Secure your Webflow website with these essential practices. From form security to custom code safety.
Verify your app follows these best practices automatically.
Webflow handles hosting security, but you're responsible for application-level security. These practices help you build secure websites on Webflow.
Forms can be targeted by bots and spammers. Enable reCAPTCHA and use Webflow's spam filtering.
Enable reCAPTCHA in Form Settings and configure spam protection
Custom HTML/CSS/JS can introduce vulnerabilities. Review all custom code for security issues.
Audit embed code for XSS vulnerabilities and external script security
Never expose API keys in client-side custom code. Use server-side solutions for sensitive APIs.
Use serverless functions or proxy services for API calls requiring keys
Ensure HTTPS is enabled and enforced for your domain.
SSL is automatic for Webflow-hosted sites, verify custom domains have SSL
Review the security of any third-party tools, widgets, or scripts you embed.
Audit embedded scripts, prefer official integrations
Add CSP headers to protect against XSS and data injection attacks.
Configure headers in Webflow project settings or via CDN
Client-side code is visible to all visitors
Use serverless functions or proxy services for API calls
Forms without protection are targeted by bots
Enable reCAPTCHA and spam filtering
Third-party scripts can access your page content
Only embed scripts from trusted sources, review what they do
Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.
Scan Your App FreeWebflow handles hosting security (SSL, DDoS protection, etc.). You're responsible for application-level security like forms, custom code, and third-party integrations.
You can't hide secrets in Webflow's client-side code. Use Webflow's integrations, Zapier, or a serverless function to make API calls that require secret keys.
Webflow forms use HTTPS and have spam filtering, but you should enable reCAPTCHA for additional protection against bots.
Last updated: January 2026