Webflow

Meets the B minimum (70/100) in our RFP clause.

With these headers missing, webflow.com is more exposed to malicious JavaScript and clickjacking.

Missing 4

• X-Content-Type-Options 0 of 10

  Stops the browser guessing a file's type instead of trusting the type the server declared.

  Without it: A file uploaded as an image or plain text can be reinterpreted as HTML or script and run inside the product's own origin: malicious JavaScript delivered through a harmless-looking upload feature.

• Permissions-Policy 0 of 10

  Switches off browser features the product does not use, such as camera, microphone, location and payments, for the page and anything embedded in it.

  Without it: Any script or iframe on the page, including third-party ads and chat widgets, can ask the user for camera, microphone or location access under the vendor's name.

• Cross-Origin-Opener-Policy 0 of 5

  Cuts the link between the product's window and windows opened by, or opening, other sites.

  Without it: A page that opens the product keeps a handle on its window and can later redirect it to a look-alike sign-in or payment page (tab-nabbing) while the user thinks they are still on the real site. It is also part of the isolation browsers need to defend against Spectre-style attacks.

• Cross-Origin-Resource-Policy 0 of 5

  Tells browsers which sites may load this site's resources.

  Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.

Sent 5

• Content-Security-Policy 25 of 25

  frame-ancestors 'self' https://webflow.com https://*.webflow.com https://app.intellimize.com; style-src 'self' 'unsafe-inline' https://webflow.com https://*.webflow.com https://d1otoma47x30pg.cloudfront.net https://d3e54v103j8qbb.cloudfront.net https://daks2k3a4ib2z.cloudfront.net https://dhygzobemt712.cloudfront.net https://accounts.google.com https://fonts.googleapis.com https://go.webflow.com https://app.pendo.io https://cdn.birdie.so https://cdn.jsdelivr.net https://cdn.pendo.io https://content-6312168775680000.static.pendo.io https://cdn.prod.website-files.com https://code-components.website-files.com https://transcend-cdn.com https://www.gstatic.com; img-src 'self' data: https://webflow.com https://*.webflow.com https://d1otoma47x30pg.cloudfront.net https://d3e54v103j8qbb.cloudfront.net https://daks2k3a4ib2z.cloudfront.net https://dhygzobemt712.cloudfront.net https://cdn.prod.website-files.com https://code-components.website-files.com https://connect.facebook.com https://*.ads.linkedin.com https://*.doubleclick.net https://www.facebook.com https://*.google.com https://webflow-assets.s3.us-east-1.amazonaws.com https://www.googleadservices.com https://www.google.ad https://www.google.ae https://www.google.al https://www.google.at https://www.google.az https://www.google.ba https://www.google.be https://www.google.bg https://www.google.bj https://www.google.by https://www.google.ca https://www.google.ch https://www.google.cl https://www.google.co.cr https://www.google.co.id https://www.google.co.il https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.nz https://www.google.co.th https://www.google.co.ug https://www.google.co.uk https://www.google.co.uz https://www.google.co.za https://www.google.co.zm https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.br https://www.google.com.co https://www.google.com.cy https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.hk https://www.google.com.kw https://www.google.com.mx https://www.google.com.ng https://www.google.com.np https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sv https://www.google.com.tj https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.uy https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.ee https://www.google.es https://www.google.fi https://www.google.fr https://www.google.ga https://www.google.ge https://www.google.gl https://www.google.gr https://www.google.hr https://www.google.hu https://www.google.ie https://www.google.it https://www.google.kg https://www.google.kz https://www.google.lk https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.md https://www.google.mg https://www.google.mk https://www.google.mu https://www.google.mw https://www.google.my https://www.google.nl https://www.google.no https://www.google.pe https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.se https://www.google.si https://www.google.sk https://www.google.tn https://webflow-assets-studio-temp-prod.s3.amazonaws.com https://*.webflow.com https://account-assets.knock.app https://alb.reddit.com https://analytics.twitter.com https://app.pendo.io https://b.6sc.co https://bat.bing.com https://bat.bing.net https://cdn.pendo.io https://content-6312168775680000.static.pendo.io https://data.pendo.io https://embed-ssl.wistia.com https://fast.wistia.com https://fonts.gstatic.com https://i.ytimg.com https://messenger-assets.qualified.com https://q.quora.com https://quickchart.io https://webflow.itsoffbrand.io https://www.googletagmanager.com

• Strict-Transport-Security 20 of 20

  max-age=31536000; preload, max-age=31536000

• Frame protection 10 of 10

  SAMEORIGIN

• Referrer-Policy 10 of 10

  strict-origin-when-cross-origin

• No version disclosure 5 of 5

Checked 2026-10-09 at https://webflow.com/. Re-checked every 7 days. The grade covers the headers this website sends, not the product’s overall security. How the grade works.