I’m having trouble with a HubSpot contact form on my website. Every time someone tries to submit it, we get an error message about sandboxed frames and missing permissions.
The exact error looks like this:
Blocked form submission to '/_hcms/forms/submissions/v3/public/submit/formsnext/multipart/4821056/b7g9ha84-4022-5b61-a934-f983fe992b1f'
because the form's frame is sandboxed and the 'allow-forms' permission is not set.
There’s also another message that appears sometimes about resource loading limits when the browser tab is running in the background. The network requests get delayed until previous ones finish or the user switches back to the tab.
I’ve already included the JavaScript file that should handle the form functionality, but it’s still not working properly. Has anyone else run into this issue before? What’s the best way to fix the sandbox permissions problem?
that’s weird - sounds like your form’s stuck in an iframe without the right permissions. if you’re using a sandbox attribute, try adding allow-forms allow-scripts to it. also check if you’re loading this through a page builder or widget - they love wrapping forms in restrictive iframes by default.
It seems you’re encountering a common issue related to Content Security Policy (CSP) combined with iframe settings. I’ve dealt with this after migrating a site to a stricter hosting environment. You should consider updating your CSP headers to explicitly allow HubSpot’s form endpoints. Additionally, check whether your hosting provider or CDN is blocking cross-origin form submissions; whitelisting HubSpot’s domains may be necessary. Be aware that security plugins can also interfere by adding restrictive sandbox attributes; temporarily disabling any WordPress security plugins can help determine if they are part of the problem. As for the background tab throttling you’re experiencing, it’s standard behavior in browsers and shouldn’t affect functionality, although it complicates debugging during tests.
i totally get it! that error is a pain. make sure your iframe has the right sandbox permissions set, like sandbox="allow-forms allow-scripts allow-same-origin". also, double check the hubspot embed code to ensure it’s set up right.
Had the same issue last month with a client’s HubSpot form. That sandbox error usually means the form’s iframe doesn’t have the right permissions. Besides what ethant said about sandbox attributes, double-check that your HubSpot portal ID matches exactly in the embed code. Sometimes when you copy the embed code from HubSpot’s form builder, it grabs a cached version with wrong permissions. I’d regenerate the embed code from scratch in your HubSpot dashboard and swap out the whole thing. The background tab throttling you mentioned is different - browsers do that to boost performance by limiting network requests on inactive tabs. Won’t affect normal form submissions unless people are tab-switching mid-submit.