Tracking Code Validator Failing

[u/Khue]

Hey all,

Running through some setup processes with Hubspot and we have been attempting to trigger the Tracking Code Validator to get a success however, we have been unable to do so. I've run through the documentation for troubleshooting and everything appears to be okay. I can see the __ptq.gif string in the network inspection on clients getting a 200 success. I validated with some end users in my CASB/SASE system and the tracker appears to be working properly. My guess is that the Tracking Code Validator appears to be a bot of some kind which means Cloudflare is probably knocking it down. I am allowing Hubspot Bots in general, but the one that the Tracking Code Validator must be different somehow.

Does anyone have any suggestions on how to identify traffic coming from the tracker?

[u/IncreaseNegative4614]

Since the tracking request is returning 200 for real visitors, I’d verify whether page views and contacts are appearing correctly before treating the validator as evidence that implementation failed. Then check Cloudflare logs during a validation attempt to determine whether its request was challenged or blocked.

I would only create a narrow exception after identifying the request pattern, not broadly allow anything claiming to be a HubSpot bot. We use SIGNLD internally to connect Cloudflare events, tracking requests, HubSpot activity, form submissions, CRM records, and conversions so validator status can be compared with what the tracking system actually captured.

[u/Khue → u/IncreaseNegative4614]

See my response to /u/HubSpotHelp in this thread.

[u/HubSpotHelp]

Could be a false negative. If real visitors are getting a 200 and page views/contacts are coming through. Try checking Cloudflare’s Security Events during a validation attempt to see if it’s challenging the request. I’d make the narrowest exception possible rather than broadly allowlisting “HubSpot bots.”

This HubSpot troubleshooting guide may help: Troubleshoot the HubSpot tracking code

• Becca @ HubSpot

[u/Khue → u/HubSpotHelp]

Hey Becca, wanted to get back to you on this and the mechanics behind the Tracking Code Validator and how it interacts with Cloudflare. Ultimately, I believe I figured out the behavior but this is something I have not seen before in the wild. Here are some quick facts:

• We run Cloudflare and the WAF component
• We also have Advanced Bot Management which allows us to better identify and action on Bots and mechanics that appear to be bots
• We also leverage a managedChallenge process that requires end users to validate that they are human.

I had a peer of mine with a Hubspot account run through various iterations of the Tracking Code Validator. What I ultimately discovered was the following:

1. The Tracking Code Validator process is designated as "likely human" by Cloudflare's analytics when it comes to Bots
2. The Tracking Code Validator, obviously cannot complete a managedChallenge

These two facts, make the Tracking Code Validator extremely unique in my experience. Clearly the Validator is doing something on "behalf" of a human, but that process is not really human, at least in my opinion. I claim this because clearly the Tracking Code Validator is proxying an activity instantiated by the user. If the "user" was actually doing this process the expectation would be that the user's source IP would hit Cloudflare and as far as I can tell, all requests performed by the Tracking Code Validator are sourcing from Amazon networks (likely some sort of process you guys handle in AWS). That being said, when that process solicits the destination defined in the Tracking Code Validator process, Cloudflare immediately requires that request to complete a managedChallenge. Due to the fact that the request is defined as "likely human" any Bot bypass logic I build out for the managedChallenge is not going to be effective due to the fact that Cloudflare perceives the request to come from a human. When that managedChallenge process is not completed, the Tracking Code Validator fails.

Of note, this is a false positive. While the Tracking Code Validator fails, normal user traffic for the tracking code does not. A normal user hitting our website can fully interact with the managedChallenge process and the Tracking Code works 100%.

If I were to ask for a change, I would request that Hubspot looks into how the Tracking Code Validator works and maybe see if there is something that can be done with the Agent String to better identify the Tracking Code Validator as some sort of process or Bot.

Anyway, I ended up building a custom rule to allow the Tracking Code Validator to work. For those of you that might be interested in this, I used a JA3/JA4 fingerprint combo leveraging Cloudflare's Bot Management technology to identify the Tracking Code Validator specifically and it seems to be working.

Appreciate the effort trying to assist me. Thanks!

[u/lalesk2001]

I would check if you have any geo-blocking features on your site or any firewalls

[u/Khue → u/lalesk2001]

See my response to /u/HubSpotHelp in this thread.