If you're using HubSpot and still relying on jQuery, it’s important to evaluate how it's being used and whether it’s creating security or performance issues. Over the years, HubSpot has moved away from needing jQuery, but some older portals may still have it checked in the settings.
Outdated versions of jQuery can lead to real security risks and performance bottlenecks. In fact, we’ve seen situations where businesses have had to take action because third parties—like insurance companies—flagged the use of older jQuery versions as a vulnerability.
A Real-World Example: Why Security Matters
We recently worked with a company whose insurance provider flagged jQuery as a security vulnerability. They were told that using an outdated version of jQuery left their site exposed to potential threats, which could increase their liability. We were able to assist them by removing the vulnerable jQuery version thus improving their site's overall security.
To avoid issues like these, it’s crucial to audit your site and see what needs to be done. Below, we outline a good, better, and best approach when dealing with jQuery in HubSpot.
Good: Moving jQuery to the Footer
If your portal still relies on an older version of jQuery (like 1.7 or 1.11), moving the script to load in the footer is a good first step. This can help mitigate potential performance issues by ensuring that jQuery loads after the main content of your page, which can enhance perceived load times. This is strictly a band aid approach and not a long-term solution. While it can help with performance issues, it doesn't address any of the security vulnerabilities.
What to do:
- Make sure you are loading jQuery from the footer to avoid slowing down your site.
- Review your existing jQuery dependencies—you may have to restructure you code to accommodate this change.
Better: Remove Old HubSpot jQuery Versions
For a better solution, you can remove the outdated version of jQuery provided by HubSpot and instead load a secure, recent version—ideally 3.6 or higher. This minimizes risks and it more in line with a "best practice" approach.
What to do:
- Uncheck the jQuery box in settings.
- Load a secure version of jQuery (3.6 or above) from a CDN or locally—ideally from the footer.
- Rewrite your jQuery so it will work with this new version
Best: Eliminate jQuery and Use Vanilla JavaScript
The best approach for performance and security is to eliminate jQuery altogether and rewrite your scripts using vanilla JavaScript. Modern JavaScript has made jQuery largely unnecessary, and using native JS leads to faster page loads and fewer dependencies.
What to do:
- Audit your site's jQuery usage and identify where vanilla JavaScript can replace it.
- Rewrite the necessary scripts using modern JS features.
- Uncheck the jQuery box in settings.
Why It Matters
Older versions of jQuery are known to have security vulnerabilities, and keeping them in use can put your site at risk. Additionally, relying on a large library like jQuery, especially when you don’t need it, can negatively impact your page load times and overall performance. Modern JavaScript offers lightweight, more efficient alternatives to most jQuery functions, so moving away from it is increasingly popular and future-proof.
Conclusion
Auditing your HubSpot portal for jQuery usage is essential for ensuring best-practice security and performance. Whether you upgrade to a more secure version or transition to vanilla JavaScript, there are clear steps you can take to enhance your site's security and speed.
Need help fixing jQuery security and performance issues?
Get your website in the best shape possible. Just fill out our contact form and let's go!
