HTTP response headers security

I am working with a client that is asking of we can set various security-related headers from our webflow hosted site:

content-security-policy, x-content-type-options, x-frame-options, x-xss-protection, strict-transport-security.

I can really see the value in being able to set some of these via an advanced options section in site settings to really help secure your site. For example as a simple one if I don't want someone embedding my site in an iframe, setting x-frame-options would be pretty nice. I can see that some of the others could get you into trouble but having a set of options for each that won't completely break my site would be nice 

Just to confirm, there is no way to set an option to control any of these, correct? I couldn't find anything.

In that case it sounds like a feature request but I wanted to toss this out there to get some general thoughts and comments, I'm no expert on website security.

written by: esassaman,



  • Dominik Roettger
  • Jul 8 2017
  • Hey Gianluca commented
    18 Sep, 2023 03:44pm

    Security Headers should not be a enterprise only features in my eyes. Since most of them can be set for our Wordpress client with a couple of lines inside a htaccess file.

  • Eliana Franco commented
    11 Sep, 2023 09:40pm

    Hi all, we just redesigned our site and moved it over to Webflow, only to find out that we are on Core and can't add custom security headers. This a HUGE problem for us. Will this be available to all customers soon or is there a manual workaround that we can implement?

  • Rien commented
    23 Aug, 2023 12:02pm

    Unbelievable that security settings/headers are only available to Enterprise customers. Thinking about using cloudflare or the like to fix this. Any suggestions?

  • Stuart Hare commented
    18 Jan, 2023 09:35am

    We have recently moved to Webflow, reading the guides and working with the agency before we agreed to move, we believed Security Headers would be available.

    Since moving over to Webflow we have now found that they are only available to Enterprise customers.

    Can security headers please be made available to all paid plans?

    Fundamental Security MUST be a standard offering for all users of any service NOT just Enterprise customers.

  • Brian Wong commented
    12 Dec, 2022 09:09am

    A financial institution partner is running an audit on our webflow landing pages and found that the default security headers are insufficient.

    They keep insisting we upgrade; however, we're stuck because custom security headers is only available to Webflow Enterprise customers.

    This is becoming a dealbreaker for us - can we please get support for this feature?

  • Sven Wiegert commented
    10 Oct, 2022 01:31pm

    THIS should be a MUST HAVE in no matter which option and not just in ENTERPRISE!!!! Especially in EU countries. Otherwise many freelancers and web agencies are going to have HUUUUUUUUGE problems with GDPR. If this doesn't become a default feature, many EU-people gotta stop working with Webflow. And that would be really sad.

  • Daniel commented
    7 Sep, 2022 03:00pm

    Why can't they just release a simple security pack for an extra $3 a month? Otherwise just give it standard. If a Google check says this is a security risk it should be addressed. Small organisations can't afford Enterprise Lite.

  • Omer Rimoch commented
    24 Aug, 2022 06:41am

    This definitely seems like a basic option that should be at least be available in the Business option.

  • Erik Runbeck commented
    25 Mar, 2022 09:00pm

    I believe that this is available in Enterprise Lite now, right?

  • Guest commented
    18 Feb, 2022 09:19pm

    You can host the Site with Stacket: where you want, and then add the security headers what you prefer :)

  • Anthony Pilger commented
    9 Feb, 2022 01:27pm

    This has been the deal breaker on many projects, and it's pretty much the same scenario.

    It's an easy sell to creatives and account people when all they can see are the visual aspects of Webflow, great content editing and layout tools. But when we start talking hosting and infosec related matters, it's a deal breaker.

    Not having this means we need to introduce new tooling to get around this issue, either by creating proxy servers or custom pipeline scripts to handle the exporting and rebuilding of site with dynamic content.

    There ways to work around this, but it's annoying, costly and fragile. So the result is just referring them to another tool or process.

  • Andrew Thompson commented
    10 Aug, 2021 03:35am

    Hey, this is becoming a bit of a problem. Can we please have the ability to put our own headers on our website? If not add some standards in there such as

    • X-Content-Type-Options

    • Strict-Transport-Security

    • Referrer-Policy

    • Permissions-Policy


  • Adam Rich commented
    13 May, 2021 08:55pm

    Adding X-Content-Type-Options: nosniff should be a trivial change

  • Mark Thurman commented
    31 Mar, 2021 10:48am

    This seems an obvious target to implement - but doing so in such a way that limits the self harm that can come from incorrect set-up is the real deal right? I have financial sector clients (non transactional sites & marketing) that I can't realistically use for Webflow because a simple scan of the headers (even of !) shows a poor 'D' rating.

    Curiously, the security rating that Webflow sites score for their headers varies. When you look at the enterprise showcase sites of HelloSign and Brandland.Zendesk they receive a D and an F respectively. The Zendesk site has no CSP or X-Frame options set, whereas HelloSign at least has those 2.

    Which begs the question? Did the Zendesk site happen before these became a core part of Webflow or did one of these two clients get some customisation aspect?

    Either way - some beefing up of the offering here would go a long way to meeting the basic expectations of more larger clients.

  • Laura Kim commented
    11 Dec, 2020 03:49pm

    Need this as well! Any updates?

  • McAlvany Intelligence Advisor commented
    22 Jul, 2020 10:30pm

    Yes! Also need this - has anyone been able to achieve this?

  • Nick DiMoro commented
    20 May, 2020 03:45am

    Please, please please, we need this implemented. This is the final key to making webflow a 100% fast, secure web host, it's a no-brainer.

  • Matt Koshko commented
    14 May, 2020 01:16am

    Curious to know if any of you have been successful with Webflow's team to get this addressed.

  • Alexander Brevig commented
    27 Mar, 2020 08:26am

    Subsequently all sites hosted on webflow get the same score.

  • Chadwick Savage commented
    19 Feb, 2020 02:01am

    Currently have a support ticket open asking about this before I found this post. This is much needed. Every webflow site I'm running through only has content security policy and x frame options as the current headers. 

  • Load older comments
  • +135