HTTP response headers security

I am working with a client that is asking of we can set various security-related headers from our webflow hosted site:

content-security-policy, x-content-type-options, x-frame-options, x-xss-protection, strict-transport-security.

I can really see the value in being able to set some of these via an advanced options section in site settings to really help secure your site. For example as a simple one if I don't want someone embedding my site in an iframe, setting x-frame-options would be pretty nice. I can see that some of the others could get you into trouble but having a set of options for each that won't completely break my site would be nice 

Just to confirm, there is no way to set an option to control any of these, correct? I couldn't find anything.

In that case it sounds like a feature request but I wanted to toss this out there to get some general thoughts and comments, I'm no expert on website security.

written by: esassaman,



  • Dominik Roettger
  • Jul 8 2017
  • Axel Sturmann commented
    20 Jun 16:26

    This would also be very helpful to me. Facebook Pixel does not track across sub-domains unless you call that Pixel into your sub-domain pages via an iFrame. But this is not allowed by Webflow (i.e. hosting the Pixel code on my main domain with Webflow, and calling that page into my sub-domains via an iFrame) . The above request would solve this problem.

  • Jaime Delgado commented
    28 Oct 09:47

    This is a must-have for all 3 of our projects - you have security headers easily with WordPress but not with Webflow?