ShipPatrolScan your site for legal, security and SEO gaps, then fix them
Built with Webflow

What Webflow doesn't set up for you

Webflow is a hosted site builder with a lot of the basics covered: HSTS, an auto-generated sitemap and per-page SEO fields. It doesn't ship a cookie banner, and it can't tell what your custom code and embeds do once they load.

What Webflow gives you

Hosting and HTTPS
Webflow hosts the site. Since July 2024, HSTS response headers are enabled automatically on non-Enterprise sites; Enterprise customers can switch them on or off. Source: webflow.com (opens in a new tab)
SEO
An auto-generated sitemap.xml updates each time you publish. Titles, descriptions and Open Graph settings are set per page. Source: university.webflow.com (opens in a new tab)
Consent
Webflow provides consent APIs for its own site tracking (Analyze and Optimize) but no built-in banner. It points to Marketplace apps such as DataGrail and Finsweet, an existing consent platform, or a banner you build. Source: developers.webflow.com (opens in a new tab)

What Webflow already checks

The checklist

What's still on you

  1. A cookie banner, and scripts that wait for it

    Webflow doesn't include a banner, so sites add one from the Marketplace, a consent platform or custom code. Scripts pasted into custom code, such as Google Analytics, a Meta pixel or a heatmap tool, run on page load unless the banner is set up to hold them back. Webflow's consent APIs are for its own site tracking; your embeds need their own handling.

    Patch checks:Critical Trackers load before consentHigh No cookie banner

  2. A privacy policy that matches the embeds

    Forms, newsletter embeds, booking widgets, video players and analytics are all services your privacy policy may need to name. These tend to pile up over time, and the policy does not update itself.

    Patch checks:Critical No privacy policyMedium Privacy policy doesn't mention services the site uses

  3. An Impressum, if you need one

    Businesses in Germany and Austria generally need a legal notice with specific details. Webflow won't add one; it's a page you write and link from every page, usually the footer.

    Patch checks:Medium No Impressum

  4. Alt text across CMS content

    The Audit panel flags missing alt text page by page, when someone opens it. CMS collections keep adding images after launch, and each one needs alt text too.

    Patch checks:Medium Images without alt text

  5. Contrast and form labels

    Light grey on white looks lovely in a portfolio and less lovely to anyone reading it on a phone in the sun. The Audit panel launched with checks for alt text, empty links and skipped heading levels, not colour contrast. Forms that rely on placeholder text also need real labels for screen readers.

    Patch checks:Medium Text contrast too lowMedium Form fields without labels

  6. Titles and link previews on CMS pages

    Open Graph settings can't be set globally in Webflow, so each page, and each CMS template, needs its own. A template without fields bound to the title and description gives every item the same preview.

    Patch checks:Medium Pages with missing or duplicate titlesMedium No sitemap.xml

  7. Headers beyond HSTS

    HSTS is handled. Whether the site also sends a Content-Security-Policy, framing rules or a referrer policy is worth checking, especially once third-party scripts are pasted in.

    Patch checks:Medium No Content-Security-Policy header

What ShipPatrol adds

  • Loads the published site from the UK, EU and US, clicks Accept and Reject, and records which scripts fire before and after.
  • Compares your privacy policy with the services the site actually loads, including embeds.
  • Re-scans daily or from a deploy hook, so a new embed added by a colleague gets noticed, and emails you about it.

ShipPatrol isn't affiliated with Webflow. Product names belong to their owners. Facts about Webflow were checked against its own documentation on 21 October 2026 and may have changed since. Not legal advice.

Free scan

Scan your Webflow site.

Paste the published address. Patch visits from the UK, the EU and the US and tells you what he finds. Free, no signup.

No signup needed. Not legal advice; every check names its source.

Sources