Is webflow.io legit or a scam?
Legitimate Webflow platform domain, but criminals exploit it to host phishing sites — verify full URLs before trusting content.
Analysis Summary
No threats detected
All checks passed. This site appears legitimate — but always stay alert for phishing even on trusted domains.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site.
MT Intelligence
Webflow Inc is a well-funded, registered US company founded in 2013 and headquartered in San Francisco. The webflow.io domain has been registered since 2013 and serves as the official hosting platform for user-created sites. Our antivirus network shows no malicious detections (0/92 engines), valid SSL from Amazon, and clean IP reputation. The evidence package confirms Webflow is a legitimate business trusted by enterprise clients like Dropbox and Verifone. However, the evidence also documents that cybercriminals have increasingly abused Webflow's platform to host phishing pages, fake crypto wallets, and CAPTCHA scams — traffic to such malicious pages increased 10-fold between April and September 2024. This abuse is a platform-wide issue, not a flaw in Webflow's own infrastructure. Users visiting webflow.io directly will reach the legitimate platform, but should be cautious about clicking links to user-created subdomains (*.webflow.io) without verifying the full URL.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for webflow.io, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- webflow.io registered on 2013-05-08 (over 13 years old) via MarkMonitor; official domain for Webflow's free hosting/subdomains.
- Webflow Inc is a legitimate, well-funded US company (San Francisco) founded in 2013, serving 300k+ brands including enterprise clients like Dropbox, Verifone, and Lattice.
- Webflow platform is frequently abused by cybercriminals to host phishing pages, fake crypto wallet sites, and CAPTCHA scams (10x traffic increase noted Apr-Sep 2024).
- Netskope and others recommend checking full URL as phishing sites often end in *.webflow.io.
- Mixed user feedback: positive professional reviews for design/CMS capabilities; complaints on Reddit about billing/cancellation and isolated scam warnings in Webflow communities.
- Trustpilot page for webflow.io exists with limited reviews (around 13 noted); no major dedicated scam database listings for the core company itself.
- Webflow maintains a spam/abuse reporting form and warns users about phishing impersonating their platform or agencies.
- The Hacker Newsopen
"Researchers have warned of a spike in phishing pages created using a website builder tool called Webflow, as threat actors continue to abuse legitimate services"
- Netskopeopen
"From April to September 2024, Netskope Threat Labs tracked a 10-fold increase in traffic to phishing pages crafted through Webflow."
- Redditopen
"Webflow is a scam. ... I've tried several times to cancel my Webflow subscription over the last few months by downgrading my website's plan."
- LinkedInopen
"A sophisticated phishing campaign exploiting Webflow's Content Delivery Network (CDN) since mid-2024."
- Crazy Eggopen
"Webflow is a great tool for web designers and developers looking to build websites the same way they've always done, only with half the hassle and twice the power."
- Aaron Ward Blogopen
"An Honest Webflow Review (Pros & Cons After 2 Years) ... support with a response time of less than 24 hours which is a perfect backup."
- LitExtensionopen
"With fast load times and strong built-in security, Webflow is highly rated for delivering a smooth and safe experience for visitors."
Webflow Inc, founded 2013, headquartered in San Francisco, CA (398 11th St, 2nd Floor). Privately held software company with significant funding (e.g. $140M round in 2021 valuing at $2.1B).
Webflow Inc is a legitimate, 13-year-old San Francisco-based software company founded in 2013 and serving over 300k teams, including enterprise clients like Dropbox and Verifone. Business registration confirms active status with significant venture funding ($140M Series C in 2021). Professional reviews on independent sites praise the platform's design, CMS, and security capabilities.
However, security researchers have documented a significant abuse problem: cybercriminals have increasingly used Webflow's platform to host phishing pages, fake crypto wallets, and CAPTCHA scams. Threat-intelligence firms reported a 10-fold increase in traffic to malicious Webflow-hosted pages between April and September 2024. This reflects external abuse of the platform, not a compromise of Webflow's own infrastructure. Webflow maintains abuse-reporting channels and warns users to verify full URLs before trusting content on webflow.io subdomains.
Mixed user feedback exists: positive professional reviews for design and CMS features; isolated complaints on Reddit about billing and cancellation processes; and security warnings in Webflow communities about phishing impersonating the platform or agencies.
Antivirus Engines
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Contact Verification
We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.
- No contact email found anywhere on the page.
- No phone number listed on the page.
- Postal address visible on the page.
Domain & Encryption
Redirect Chain
- 1301http://webflow.io/
- 2200https://webflow.com/cross-domain
Server Reputation
Still, stay alert
No major threat indicators — but a clean scan does not guarantee every page is safe, and phishing emails routinely spoof real domains.
- Double-check the exact URL in your address bar
Confirm you are actually on webflow.io and not a lookalike like w-ebflow.io.com or an IDN homoglyph.
- Use a password manager
Password managers only auto-fill on the exact domain they were saved for — they refuse to fill lookalike domains, which is the single best phishing defence.
- OpenDiscuss this site on the forum
If you have first-hand experience with this site — good or bad — share it with the MalwareTips community.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review found no threat indicators on webflow.io. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.
- webflow.io passed our automated security checks with a trust score of 85/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.
- Yes. webflow.io presents a valid TLSv1.3 certificate issued by Amazon · Amazon RSA 2048 M01, expiring in 127 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- 1 out of 92 antivirus engines in our malware network flagged webflow.io as malicious or suspicious. Even one detection is a meaningful signal.
- No. webflow.io is not currently listed on the major browser blocklist feeds that modern browsers use.
- webflow.io resolves to an IP operated by Amazon Data Services Northern Virginia in US (usage type: Data Center/Web Hosting/Transit). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- Yes. webflow.io sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.
- This is a permanent record of the scan run on June 16, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around webflow.io have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.