I am working with a client that is asking of we can set various security-related headers from our webflow hosted site:
content-security-policy, x-content-type-options, x-frame-options, x-xss-protection, strict-transport-security.
I can really see the value in being able to set some of these via an advanced options section in site settings to really help secure your site. For example as a simple one if I don't want someone embedding my site in an iframe, setting x-frame-options would be pretty nice. I can see that some of the others could get you into trouble but having a set of options for each that won't completely break my site would be nice
Just to confirm, there is no way to set an option to control any of these, correct? I couldn't find anything.
In that case it sounds like a feature request but I wanted to toss this out there to get some general thoughts and comments, I'm no expert on website security.
written by: esassaman, https://forum.webflow.com/t/setting-various-webflow-host-http-headers-for-security/44925
Thanks
Dominik
We have recently moved to Webflow, reading the guides and working with the agency before we agreed to move, we believed Security Headers would be available.
Since moving over to Webflow we have now found that they are only available to Enterprise customers.
Can security headers please be made available to all paid plans?
Fundamental Security MUST be a standard offering for all users of any service NOT just Enterprise customers.
Attachments Open full size
A financial institution partner is running an audit on our webflow landing pages and found that the default security headers are insufficient.
They keep insisting we upgrade; however, we're stuck because custom security headers is only available to Webflow Enterprise customers.
This is becoming a dealbreaker for us - can we please get support for this feature?
Attachments Open full size
THIS should be a MUST HAVE in no matter which option and not just in ENTERPRISE!!!! Especially in EU countries. Otherwise many freelancers and web agencies are going to have HUUUUUUUUGE problems with GDPR. If this doesn't become a default feature, many EU-people gotta stop working with Webflow. And that would be really sad.
Attachments Open full size
Why can't they just release a simple security pack for an extra $3 a month? Otherwise just give it standard. If a Google check says this is a security risk it should be addressed. Small organisations can't afford Enterprise Lite.
Attachments Open full size
This definitely seems like a basic option that should be at least be available in the Business option.
Attachments Open full size
I believe that this is available in Enterprise Lite now, right?
Attachments Open full size
You can host the Site with Stacket: https://stacket.app/ where you want, and then add the security headers what you prefer :)
Attachments Open full size
This has been the deal breaker on many projects, and it's pretty much the same scenario.
It's an easy sell to creatives and account people when all they can see are the visual aspects of Webflow, great content editing and layout tools. But when we start talking hosting and infosec related matters, it's a deal breaker.
Not having this means we need to introduce new tooling to get around this issue, either by creating proxy servers or custom pipeline scripts to handle the exporting and rebuilding of site with dynamic content.
There ways to work around this, but it's annoying, costly and fragile. So the result is just referring them to another tool or process.
Attachments Open full size
Hey, this is becoming a bit of a problem. Can we please have the ability to put our own headers on our website? If not add some standards in there such as
X-Content-Type-Options
Strict-Transport-Security
Referrer-Policy
Permissions-Policy
Thanks
Attachments Open full size
Adding X-Content-Type-Options: nosniff should be a trivial change
Attachments Open full size
This seems an obvious target to implement - but doing so in such a way that limits the self harm that can come from incorrect set-up is the real deal right? I have financial sector clients (non transactional sites & marketing) that I can't realistically use for Webflow because a simple scan of the headers (even of webflow.com !) shows a poor 'D' rating.
Curiously, the security rating that Webflow sites score for their headers varies. When you look at the enterprise showcase sites of HelloSign and Brandland.Zendesk they receive a D and an F respectively. The Zendesk site has no CSP or X-Frame options set, whereas HelloSign at least has those 2.
Which begs the question? Did the Zendesk site happen before these became a core part of Webflow or did one of these two clients get some customisation aspect?
Either way - some beefing up of the offering here would go a long way to meeting the basic expectations of more larger clients.
Attachments Open full size
Need this as well! Any updates?
Attachments Open full size
Yes! Also need this - has anyone been able to achieve this?
Attachments Open full size
Please, please please, we need this implemented. This is the final key to making webflow a 100% fast, secure web host, it's a no-brainer.
Attachments Open full size
Curious to know if any of you have been successful with Webflow's team to get this addressed.
Attachments Open full size
https://securityheaders.com/?q=https%3A%2F%2Fwebflow.com%2F&hide=on&followRedirects=on
Subsequently all sites hosted on webflow get the same score.
Attachments Open full size
Currently have a support ticket open asking about this before I found this post. This is much needed. Every webflow site I'm running through securityheaders.com only has content security policy and x frame options as the current headers.
Attachments Open full size
Same here, HSTS headers are a must in our opinion
Attachments Open full size
Given many of these headers are legal requirements for compliance with CCPA and GDPR, I'd love to see an update from Webflow on this.
Attachments Open full size
Webflow team, any news about the feature?
Attachments Open full size