverse proxy setup for exactly this case: your domain stays pointed at your own infrastructure, and a proxy forwards /blog and HubSpot’s asset paths to HubSpot with three required headers. HubSpot documents it but states that reverse proxy setup is not supported by its support team.
Which HubSpot plan do I need?
HubSpot’s reverse proxy developer docs do not name a tier for the proxy itself. Separately, HubSpot’s blog settings documentation says Marketing Hub Enterprise is required to change a blog root URL, which you need if you are moving an existing blog from a subdomain. Check your own account’s settings before planning around either.
Can I put HubSpot behind a single nginx server?
HubSpot says no. Its overview explains that proxying through one server concentrates traffic on a few IP addresses, which resembles a DDoS attack to the Cloudflare-powered HubSpot CDN and results in blocked requests or JavaScript challenges. It requires a CDN or distributed computing environment.
Does HubSpot redirect my old blog.yourdomain.com URLs?
When you change a blog’s root URL, HubSpot automatically creates redirects for published posts. They only work while requests to the old hostname still reach HubSpot, so keep that domain connected for as long as the redirects matter, which Google suggests is at least a year for site moves.
Is a subdirectory better for SEO than a HubSpot subdomain?
Google’s documentation does not say subdirectories rank better, and a HubSpot blog on a subdomain can rank well. The case for the subfolder is consolidation of links and brand under one host, and teams weigh it differently. Our subdomain vs. subfolder guide lays out both sides.