webflow.com

HTML metadata

Title

Webflow: The agentic web platform for modern businesses

Description

Design, build, optimize, and rank in AI search — all in Webflow. Enterprise-grade security, CMS, hosting, and AEO built in. Trusted by over 300k teams.

Language

en

Generator

Webflow

Canonical

https://webflow.com

Translations

de
en
fr

Open Graph

title: Webflow: The agentic web platform for modern businesses
description: Design, build, optimize, and rank in AI search — all in Webflow. Enterprise-grade security, CMS, hosting, and AEO built in. Trusted by over 300k teams.

Technology

CDN: Cloudflare

Analytics

Google Tag Manager

Fonts

Google Fonts

Third-party hosts loaded (13)

cdn.prod.website-files.com×157
dhygzobemt712.cloudfront.net×46
cdn.jsdelivr.net×11
117761985.intellimizeio.com×1
ajax.googleapis.com×1
api.intellimize.co×1
cdn.intellimize.co×1
cdnjs.cloudflare.com×1
d3e54v103j8qbb.cloudfront.net×1
fonts.googleapis.com×1
fonts.gstatic.com×1
log.intellimize.co×1
www.googletagmanager.com×1

Social

Contact

Address: 398 11th St, 94103, San Francisco, CA, US

Registration

Registrar

MarkMonitor Inc.

Created

2003-03-31

Expires

2029-05-09 1085 days left

Updated

2023-10-03

Name servers

ns-1078.awsdns-06.org
ns-1722.awsdns-23.co.uk
ns-344.awsdns-43.com
ns-958.awsdns-55.net

DNS records live

NS

ns-1078.awsdns-06.org
ns-1722.awsdns-23.co.uk
ns-344.awsdns-43.com
ns-958.awsdns-55.net

MX

1 aspmx.l.google.com
10 aspmx2.googlemail.com
10 aspmx3.googlemail.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com

TXT

Show 33 TXT records

remote-domain-verification=c86c15b2-88e3-470c-963c-c2ba01190ed6
postman-domain-verification=f6a7d2f52435f16105a25c66f173054e9db7d2e4e7bacf4fda44e9c585f7d7ab7dbad2a08f8acf7c8d195ce56d12b1f99f670d930ff5b08b581fda9bcaae0343
gentrace-domain-verification=9ea62305-a906-4c5d-9c5a-2f5feb37f859
asv=8c460543decb140b87537caf58b0eed9
google-site-verification=3xpiScIbxMGgY_V5bYXY3JDJORGlv5nmA2tQmE5QxSk
atlassian-sending-domain-verification=b3059a1a-7d62-4ed9-8cb7-19a228943ed2
apple-domain-verification=JyJNP680tZLN6J8E
reachdesk-verification=EXkA6I7Em5MHAKi4IsBuS2Wx2EOSbwxPDYyVaYBL2IJY6cOgcz2oFoEXf9saw4Y2
mongodb-site-verification=nAdRq1BV7wGB1U3IAgrrJlUD2vAPZQHQ
dropbox-domain-verification=hhwd9eo2aak2
v=STSv1;id=1750164986635;
docker-verification=f6eb7150-2c4d-42e3-a1d5-a71ed7b41947
facebook-domain-verification=wim5aiikqmubjhpgjlea0grlcy4arz
jamf-site-verification=dkoLzLTQPiBnSg2osl_ItQ
gc-ai-domain-verification-0k0qqg=5zGKAndwdUGAEEyCKjPKn5nnU
ps-cd-verification=f20b97a8-228d-424e-8bfe-131ed5598c37
atlassian-domain-verification=vyA0bNKYZHNbZ9LbbOu8Aa28WajPCCJ53qO9/idxMUDkdOdta9hrFrutCiOK000q
a--ZbWEx22eC1OzXyIYkzUHxyCa30U4
drift-domain-verification=bec89e0da98bf36f6e5c3d99bddaf800d78f7c6a697112bd1a16160ca0f28ef3
segment-site-verification=s002M3sGMlRXc1kaK40eXaRqerGhLlpZ
hubspot-developer-verification=NWRmZjRhNmYtNzAzNi00MDZkLTgyODgtZWMzMjIzZTUwYzJi
v=TLSRPTv1;rua=mailto:smtp-tls-reports@webflow.com;
stripe-verification=4a619994910710fc7d530a0db04a8dd60ff6e79a9f72f97e28177a2f32951174
v=MCPv1; k=ed25519; p=TryMv95qd4OZPnc6IWmQ3BC7cD8Gcwb3urt3EzAFZ3E=
stripe-verification=081188df8f2b18461958e266de4b6e0c3a5c51f3d4c570653675af0c55053d84
openai-domain-verification=dv-5HdMPAlHXfCAoIOEkUTaVhGz
miro-verification=c52af6e00d431e8c515bc6889548fefc20cd888e
linear-domain-verification=kejfhj7nu55m
docusign=8205d05f-50c2-4f88-b454-f5ced0363215
mgverify=2eb750df10b6c31a1e3ef27a0d06844b676644792b4ea6ea08715cb137dfb1bd
onetrust-domain-verification=cf4f0c9e0a544dcf8c4d5077ad4cd03e
fireflies-verification=01KM0TS4HANF93ACVSS0G2CSKX.ffverify.fireflies.ai-request-verification=2026-03-18T15:59:40Z
loom-site-verification=f10b939df67b4d06a42dadb2c7b3ff43

Email authentication strong

SPF

v=spf1 include:_spf.google.com include:spf.mailjet.com include:mail.zendesk.com include:_spf.salesforce.com ?all

neutral (?all)

DMARC

v=DMARC1; p=reject; sp=none; rua=mailto:dmarc-reports@webflow.com,mailto:re+9a4f4489f1fa@inbound.dmarcdigests.com; aspf=r; pct=100

policy: reject (enforced) · sp=none

DKIM

google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnQsokxGfCyEVwI0QjSDWwS7tAYrTFmQSvNrZC86OvaDus+08Se37veOOMbhl3B9w+Vj9fhXD19/6rU…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzEnz6k1uexonRn2ZZ6JnK7Z+nTw0maN5SLwublT3471gQE2LGGkJkUfiYp5aX8vu/QLAyMQHSBlLx5FncZ…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqFqpRfmdLM4e+vFbuGmKhfafuoWuSSft19s/SGsrmL0XysyHndPX26o4xVBhVOWfdEkRAJ4hrdEX2kpM/2d5zb5…

selectors probed

Certificate (current)

Amazon RSA 2048 M01

from 2025-09-22 to 2026-10-22

Expires in 155 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 75/100 Checked live page: https://webflow.com/

present

strict-transport-security
content-security-policy
content-security-policy-report-only
x-frame-options
referrer-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing content type protection
missing Permissions Policy

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self' https://*.webflow.com https://webflow.com https://app.intellimize.com; style-src 'self' 'unsafe-inline' https://webflow.com https://*.webflow.com https://d1otoma47x30pg.cloudfront.net https://d3e54v103j8qbb.cloudfront.net https://daks2k3a4ib2z.cloudfront.net https://dhygzobemt712.cloudfront.net https://accounts.google.com https://fonts.googleapis.com https://go.webflow.com https://cdn.birdie.so https://cdn.jsdelivr.net https://cdn.prod.website-files.com https://code-components.website-files.com https://transcend-cdn.com https://www.gstatic.com; img-src 'self' data: https://webflow.com https://*.webflow.com https://d1otoma47x30pg.cloudfront.net https://d3e54v103j8qbb.cloudfront.net https://daks2k3a4ib2z.cloudfront.net https://dhygzobemt712.cloudfront.net https://cdn.prod.website-files.com https://code-components.website-files.com https://connect.facebook.com https://*.ads.linkedin.com https://*.doubleclick.net https://www.facebook.com https://*.google.com https://
strict-transport-security: max-age=31536000; preload, max-age=31536000
content-security-policy-report-only: frame-ancestors 'self' https://*.webflow.com https://webflow.com https://app.intellimize.com; connect-src 'self' https://webflow.com https://*.webflow.com https://d1otoma47x30pg.cloudfront.net https://d3e54v103j8qbb.cloudfront.net https://daks2k3a4ib2z.cloudfront.net https://dhygzobemt712.cloudfront.net https://cdn.prod.website-files.com https://code-components.website-files.com https://webflow-assets.s3.us-east-1.amazonaws.com https://browser-intake-datadoghq.com https://statsigapi.net https://beyondwickedmapping.org https://cloudflare-dns.com https://featureassets.org https://prodregistryv2.org https://api.segment.io https://www.google-analytics.com https://*.clarity.ms https://050-lkc-745.mktoresp.com https://050-lkc-745.mktoutil.com https://bat.bing.com https://bat.bing.net https://cdn.dreamdata.cloud https://grsm.io https://partnerlinks.io https://pixel-config.reddit.com https://*.ads.linkedin.com https://q.quora.com https://tracking.goentri.com https://api.claydar.com https://api