technology software

documentation technical

social media network

English

_dd_s

wf_logout

wf_first_touch

__stripe_mid

__stripe_sid

ajs_anonymous_id

wf_exp_uniqueId

Within the commercial generic top-level domain (.com), 'preview.webflow.com' is registered with subdomain 'preview'. Its registrable label 'webflow' stretches across 7 characters holding two vowels versus five consonants. Splitting it apart reveals two words: web, flow. Average segment length settles at 3.5 characters. No strong language cues emerged from the frequency lists.

html/51/56/51562db6-15d1-4f3a-87f4-5e91d8cfc58f.html.gz

frame-ancestors 'self' https://preview.webflow.com; report-uri https://webflow.report-uri.com/r/t/csp/reportOnly

frame-ancestors 'self' https://*.webflow.com https://webflow.com

frame-ancestors 'self' https://*.webflow.com https://webflow.com; report-uri https://webflow.report-uri.com/r/t/csp/reportOnly

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-2V4+9S3iEyeJDjEeT5aVlwdYhODIsglCZ2EmEqr5d9m9ABaG' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-2V4+9S3iEyeJDjEeT5aVlwdYhODIsglCZ2EmEqr5d9m9ABaG' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp

base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report

base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e357n1PxCJ8d03/QCSKaHFmHF1JADyvSHdSfshxM494=' 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report

83a3dad0e2b07d3ec4ece31d37fad1e8156060b2ff3003342395e3d5edb689bb

682c2461685ccab9440db6922fcc1e08743ee9e15866549c190a7906fce8b7ee

app-version

robots

hostedSubdomain

viewport

theme-color

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

MarkMonitor Inc.

WEBFLOW.COM

Amazon EC2 Abuse

IP Management

Amazon AWS Network Operations

Amazon.com, Inc.

AWS RPKI Management POC

IP Routing

Amazon EC2 Network Operations

AMAZON-CF

//- attributes == {apiKey: "", source: "", hostUrl: "", authenticated: true/false}
var source = 'designer-preview';
var hostUrl = 'https://webflow.com';
var authenticated = Boolean();

var forceFalse = false;
// When ipstack is not loaded window.wf_continentCode is undefined and
// segment consent manager doesn't require consent. We assume consent for
// authenticated users
switch (source) {
  case 'dashboard':
    // If in iframe we don't want consent banner to pop up so we don't load ipstack,
    // but we also use parent window consent manager settings for analytics
    if (!authenticated) {
      initCallbacks();
      loadIpStack();
    }
    break;
  case 'designer-preview':
    // When loading preview.webflow.com/... we don't know if a user is
    // authenticated or not so we need to call this extra endpoint
    initCallbacks();
    isAuthenticated(function(authenticated) {
      if (!authenticated) {
        loadIpStack();
      } else {
        // Needed to resolve wf_isEU
        forceFalse = true;
      }
    });
    break;
  // Default: do nothing
  // Users in Designer are always authenticated so we don't need to detect
  // EU continent because we assume consent
}

function initCallbacks() {
  // ipstack docs: https://ipstack.com/documentation
  window.wf_onDetectContinent = function(ipstackResponseJson) {
    window.wf_continentCode = ipstackResponseJson.continent_code; 
    window.wf_userLocation = {
      country_code: ipstackResponseJson.country_code,
      city: ipstackResponseJson.city
    }
  };

  window.wf_isEU = function() {
    // In order to be GDPR-compliant, we want to treat users from unidentified continent
    // as if they were from EU and in result – show them cookie consent manager
    // instead of assuming the consent was given:
    var fallbackValue = true;
    
    if (forceFalse) {
      return false;
    }
    if (typeof window.wf_continentCode === 'string') {
      return window.wf_continentCode === 'EU';
    }
    if (typeof Promise === 'undefined') {
      return fallbackValue;
    }
    
    // There could be a race condition and wf_continentCode be undefined
    return new Promise(function(resolve) {
      var i = 0;
      var interval = setInterval(function() {
        // Resolve it if:
        // - ipstack has loaded and window.wf_continentCode is defined
        // - 5 seconds passed and wf_continentCode is still undefined
        // - forceFalse is true (used in preview sites when user is authenticated)
        if (forceFalse) {
          clearInterval(interval);
          return resolve(false);
        }
        if (i++ >= 50) {
          clearInterval(interval);
          return resolve(fallbackValue);
        }
        if (typeof window.wf_continentCode === 'string') {
          clearInterval(interval);
          return resolve(window.wf_continentCode === 'EU');
        }
      }, 100);
    });
  };
}

function loadIpStack() {
  var head = document.getElementsByTagName("head")[0];
  var ipstackScript = document.createElement("script");
  ipstackScript.src = "https://api.ipstack.com/check?access_key=53038fede8e664ed0b2e5274047e23a8&fields=continent_code,country_code,city&callback=wf_onDetectContinent";
  head.appendChild(ipstackScript);
}

function isAuthenticated(cb) {
  var xmlhttp = new XMLHttpRequest();
  xmlhttp.open("GET", hostUrl + '/api/user/readOnlyData');
  xmlhttp.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
  xmlhttp.withCredentials = true;
  xmlhttp.onload = function() {
    if (xmlhttp.status === 200) {
      cb(true);
    } else {
      cb(false);
    }
  };
  xmlhttp.send();
}

Object.defineProperty(window, 'wfenvironment', {
  value: Object.freeze({
    APP_ENV: "production",
    designerCanvasCss: "https://d3e54v103j8qbb.cloudfront.net/gen/css/designer-canvas.e3821c73b732a246.css",
    WEBFLOW_DEFAULT_HOST: "https://webflow.com",
    paletteClientKey: "ee084a45-e2b9-4437-acc1-7ab4802d528f"
  }),
  writable: false,
  enumerable: false
});


window.performance && typeof performance.mark === 'function' &&
  performance.mark('start js:execute-preloader');


window.performance && typeof performance.mark === 'function' &&
  performance.mark('end js:execute-preloader');


window.isMainTabHidden = Boolean(window.document && window.document.hidden);


if (typeof Preloader !== 'undefined') Preloader.update(1);


window.performance && typeof performance.mark === 'function' &&
  performance.mark('start js:execute-app');


{&quot;experimentAssignments&quot;:[],&quot;featureConfig&quot;:{&quot;config&quot;:{&quot;clientSdkKey&quot;:&quot;client-nJfFsZScKezfQDA01wjoxovvPhAK4FTSLslypZ2pHYL&quot;,&quot;tier&quot;:&quot;prod

window.performance && typeof performance.mark === 'function' &&
  performance.mark('end js:execute-app');


Webflow - BTmail EE

First-Party Tracking

✅ Low Risk - https://preview.webflow.com/preview/btmail-ee?utm_medium=preview_link&utm_source=designer&utm_content=btmail-ee&preview=d997dc32cf010fff45bec792092796b2&workflow=preview

Requests	IP Address	Location	AS Autonomous System
14	3.174.46.75	Unknown	Unknown
1	13.226.247.129	Unknown	Unknown
1	104.18.31.133	Unknown	Unknown
1	172.64.153.109	Unknown	Unknown
1	142.250.185.106	Unknown	Unknown
1	44.219.57.85	Unknown	Unknown
1	13.226.247.220	Unknown	Unknown
1	18.173.205.118	Unknown	Unknown
1	108.138.26.97	Unknown	Unknown
1	104.18.11.212	Unknown	Unknown
88	75	-	-

Security Scan Report: preview.webflow.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History