What the HubSpot plugin does on your site
The official HubSpot plugin connects your WordPress site to a HubSpot account, the CRM, marketing and customer service platform built by the US company of the same name. Once the account is connected, it adds the HubSpot tracking code to every page: each visit, form submission and chat conversation lands on the contact record, along with the pages that person viewed.
In the admin area, a HubSpot menu gives you Forms, Live Chat, Contacts, Email, Lists, Reporting and Settings. These screens display the HubSpot app itself: forms, chatbots and campaigns are created and stored in your HubSpot account, not in the WordPress database. To place them on your pages, the plugin provides a Form block and a meetings scheduler block, two Elementor widgets and the [hubspot] shortcode.
The plugin and HubSpot’s free tools are free with no time limit (this is not a trial account). Marketing automation or removing the HubSpot logo requires a Starter, Professional or Enterprise subscription, billed per user seat.
Which sites the HubSpot plugin is a good fit for
The plugin makes sense when HubSpot is, or is about to become, the hub of your customer relationships:
- Small businesses and freelancers selling a service: quote and appointment requests go straight into a free CRM, with each prospect’s browsing history.
- Teams already on HubSpot: no more pasting the tracking code by hand, and forms are available from inside WordPress.
- Sites that want chat tied to the CRM: conversations are attached to the contact, with chatbots that qualify leads, book meetings or open tickets.
- Agencies delivering a site and a CRM together: a single HubSpot account can serve several WordPress sites.
It is the wrong pick if all you need is a contact form or a newsletter signup, with data that stays on your own server: a regular forms plugin, or MC4WP for Mailchimp, does the job without loading an external script on every page.
HubSpot plugin strengths and limitations
Strengths
- A real free CRM. Forms, chat, email and visits all feed the same contact record, with no trial period.
- Easy embedding. Form block, meetings block, Elementor widgets and a shortcode: no code to paste.
- No SMTP plugin needed for campaigns. Marketing emails are sent from HubSpot’s servers.
- Works with your existing forms. According to HubSpot, the plugin works with most WordPress form and popup builders.
Limitations
- Everything depends on the HubSpot account. Forms, contacts and campaigns live at HubSpot; with no connected account, the plugin shows nothing.
- HubSpot logo on the free plan. It appears on emails, forms, chat and meeting links; removing it takes Starter.
- Costs grow with your team. Paid plans are billed per user seat, and Marketing Hub also charges for marketing contacts.
- An external script on every page. HubSpot itself notes that the chat widget can slow page load times.
- Demanding setup. You must be a HubSpot Super Admin, allow third-party cookies in your browser, and activate the plugin site by site on a multisite network.
The settings we recommend for HubSpot
The plugin has few settings of its own: most of the work happens in your HubSpot account (the settings icon in the main navigation bar).
| Setting | Recommended value | Why |
|---|---|---|
| Account connection HubSpot (WordPress sidebar menu) | A company Super Admin account, not a personal one | HubSpot requires this role; the account must stay accessible if an employee leaves. |
| Enable reverse proxy for HubSpot hosted content HubSpot > Settings > Domains | Off (default), unless you publish HubSpot content in a subfolder | This routing only serves pages or blogs hosted at HubSpot and shown under your domain. |
| IP Addresses to Exclude HubSpot account > Settings > Tracking & Analytics > Tracking Code > Advanced Tracking | Your offices’ static IP addresses | Your own visits stop skewing the analytics. |
| Bot filtering Same screen | On | HubSpot removes activity from known bots from your analytics. |
| Cookie consent banner HubSpot account > Settings > Privacy & Consent | Consent required before tracking for your European visitors | The tracking code sets cookies; the HubSpot banner works on any page that carries it. |
| Content type HubSpot Analytics uses to track this page Elementor page settings, Hubspot section | Detect Automatically (default) | Change it only if a page is misclassified in reports. |
| Automatic updates Plugins > Installed Plugins | On | Every published vulnerability was fixed by a new release. |
- View the source of a page: the
hs-script-loaderscript should load fromjs.hs-scripts.comwith your account ID. - Submit a test form from a private window and check that the contact shows up in HubSpot > Contacts.
- Decline cookies in the banner, then confirm in your browser’s developer tools that no HubSpot tracking cookie is set.
If you already run a consent plugin such as Complianz, keep a single banner and make sure it blocks the HubSpot script until the visitor agrees. The data you collect belongs in your GDPR records (see our article on GDPR and WordPress security).
HubSpot plugin security: flaws that need an editorial account
Every published flaw in the plugin requires a logged-in account, usually Contributor or above, so they mainly matter for sites that hand out writing accounts to outsiders.
- CVE-2022-1239, fixed in 8.8.15: blind SSRF, because the REST API proxy endpoint did not validate the URL a contributor supplied.
- CVE-2024-5879, fixed in 11.1.34: stored XSS through the
urlattribute of the meetings widget, with a Contributor account (CVSS 6.4). - CVE-2025-11762, fixed in 11.3.33: a contributor could read the list of installed plugins and their versions (CVSS 4.3).
- CVE-2026-57736, fixed in 11.3.56 according to Patchstack: sensitive data exposure, up to version 11.3.51 (CVSS 7.4).
The useful move: turn on automatic updates for the plugin (see our guide to automatic plugin updates) and give Contributor accounts only to people you trust. The plugin also stamps your pages with an HTML comment that gives its version (see HTML comments and the generator tag): WP Masquerade Pro removes it and hides the plugin folder addresses, which makes the plugin harder for bots to spot, without replacing updates. The js.hs-scripts.com script and the _hsq variable stay visible, because HubSpot tracking needs them.
What WP Masquerade hides for HubSpot
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to HubSpot: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- signed HTML comments
- folder name
- tag IDs
Still visible
- JavaScript variables
leadin_wordpress, _hsq - files served by the vendor
js.hs-scripts.com
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
HubSpot plugin FAQ
Is the HubSpot plugin really free?
Yes: the plugin and HubSpot’s free tools (CRM, forms, chat, marketing email, reports) are free with no time limit, with the HubSpot logo. Marketing Hub Starter costs €15 per month per seat with an annual commitment, or €20 without one, excluding taxes.
Do I need an SMTP plugin with HubSpot?
Not for marketing emails, which HubSpot sends. The plugin does not touch the emails WordPress sends itself (password resets, notifications): for those, an SMTP plugin is still useful if your host delivers poorly.
What is left after I delete the HubSpot plugin?
On deletion, the plugin erases its options (account ID, connection tokens) and its user metadata. Your contacts, forms and campaigns stay in your HubSpot account, but the HubSpot blocks and shortcodes on your pages no longer display anything.
Is the HubSpot plugin a good fit for a WooCommerce store?
It tracks a store’s visits and forms like any other site. To sync orders and customers, HubSpot points to a separate plugin, HubSpot for WooCommerce.