Security headers on Webflow
Know what your Webflow plan can set before you pick a fix. Custom security headers need an Enterprise site plan, while HSTS is on by default on the other plans.
On Webflow, custom security headers come with Enterprise site plans only. The Webflow Sales team unlocks them for each site. Once they are unlocked, open Site settings > Publishing, scroll to Custom Headers and turn on Enable custom site headers. Pick a header in the Header dropdown, enter its value and click Add header. Publish the site again afterwards. A header takes effect only after that. A header cannot be edited once it is added. To change its value, delete it and add it again. Webflow lists the headers it supports. Nine of them are custom headers: x-xss-protection, x-content-type-options, x-frame-options, referrer-policy, x-permitted-cross-domain-policies, timing-allow-origin, content-security-policy, feature-policy and expect-ct. HSTS is on that list too, as a setting under Advanced publishing options rather than a custom header. On other plans Webflow does not offer the custom headers. A proxy or CDN in front of a site can add response headers instead. Cloudflare, for example, does that with Response Header Transform Rules.
Sources: Webflow Help Center: Custom security headers and Cloudflare docs: Response Header Transform Rules
Strict-Transport-Security (HSTS)
On a site without an Enterprise plan, Webflow turns HSTS on and it cannot be turned off. The options for subdomains and for the preload directive can still be changed on such a site. On an Enterprise site, switch HSTS on or off under Site settings > Publishing > Advanced publishing options. HSTS only takes effect on a site with a custom domain.
Content-Security-Policy (CSP)
On an Enterprise site, pick content-security-policy in the Header dropdown and enter the policy as its value. The list has no report-only form of the header, so a policy takes effect from the first publish.
Draft the policy before you add it. The CSP fix guide linked below shows what a working policy has to name.
X-Frame-Options
On an Enterprise site, pick x-frame-options and enter SAMEORIGIN.
SAMEORIGIN lets only your own pages frame the site. DENY refuses every frame.
X-Content-Type-Options
On an Enterprise site, pick x-content-type-options and enter nosniff.
Referrer-Policy
On an Enterprise site, pick referrer-policy and enter strict-origin-when-cross-origin.
Permissions-Policy
Webflow does not support permissions-policy. Its documentation suggests feature-policy in its place.
How to check it
After you publish, read the headers the live site sends with curl -I https://www.example.com/ or in the network panel of your browser developer tools. The free check gives an A to F grade and shows how to fix the first two findings in a few seconds, with no sign-up. Run the free check.
More on each header: how to fix a missing HSTS header, how to fix a missing Content-Security-Policy header, how to fix a missing X-Frame-Options header and the security headers guide.
The same headers on other platforms: Vercel, Netlify and WordPress.