Snapshot 249906
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Supply Chain Vulnerability Announcements Trust Center Start your security review View & download sensitive information Overview Webflow empowers teams to build and host securely - with trust at the core. Webflow is independently audited for SOC 2 Type II and certified ISO 27001 compliant, proving our commitment to protecting your data and your brand. Our security standards are continuously audited, refined, and embedded into everything we do. Our commitment doesn’t stop at compliance, we continuously invest in strengthening our security posture, improving resilience, and evolving our practices to stay ahead of emerging threats. Compliance SOC 1 Type 2 SOC 2 Type 2 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2025 ISO/IEC 42001:2023 PCI DSS GDPR CCPA Privacy Shield DORA Swiss-US DPF EU-US DPF UK Extension to EU-US DPF DSA Webflow is reviewed and trusted by Okta Verifone Equals Money Stripe HealthStream Procter & Gamble Documents COMPLIANCESOC 1 Type 2 COMPLIANCESOC 2 Type 2 COMPLIANCEISO/IEC 27001:2022 COMPLIANCEISO/IEC 27017:2015 COMPLIANCEISO/IEC 42001:2023 REPORTSAnnual Pentest Report REPORTSWebflow Custom Hosting (WCH) Pentest Report DATA SECURITYBCP/DRP test letter DOCUMENTSCommon False Positive Vulnerability FAQ REPORTSWebflow's Shared Security Responsibility Model SELF-ASSESSMENTSCAIQ SELF-ASSESSMENTSSIG Lite Risk Profile Data access levelPublic Third party dependenceYes HostingMajor Cloud Provider View more Product Feature Security Audit & activity logging (Enterprise Feature) Custom SSL certificate (Enterprise feature) Single Sign-On (SSO) Login (Enterprise feature) View more Reports Past SOC2 Reports Annual Pentest Report Webflow Custom Hosting (WCH) Pentest Report View more Policies Policy governance Integrated management system (IMS) policy Business continuity/disaster recovery (BC/DR) policy View more Self-Assessments CAIQ SIG Lite AI AI overview Webflow Campaigns AI training data View more Access Control Personal data access Data & system access privileges Access log management View more App Security Responsible disclosure Bug bounty program Vulnerability management View more Software Development Lifecycle Software Development Lifecycle Separation of duties Corporate Security Personnel Security Physical security Email protection Infrastructure Amazon web services Environment segregation Status page Data Security BC/DRP tabletop exercises BCP/DRP test letter Data backups View more Endpoint Security Endpoint detection & response Mobile device management (MDM) Anti-malware protection Network Security Intrusion detection system (IDS) Distributed denial of service Protection (DDoS Protection) Firewall View more Incident Response Data breach notifications Incident response Incident reporting process View more Data Privacy Cookies Data privacy practice Data protection impact assessment (DPIA) Risk Management Risk assessments Third-party vendor management Training Secure code training Security and privacy awareness raining Legal Subprocessors Privacy policy Service level agreement View more ESG Anti-bribery and corruption Code of conduct Diversity, equity, and inclusion View more Security Grades Qualys SSL Labs webflow.com A Trust Center Updates Supply Chain Vulnerability Announcements Vulnerabilities Update on Nov 9 Incident Statement: Service availability disruption Webflow cloud app deployment services have been restored after investigation and credential rotation. Please see Webflow’s Status page for the detailed incident report. We have taken steps to block the activity, including disabling and rotating infrastructure credentials and patching affected code and services. We will continue conducting a forensic review, including whether any customer data was impacted. Based on what we know so far, we have not identified any actions customers need to take. If we determine that any customer data was affected then impacted customers will be notified. The Webflow team will continue to monitor and provide updates as necessary. Nov 9 Incident Statement: Service availability disruption Webflow Cloud app deployments are temporarily paused as a precaution while we investigate an incident. Hosted sites are operating normally and are back up and running. We detected unauthorized activity in a Webflow-managed third-party infrastructure account that supports Webflow Cloud deployments. We have taken steps to block the activity, including disabling and rotating infrastructure credentials. We are conducting a forensic review, including whether any customer data was affected. Based on what we know so far, we have not identified any actions customers need to take. If we determine that any customer data was affected, we will notify impacted customers directly. The Webflow team will continue with investigation efforts and will provide updates as our investigation continues. Please subscribe to Webflow’s Status page for updates. Use-After-Free (UAF) vulnerability statement The Webflow Security team is investigating CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. No action is required from customers. We have identified fixes for affected systems, and the Webflow team is working to remediate all affected infrastructure as patches become available. We have no detections or evidence of exploitation, and we have no indication of impact to customer data or to the availability of Webflow services. The Webflow team will continue with vulnerability management efforts and will provide updates as needed. Brotli2shell vulnerability statement The Webflow Security team is investigating CVE-2026-111497 (brotli), a buffer overflow in Google Brotli (1.0.3 through 1.2.0) that affects software that uses the library, including node.js and python packages. The issue has been referred to as “Brotli2shell.” No action is required from customers. We have identified fixes for affected systems, and the Webflow team is working to remediate all affected components as patches become available. We have no detections or evidence of exploitation, and we have no indication of impact to customer data or to the availability of Webflow services. The Webflow team will continue with vulnerability management efforts and will provide updates as needed. Update on PHP2SHELL vulnerabilities statement The Webflow Security team is actively tracking the critical PHP2SHELL vulnerabilities (CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560). Webflow’s core services are not built on PHP and are not affected. No action is required from customers to protect your Webflow site at this time. As a precaution, our Security Team has assessed the non-production related systems that may use PHP and taken appropriate steps to mitigate any identified vulnerabilities. We are also conducting a thorough audit of our supply chain to understand any potential exposure. Our Security team will continue monitoring and provide updates as needed. eMudhra CA compromise statement On October 20, 2026, Mozilla and Google's Chrome Root Program confirmed that the private keys of eight eMudhra intermediate certificate authority (CA) certificates were compromised. eMudhra is a publicly trusted CA used across the internet. At this time, No action is required from customers. Webflow impact assessment: Webflow's hosting SSL infrastructure is not dependent on eMudhra We have found no Webflow-managed or customer site SSL/TLS certificates are issued by, or chain through, the affected eMudhra intermediates The team is actively patching infrastructure in alignment with Webflow patch management and vulnerability operation process for downstream dependencies (Node.js, Go, Python) Internal endpoints and Web browsers (Chrome, Firefox) and macOS have already been patched. PHP2SHELL vulnerabilities statement The Webflow Security team is actively tracking the critical PHP2SHELL vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Webflow’s core services are not built on PHP and are not affected. Our security team is assessing non-production related systems that use PHP and taking appropriate steps to address any identified vulnerabilities. No action is required from customers. "Copy Fail" (CVE-2026-31431) statement The Webflow Security team is investigating "Copy Fail" (CVE-2026-31431), a Linux flaw that could allow local authorized users to escalate permissions. This vulnerability cannot be exploited remotely over the internet. We have identified the affected infrastructure instances and are working on fixes. At this time, there is no evidence of exploitation in Webflow's environment. Customer data and services remain secure and fully operational. We will continue monitoring and provide updates as patches are deployed . No action is required from customers. Reference links: NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31431 Copy Fail (researcher site): https://copy.fail/ pypi-lightning project statement April 30, 2026 Webflow is aware of the recent security advisory regarding the pypi-lightning project (https://pypi.org/project/lightning - versions 2.6.2 and 2.6.3). At this time, we have no evidence to suggest any impact to customer data, accounts, or Webflow services and no indication that sensitive codebases were exposed. Webflow’s security team is continuing to conduct a thorough review of relevant systems. If anything changes, we’ll share updates. Thanks, Webflow Security Vercel security incident statement The Webflow Security team is aware of Vercel's recently disclosed security incident. Webflow uses Vercel in a limited capacity for application hosting. At this time, we have no evidence of any impact to customer data, accounts, or Webflow services related to this incident. The Webflow team is following guidance and has rotated all related credentials. Additionally, Webflow is conducting a thorough audit of our supply chain and their potential exposure. If anything changes, we will provide updates. Thank you, Webflow Security Axios project statement We’re aware of the recent security advisory regarding the Axios project (https://www.npmjs.com/package/axios - versions 1.14.1 and 0.30.4). At this time, we have no evidence to suggest any impact to customer data, accounts, or Webflow services and no indication that sensitive codebases were exposed. Out of an abundance of caution, we’ve implemented additional security controls and are conducting a thorough review of relevant systems. If anything changes, we’ll share updates. Thanks, Webflow Security Security Compliance Framework Announcements Compliance 2026 SOC 1, SOC 2 report, and ISO 27001 certification now available We Have Exciting News! Webflow's 2026 SOC 1 & 2 reports and the ISO 27001:2022 certification are now available to request and download from our Trust Center. Thanks for building with Webflow! 2026 ISO 42001 certification now available We Have Exciting News! The 2026 ISO/IEC 42001:2023 is now available to request and download from our Trust Center. Thanks for building with Webflow! General Announcements General Webflow updated Security page We’re excited to share our updated Security page: 👉 https://webflow.com/security This page provides a comprehensive overview of how Webflow protects customer data and maintains a secure, reliable platform. It outlines our security practices across infrastructure, monitoring, vulnerability management, incident response, compliance, and more. We’re committed to transparency and continuously strengthening our security posture. Visit the page to learn more about how we safeguard your data. Knowledge Base (FAQ) Is Webflow PCI Compliant? Does Webflow allow customers to perform penetration testing and vulnerability scan? Is Webflow HIPAA Compliant? View more