documentation technical

technology software

social media network

government public service

English

_dd_s

wf_logout

wf_first_touch

__stripe_mid

__stripe_sid

ajs_anonymous_id

wf_exp_uniqueId

Domain 'preview.webflow.com' uses the commercial generic top-level domain (.com) with subdomain 'preview'. The registrable portion 'webflow' spans 7 characters holding two vowels versus 5 consonants. Segmentation suggests 2 words: web, flow. Median word length comes out to 3.5 characters. No strong language cues emerged from the frequency lists.

html/de/eb/deebe721-3b9f-4aab-8cd9-95e0fc24abd6.html.gz

frame-ancestors 'self' https://preview.webflow.com; report-uri https://webflow.report-uri.com/r/t/csp/reportOnly

frame-ancestors 'self' https://*.webflow.com https://webflow.com

frame-ancestors 'self' https://*.webflow.com https://webflow.com; report-uri https://webflow.report-uri.com/r/t/csp/reportOnly

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

default-src 'self' https://*.paypal.com https://*.paypalobjects.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.qualtrics.com; script-src 'nonce-vxVQZR58M6CJR5aW4uwx/3EE+wiMOXP1WbtjJrqS8GU/4uNP' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'nonce-vxVQZR58M6CJR5aW4uwx/3EE+wiMOXP1WbtjJrqS8GU/4uNP' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; object-src 'none'; img-src https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp

require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr

base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report

base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e357n1PxCJ8d03/QCSKaHFmHF1JADyvSHdSfshxM494=' 'sha256-5DA+a07wxWmEka9IdoWjSPVHb17Cp5284/lJzfbl8KA=' 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report

83a3dad0e2b07d3ec4ece31d37fad1e8156060b2ff3003342395e3d5edb689bb

682c2461685ccab9440db6922fcc1e08743ee9e15866549c190a7906fce8b7ee

app-version

robots

hostedSubdomain

viewport

theme-color

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

//- attributes == {apiKey: "", source: "", hostUrl: "", authenticated: true/false}
var source = 'designer-preview';
var hostUrl = 'https://webflow.com';
var authenticated = Boolean();

var forceFalse = false;
// When ipstack is not loaded window.wf_continentCode is undefined and
// segment consent manager doesn't require consent. We assume consent for
// authenticated users
switch (source) {
  case 'dashboard':
    // If in iframe we don't want consent banner to pop up so we don't load ipstack,
    // but we also use parent window consent manager settings for analytics
    if (!authenticated) {
      initCallbacks();
      loadIpStack();
    }
    break;
  case 'designer-preview':
    // When loading preview.webflow.com/... we don't know if a user is
    // authenticated or not so we need to call this extra endpoint
    initCallbacks();
    isAuthenticated(function(authenticated) {
      if (!authenticated) {
        loadIpStack();
      } else {
        // Needed to resolve wf_isEU
        forceFalse = true;
      }
    });
    break;
  // Default: do nothing
  // Users in Designer are always authenticated so we don't need to detect
  // EU continent because we assume consent
}

function initCallbacks() {
  // ipstack docs: https://ipstack.com/documentation
  window.wf_onDetectContinent = function(ipstackResponseJson) {
    window.wf_continentCode = ipstackResponseJson.continent_code; 
    window.wf_userLocation = {
      country_code: ipstackResponseJson.country_code,
      city: ipstackResponseJson.city
    }
  };

  window.wf_isEU = function() {
    // In order to be GDPR-compliant, we want to treat users from unidentified continent
    // as if they were from EU and in result – show them cookie consent manager
    // instead of assuming the consent was given:
    var fallbackValue = true;
    
    if (forceFalse) {
      return false;
    }
    if (typeof window.wf_continentCode === 'string') {
      return window.wf_continentCode === 'EU';
    }
    if (typeof Promise === 'undefined') {
      return fallbackValue;
    }
    
    // There could be a race condition and wf_continentCode be undefined
    return new Promise(function(resolve) {
      var i = 0;
      var interval = setInterval(function() {
        // Resolve it if:
        // - ipstack has loaded and window.wf_continentCode is defined
        // - 5 seconds passed and wf_continentCode is still undefined
        // - forceFalse is true (used in preview sites when user is authenticated)
        if (forceFalse) {
          clearInterval(interval);
          return resolve(false);
        }
        if (i++ >= 50) {
          clearInterval(interval);
          return resolve(fallbackValue);
        }
        if (typeof window.wf_continentCode === 'string') {
          clearInterval(interval);
          return resolve(window.wf_continentCode === 'EU');
        }
      }, 100);
    });
  };
}

function loadIpStack() {
  var head = document.getElementsByTagName("head")[0];
  var ipstackScript = document.createElement("script");
  ipstackScript.src = "https://api.ipstack.com/check?access_key=53038fede8e664ed0b2e5274047e23a8&fields=continent_code,country_code,city&callback=wf_onDetectContinent";
  head.appendChild(ipstackScript);
}

function isAuthenticated(cb) {
  var xmlhttp = new XMLHttpRequest();
  xmlhttp.open("GET", hostUrl + '/api/user/readOnlyData');
  xmlhttp.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
  xmlhttp.withCredentials = true;
  xmlhttp.onload = function() {
    if (xmlhttp.status === 200) {
      cb(true);
    } else {
      cb(false);
    }
  };
  xmlhttp.send();
}

Object.defineProperty(window, 'wfenvironment', {
  value: Object.freeze({
    APP_ENV: "production",
    designerCanvasCss: "https://d3e54v103j8qbb.cloudfront.net/gen/css/designer-canvas.e3821c73b732a246.css",
    WEBFLOW_DEFAULT_HOST: "https://webflow.com",
    paletteClientKey: "ee084a45-e2b9-4437-acc1-7ab4802d528f"
  }),
  writable: false,
  enumerable: false
});


window.performance && typeof performance.mark === 'function' &&
  performance.mark('start js:execute-preloader');


window.performance && typeof performance.mark === 'function' &&
  performance.mark('end js:execute-preloader');


window.isMainTabHidden = Boolean(window.document && window.document.hidden);


if (typeof Preloader !== 'undefined') Preloader.update(1);


window.performance && typeof performance.mark === 'function' &&
  performance.mark('start js:execute-app');


{&quot;experimentAssignments&quot;:[],&quot;featureConfig&quot;:{&quot;config&quot;:{&quot;clientSdkKey&quot;:&quot;client-nJfFsZScKezfQDA01wjoxovvPhAK4FTSLslypZ2pHYL&quot;,&quot;tier&quot;:&quot;prod

window.performance && typeof performance.mark === 'function' &&
  performance.mark('end js:execute-app');


Webflow - Graec's Amazing Site

First-Party Tracking

✅ Low Risk - https://preview.webflow.com/preview/graecs-amazing-site?utm_medium=preview_link&utm_source=designer&utm_content=graecs-amazing-site&preview=29e8932c0cb49207c663cd35a91e181d&workflow=preview

Requests	IP Address	Location	AS Autonomous System
25	34.232.10.183	Ashburn, Virginia, United States	AS14618AMAZON-AES
1	104.18.160.117	United States	AS13335CLOUDFLARENET
1	108.138.26.93	United States	AS16509AMAZON-02
1	142.250.185.163	United States	AS15169GOOGLE
1	13.226.247.129	United States	AS16509AMAZON-02
1	104.18.2.70	United States	AS13335CLOUDFLARENET
1	142.250.181.234	United States	AS15169GOOGLE
1	104.18.11.212	United States	AS13335CLOUDFLARENET
1	172.64.153.109	United States	AS13335CLOUDFLARENET
1	34.128.128.0	Kansas City, Missouri, United States	AS396982GOOGLE-CLOUD-PLATFORM
90	66	-	-

Security Scan Report: preview.webflow.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History