Security audits for Webflow sites.
Webflow hosts your site securely. The risk lives in what gets added to it: API keys pasted into custom code, third-party scripts, members-only content that is hidden rather than protected, and backends wired straight from the browser. We test all of it from the outside.
Why it matters
The pattern is always the same. The site needed something beyond the visual builder, so a script went into the custom code panel, an integration got an API token, a members area got bolted on, or an Airtable, Xano or Supabase backend got called from the page. Each addition works, and each one carries a decision nobody reviewed: is that token readable by every visitor, and does that backend check who is asking? Gating is the sharpest version. Content hidden by client-side logic is still in the response, and members-only that means not-rendered is public data with extra steps.
What you get.
Custom code and embed review
Every script in your head and footer code and every embed block, read for API keys, tokens and credentials that ship to each visitor's browser.
Gated content test
We request your members-only pages and data as a stranger and as the wrong member, and show you exactly what comes back. Hidden in the interface and protected on the server are different things.
Integration and webhook review
Form handlers, Make and Zapier endpoints, and CMS API tokens used from the browser: whether each can be called or read by someone it was never meant for.
External backend exposure test
If your site talks to Airtable, Xano, Supabase or a custom API from the page, we test what that backend returns to an unauthenticated request, because the browser key is only as safe as the rules behind it.
Script supply chain
Third-party scripts loaded from hosts nobody recognises, where whoever controls the host controls part of your site, plus anything loaded over plain http.
Prioritised report and free re-review
Every finding rated by severity with a concrete fix, and a free re-test of the same surface once you have applied them.
How it works.
- 01
Access
You share the site's URL and a short walkthrough of what it does, plus a member login if you have gated content. Much of the test needs only the public address.
- 02
Test
We test the live site from outside, read the custom code, and probe every integration and backend it talks to, by hand.
- 03
Report
You get a clear, prioritised write-up within days, plus a call to walk through it and the fix for each finding.
- 04
Re-review
After you apply the fixes, we verify the exposed keys are rotated and the gated content is actually gated.
Common questions.
- Isn't Webflow itself secure?
- Yes, and that is exactly why the audit looks elsewhere. The platform layer is Webflow's job and they do it well. Everything added on top, custom code, integrations, membership tooling, external backends, is configured per site by whoever built it, and that layer is where every finding we make on Webflow sites lives.
- My members-only content requires a login. Is it safe?
- Requiring a login to see a page is not the same as the data being protected. If the gating happens in the browser, the content or the API behind it can still answer a direct request. We test it the blunt way: ask for the protected data as a stranger and see what comes back.
- What do you check?
- Keys and tokens in custom code and embeds, gated content tested unauthenticated, form and webhook endpoints, CMS API token exposure, any external backend called from the browser, and the third-party scripts your pages load. Every finding comes with a severity and a fix.
- Can you fix the issues, not just find them?
- Yes. We can make the changes, stand up a small server-side proxy where a key genuinely cannot live in the page, and rotate anything already exposed. Or we hand your builder a clear prioritised list.
- How much does a Webflow security audit cost?
- It is scoped to a fixed quote up front, with no hourly meter, and typically starts around $500 depending on the size of the site. You will know the price before we begin.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.