We have recently moved to Webflow, reading the guides and working with the agency before we agreed to move, we believed Security Headers would be available.

Since moving over to Webflow we have now found that they are only available to Enterprise customers.

Can security headers please be made available to all paid plans?

Fundamental Security MUST be a standard offering for all users of any service NOT just Enterprise customers.

A financial institution partner is running an audit on our webflow landing pages and found that the default security headers are insufficient.

They keep insisting we upgrade; however, we're stuck because custom security headers is only available to Webflow Enterprise customers.

This is becoming a dealbreaker for us - can we please get support for this feature?

THIS should be a MUST HAVE in no matter which option and not just in ENTERPRISE!!!! Especially in EU countries. Otherwise many freelancers and web agencies are going to have HUUUUUUUUGE problems with GDPR. If this doesn't become a default feature, many EU-people gotta stop working with Webflow. And that would be really sad.

Why can't they just release a simple security pack for an extra $3 a month? Otherwise just give it standard. If a Google check says this is a security risk it should be addressed. Small organisations can't afford Enterprise Lite.

This definitely seems like a basic option that should be at least be available in the Business option.

I believe that this is available in Enterprise Lite now, right?

You can host the Site with Stacket: https://stacket.app/ where you want, and then add the security headers what you prefer :)

This has been the deal breaker on many projects, and it's pretty much the same scenario.

It's an easy sell to creatives and account people when all they can see are the visual aspects of Webflow, great content editing and layout tools. But when we start talking hosting and infosec related matters, it's a deal breaker.

Not having this means we need to introduce new tooling to get around this issue, either by creating proxy servers or custom pipeline scripts to handle the exporting and rebuilding of site with dynamic content.

There ways to work around this, but it's annoying, costly and fragile. So the result is just referring them to another tool or process.

Hey, this is becoming a bit of a problem. Can we please have the ability to put our own headers on our website? If not add some standards in there such as

• X-Content-Type-Options

• Strict-Transport-Security

• Referrer-Policy

• Permissions-Policy

Thanks

Adding X-Content-Type-Options: nosniff should be a trivial change

This seems an obvious target to implement - but doing so in such a way that limits the self harm that can come from incorrect set-up is the real deal right? I have financial sector clients (non transactional sites & marketing) that I can't realistically use for Webflow because a simple scan of the headers (even of webflow.com !) shows a poor 'D' rating.

Curiously, the security rating that Webflow sites score for their headers varies. When you look at the enterprise showcase sites of HelloSign and Brandland.Zendesk they receive a D and an F respectively. The Zendesk site has no CSP or X-Frame options set, whereas HelloSign at least has those 2.

Which begs the question? Did the Zendesk site happen before these became a core part of Webflow or did one of these two clients get some customisation aspect?

Either way - some beefing up of the offering here would go a long way to meeting the basic expectations of more larger clients.

Need this as well! Any updates?

Yes! Also need this - has anyone been able to achieve this?

Please, please please, we need this implemented. This is the final key to making webflow a 100% fast, secure web host, it's a no-brainer.

Curious to know if any of you have been successful with Webflow's team to get this addressed.

https://securityheaders.com/?q=https%3A%2F%2Fwebflow.com%2F&hide=on&followRedirects=on

Subsequently all sites hosted on webflow get the same score.

Currently have a support ticket open asking about this before I found this post. This is much needed. Every webflow site I'm running through securityheaders.com only has content security policy and x frame options as the current headers. 

Same here, HSTS headers are a must in our opinion

Given many of these headers are legal requirements for compliance with CCPA and GDPR, I'd love to see an update from Webflow on this.

Webflow team, any news about the feature?