Stack playbook · Snapshot 23 October 2026
HubSpot CMS: readiness playbook
What 362 measured sites on this hosted platform get right, where they fall short, and the HubSpot CMS-specific steps that close each gap.
- Sites measured
- 362
- Median readiness index
- 76/100
- Profiles on this stack
- 21
detected from homepage HTML and headers
all sites: 64
top-50K sites
Readiness by lane
Enable
85/100
All sites 77
Harden
70/100
All sites 55
Accelerate
77/100
All sites 63
Recover
8/100
All sites 11
The HubSpot CMS playbook
Gaps ordered by impact, with the platform-specific step where one exists.
security.txt published
7.5% observed · all sites 5.5%
Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
CAA records limit who can issue certificates
14% observed · all sites 11%
Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.
No render-blocking scripts in <head>
38% observed · all sites 44%
Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.
Guide: Control Third-Party Scripts Before They Control Your Page
Modern image formats in use
55% observed · all sites 40%
Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.
Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format
Framing restricted
36% observed · all sites 49%
Send Content-Security-Policy: frame-ancestors 'self' (or a list of trusted origins). X-Frame-Options: SAMEORIGIN covers older browsers.
DNSSEC signed
15% observed · all sites 8.1%
Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives
DMARC policy enforces quarantine or reject
59% observed · all sites 31%
Publish DMARC with p=none and a reporting address first, fix any legitimate senders that fail SPF or DKIM alignment, then move to quarantine and finally reject.
Nameservers spread across providers
8.3% observed · all sites 11%
Treat this as an advanced step. Add a secondary DNS provider through zone transfers or a multi-provider setup, then test changes carefully, since both providers must stay in sync.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives
Where HubSpot CMS sites lead
- Referrer-Policy set81% observedall sites 23%
- Content Security Policy present87% observedall sites 31%
- HSTS kept for at least a year85% observedall sites 31%
- HTTP/3 advertised80% observedall sites 36%
A note on hosted platforms
On HubSpot CMS, the platform controls much of the TLS, header and caching configuration. Owners mostly influence content-level checks such as images, structured data, social previews and the sitemap. Header-level gaps are worth raising with the platform.