Framer Security Best Practices
Secure your Framer website with these essential practices. From form protection to custom code security.
Verify your app follows these best practices automatically.
Framer handles hosting security, but you're responsible for application-level security. These practices help you build secure websites on Framer.
Quick Wins
Security Best Practices
#1Secure Custom Code Blocks
criticalCustom code (HTML, CSS, JS) can introduce vulnerabilities. Review all custom code for security issues.
Implementation
Audit code overrides and embeds for XSS vulnerabilities
#2Never Expose API Keys
criticalClient-side code in Framer is visible to all visitors. Never include API keys in custom code.
Implementation
Use serverless functions or proxy services for API calls requiring secrets
#3Enable Form Spam Protection
highForms can be targeted by bots. Enable reCAPTCHA or similar protection.
Implementation
Configure form spam protection in Form Settings
#4Verify SSL Configuration
highEnsure HTTPS is enabled and working for your domain.
Implementation
Framer provides automatic SSL, verify custom domains have valid certificates
#5Review Third-Party Integrations
highAudit the security of any third-party scripts or embeds you add.
Implementation
Only embed from trusted sources, review what data integrations access
#6Control Editor Access
mediumLimit who has edit access to your Framer project.
Implementation
Review team members and their permissions regularly
Common Mistakes to Avoid
API keys in custom code
All client-side code is visible to visitors
Use serverless functions for API calls requiring secrets
Forms without spam protection
Bots can flood forms with submissions
Enable reCAPTCHA or honeypot fields
Untrusted embed scripts
Third-party scripts have access to your page
Only embed from trusted sources, review script behavior
Verify Your Framer App Security
Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.
Get Starter ScanFrequently Asked Questions
Is Framer secure for business websites?
Yes, Framer handles hosting security (SSL, DDoS protection). You're responsible for application security like forms, custom code, and third-party integrations.
How do I hide API keys in Framer?
You can't hide secrets in client-side Framer code. Use Framer's integrations, webhooks, or external serverless functions for API calls requiring secret keys.
Are Framer forms secure?
Framer forms use HTTPS. Enable additional spam protection for production sites to prevent bot submissions.
Related Framer Security Resources
Similar Platforms
Last updated: January 2026