English

_dd_s

wf_logout

wf_first_touch

__stripe_mid

__stripe_sid

ajs_anonymous_id

wf_exp_uniqueId

Within the commercial generic top-level domain (.com), 'preview.webflow.com' is registered with subdomain 'preview'. Count 7 characters in 'webflow' containing two vowels alongside five consonants. Breaking it apart gives two words: web, flow. Median word length is 3.5 characters. No strong language cues emerged from the frequency lists.

html/2d/b7/2db79068-7b86-4831-b77c-1cf3e1f5ce00.html.gz

frame-ancestors 'self' https://preview.webflow.com

frame-ancestors 'self' https://preview.webflow.com; report-uri https://webflow.report-uri.com/r/t/csp/reportOnly

frame-ancestors 'self' https://*.webflow.com https://webflow.com

frame-ancestors 'self' https://*.webflow.com https://webflow.com; report-uri https://webflow.report-uri.com/r/t/csp/reportOnly

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-g79YH+cujQqpKcaUPdUGKGEVOao3TJTzTfk++rP13mUcNpCQ' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-g79YH+cujQqpKcaUPdUGKGEVOao3TJTzTfk++rP13mUcNpCQ' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp

base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report

base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e357n1PxCJ8d03/QCSKaHFmHF1JADyvSHdSfshxM494=' 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report

6e230b2b4a30f7a34b7d6abc15a35515a0e606805d8a700f2c618cd91f2090cf

f8372444d8889963ae52c1ad7d1190fcab6602f38d3949897f3cd9c598cdc0c2

80ccb2fc4dad9bedacbae6d789235a214362a7cfced170a268dcaaa3a00ff863

d6a981c994218faaba3dd57d7aaaeb5e85c3fd3a135c162bbeec2db37194e1bc

e2bc51220d53fdbab82a12fa3a276f21ee7387e97484000b5ce5f3c2b5c5cdce

e43b9742001acaa0d1cfc5d69bdb4e8274183bad4dd9f1820e7c114fd20c6e39

dd4e1de867e5c3baab7ffec8e37a348d9e76909286f7f5704604cc859ee706a3

8186ce6b64682210bd446576cbe7abcc5683f9e955292b0d8c59cf75f85afba9

975afb0f5f068c0ed9f79adae04f2a62ed1385d453e88c4fc9dc1f8a035d163a

4a72a0c35d5e64d433178e1984e62e3ebe13319019a597cc9870c72afe1585de

87a83fb64eeaa6bc597e32d20e3caf1d476c68f33c617b8788cb056e8307e3ec

2820317a0a1cd436d8379f065d12dd8445247ac66b9010fda951696f003ea2b5

app-version

robots

hostedSubdomain

viewport

theme-color

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

MarkMonitor Inc.

WEBFLOW.COM

//- attributes == {apiKey: "", source: "", hostUrl: "", authenticated: true/false}
var source = 'designer-preview';
var hostUrl = 'https://webflow.com';
var authenticated = Boolean();

var forceFalse = false;
// When ipstack is not loaded window.wf_continentCode is undefined and
// segment consent manager doesn't require consent. We assume consent for
// authenticated users
switch (source) {
  case 'dashboard':
    // If in iframe we don't want consent banner to pop up so we don't load ipstack,
    // but we also use parent window consent manager settings for analytics
    if (!authenticated) {
      initCallbacks();
      loadIpStack();
    }
    break;
  case 'designer-preview':
    // When loading preview.webflow.com/... we don't know if a user is
    // authenticated or not so we need to call this extra endpoint
    initCallbacks();
    isAuthenticated(function(authenticated) {
      if (!authenticated) {
        loadIpStack();
      } else {
        // Needed to resolve wf_isEU
        forceFalse = true;
      }
    });
    break;
  // Default: do nothing
  // Users in Designer are always authenticated so we don't need to detect
  // EU continent because we assume consent
}

function initCallbacks() {
  // ipstack docs: https://ipstack.com/documentation
  window.wf_onDetectContinent = function(ipstackResponseJson) {
    window.wf_continentCode = ipstackResponseJson.continent_code; 
    window.wf_userLocation = {
      country_code: ipstackResponseJson.country_code,
      city: ipstackResponseJson.city
    }
  };

  window.wf_isEU = function() {
    // In order to be GDPR-compliant, we want to treat users from unidentified continent
    // as if they were from EU and in result – show them cookie consent manager
    // instead of assuming the consent was given:
    var fallbackValue = true;
    
    if (forceFalse) {
      return false;
    }
    if (typeof window.wf_continentCode === 'string') {
      return window.wf_continentCode === 'EU';
    }
    if (typeof Promise === 'undefined') {
      return fallbackValue;
    }
    
    // There could be a race condition and wf_continentCode be undefined
    return new Promise(function(resolve) {
      var i = 0;
      var interval = setInterval(function() {
        // Resolve it if:
        // - ipstack has loaded and window.wf_continentCode is defined
        // - 5 seconds passed and wf_continentCode is still undefined
        // - forceFalse is true (used in preview sites when user is authenticated)
        if (forceFalse) {
          clearInterval(interval);
          return resolve(false);
        }
        if (i++ >= 50) {
          clearInterval(interval);
          return resolve(fallbackValue);
        }
        if (typeof window.wf_continentCode === 'string') {
          clearInterval(interval);
          return resolve(window.wf_continentCode === 'EU');
        }
      }, 100);
    });
  };
}

function loadIpStack() {
  var head = document.getElementsByTagName("head")[0];
  var ipstackScript = document.createElement("script");
  ipstackScript.src = "https://api.ipstack.com/check?access_key=53038fede8e664ed0b2e5274047e23a8&fields=continent_code,country_code,city&callback=wf_onDetectContinent";
  head.appendChild(ipstackScript);
}

function isAuthenticated(cb) {
  var xmlhttp = new XMLHttpRequest();
  xmlhttp.open("GET", hostUrl + '/api/user/readOnlyData');
  xmlhttp.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
  xmlhttp.withCredentials = true;
  xmlhttp.onload = function() {
    if (xmlhttp.status === 200) {
      cb(true);
    } else {
      cb(false);
    }
  };
  xmlhttp.send();
}

Object.defineProperty(window, 'wfenvironment', {
  value: Object.freeze({
    APP_ENV: "production",
    designerCanvasCss: "https://d3e54v103j8qbb.cloudfront.net/gen/css/designer-canvas.1eaf23c0ac7eecc0.css",
    WEBFLOW_DEFAULT_HOST: "https://webflow.com",
    paletteClientKey: "ee084a45-e2b9-4437-acc1-7ab4802d528f"
  }),
  writable: false,
  enumerable: false
});


window.performance && typeof performance.mark === 'function' &&
  performance.mark('start js:execute-preloader');


window.performance && typeof performance.mark === 'function' &&
  performance.mark('end js:execute-preloader');


window.isMainTabHidden = Boolean(window.document && window.document.hidden);


if (typeof Preloader !== 'undefined') Preloader.update(1);


window.performance && typeof performance.mark === 'function' &&
  performance.mark('start js:execute-app');


{&quot;featureConfig&quot;:{&quot;config&quot;:{&quot;clientSdkKey&quot;:&quot;client-nJfFsZScKezfQDA01wjoxovvPhAK4FTSLslypZ2pHYL&quot;,&quot;tier&quot;:&quot;production&quot;},&quot;identity&quot;:{&

window.performance && typeof performance.mark === 'function' &&
  performance.mark('end js:execute-app');


X-UA-Compatible

Script

Google-Analytics

HSTS

Webflow

Webflow - EE's Site

First-Party Tracking

✅ Low Risk - https://preview.webflow.com/preview/ees-site-c858d3?utm_medium=preview_link&utm_source=designer&utm_content=ees-site-c858d3&preview=bbaf303e2e498c8f7686cea29d50fa63&workflow=sitePreview

Requests	IP Address	Location	AS Autonomous System
29	13.226.247.67	United States	AS16509AMAZON-02
20	13.226.247.129	United States	AS16509AMAZON-02
17	23.21.215.38	Ashburn, Virginia, United States	AS14618AMAZON-AES
10	172.64.153.109	United States	AS13335CLOUDFLARENET
6	142.250.184.234	United States	AS15169GOOGLE
6	108.138.26.4	United States	AS16509AMAZON-02
4	13.32.121.102	New York, New York, United States	AS16509AMAZON-02
3	52.222.214.25	United States	AS16509AMAZON-02
2	104.18.161.117	United States	AS13335CLOUDFLARENET
2	13.226.244.12	United States	AS16509AMAZON-02
90	71	-	-

Security Scan Report: preview.webflow.com

Summary

AI Security Verdict

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History