Does Webflow require domain verification?

HIGH SEVERITYHOSTINGCVSS 8.6Requires Account VerificationID: webflow

Webflow Dangling DNS & Takeover Fingerprint

CNAME points to Webflow edge proxies without an active site custom domain binding.

DNS CNAME Delegation Rules

Target CNAME Delegation

proxy.webflow.com / proxy-ssl.webflow.com

DNS Resolution Indicator

CNAME points to proxy.webflow.com. Returns 404 'The page you are looking for doesn\'t exist'.

Expected HTTP Status Code

404 Not Found

Authoritative Response Token

Vulnerable Body Indicator String

“The page you are looking for doesn't exist”

CLI Verification Command

curl -sI http://subdomain.example.com | grep 'The page you are looking for doesn\'t exist'

When SubdomainWatch scanner identifies this response on an unresolved CNAME target, an automated alert is triggered within 800ms.

Remediation Guide & Defensive Action Plan

Immediate Action Required: Remove the Webflow CNAME in DNS or attach the domain in your Webflow project settings.

Defensive Verification Checklist:

Audit authoritative DNS zone records for any CNAME pointing to proxy.webflow.com / proxy-ssl.webflow.com.
Verify whether the target resource or bucket still exists under your organization's cloud tenant.
If decommissioned, delete the DNS record immediately to close the public exposure window.
Deploy a pre-merge IaC security gate (such as SubdomainWatch Takeover Guard) to intercept dangling records before pull requests merge.

Terraform Remediation Example

# Delete Webflow proxy CNAME

Open Dedicated Webflow Terraform Solution Guide →

ATTACK SURFACE DETECTION COMPARISON

Why Static DNS Scanners Miss Webflow Takeovers

Passive DNS repositories like SecurityTrails and heavy scanners like Detectify record domain records retrospectively or trigger alert fatigue. SubdomainWatch conducts active recursive CNAME testing with zero false positives.

SubdomainWatch vs SecurityTrails →SubdomainWatch vs Detectify →All 5 Competitor Benchmarks →

Webflow Takeover FAQs

Webflow requires adding TXT verification tokens in newer project settings, but legacy CNAME records may still be vulnerable if left unattended.

FREE UNRESTRICTED SCANNER

Scan Your Domain for Webflow Orphans

Test any hostname live. Our diagnostic engine traverses CNAME hops and verifies authoritative provider tokens in seconds without requiring an account.

LAUNCH TAKEOVER TOOL →Start Free 24/7 Monitor