Is Webflow Secure, and Does It Run PHP?

Key takeaways

• Webflow has said something about the PHP flaws. Its Trust Center says its core services are not built on PHP and are not affected, and that no customer action is required.
• That is a vendor statement, not a promise. Webflow also says it is still assessing non-production systems that use PHP, so we repeat its words and do not claim anything is immune.
• Webflow runs the platform for you. Its hosting page says there are no updates to run or packages to install, and its security page says patches and updates are automated, so there is no PHP version for you to change.
• Your side still matters. Account sign-in, who has access and the third-party tools you add are the owner's job, as they are on any platform.
• Backups exist. Webflow's hosting page lists backups and versioning, with automatic backups you can preview and restore, and save points you make yourself.
• Anything beside the site can still run PHP. A separate WordPress blog, a booking tool or a form handler may use PHP even if the Webflow site does not.

The short answer

Is Webflow secure? It is a hosted platform, and Webflow publishes a fair amount about how it protects the servers, the network and the code that runs your pages. Does it run PHP? Webflow's Trust Center says its core services are not built on PHP.

Neither answer means you can stop paying attention. Webflow looks after the platform. You look after your account, your team's access and anything you paste into the site. The rest of this page separates the two.

For the PHP flaws themselves, read our main guide to the October 2026 PHP vulnerability. In short, php.net announced fixes on 21 October 2026 for two critical flaws that could let an outsider run commands on a server.

What Webflow says about the PHP flaws

Webflow's Trust Center (read on 22 October 2026) lists the two PHP flaws, CVE-2026-109618 and CVE-2026-109619, under its vulnerability announcements. It says Webflow is tracking them, that its core services are not built on PHP and are not affected, and that it is assessing non-production systems that use PHP. It also says no customer action is required.

We did not find a separate Webflow blog post or help article on the advisory, so this notice is the one source. Treat it as Webflow describing its own systems, which we cannot check from outside. It speaks about "core services", says the review of other systems is ongoing, and does not cover tools you connect to your site. That is why we write "Webflow says" and never "Webflow is immune". If you need the position in writing, copy the notice's wording and date from the Trust Center, or ask Webflow support.

Why a Webflow site has no PHP version to patch

A WordPress site is a program that runs on a server you rent, so the PHP version on that server matters to you. A Webflow site is built in the Designer and published to Webflow's own hosting. Webflow's hosting page calls this "zero maintenance": no updates to run, packages to install or capacity to plan, and it says Webflow continuously monitors for new vulnerabilities and deploys updates automatically. Its security page says the same from another side: automated patches and updates with no customer maintenance, and a global CDN with DDoS protection and built-in rate limiting for all sites.

Your pages are served from that setup. There is no control panel with a PHP switch, and nothing for you to update on a server. The platform's updates are Webflow's work.

What Webflow says it handles

Plan limits, such as how many backups a plan keeps, are on Webflow's help pages and change over time, so check the current page before you rely on one.

What stays your job

Webflow runs the platform. It does not run your team, your inbox or the scripts you add. These points are our own advice, based on how a hosted platform works, and not quotes from Webflow.

• Your account. Use a strong, unique password and turn on two-factor authentication, which Webflow's security page lists among its access features.
• Who can do what. Webflow's security page lists role-based access control. Give each person the lowest role that lets them do the job, and remove people who have left.
• Custom code. Code you paste into a site runs on your pages and is yours to check. Keep a list of what is added and why.
• Third-party scripts. Chat widgets, trackers and embeds are code from other companies that runs on your pages. Remove the ones you no longer use.
• Ecommerce and forms. If you take payments or collect personal data through added tools, read those tools' own security pages.

Backups and restoring a Webflow site

Webflow's hosting page lists "backups and versioning": you can preview and restore your site from ongoing automatic backups, or create save points to mark progress. How many backups a plan keeps, and who may restore them, are plan details on Webflow's help pages, so read those before a big change. A good habit on any platform is a named backup before major edits, and a test restore at least once so you know it works.

Who handles what: Webflow and self-hosted WordPress

This table is general. Details change with your host and plan.

WordPress.org's advice during the PHP event was that the site owner should check the PHP version in Site Health and ask the host, because the server holds it. For that side of the story, see our guides to checking and updating PHP on WordPress and what to ask your web host.

Where PHP can still reach a Webflow owner

Even if the Webflow site has no PHP, the business around it may. Check these:

• A WordPress blog or help centre on a subdomain.
• A booking, quote or membership tool that you embed from another company.
• A form handler on a separate server that your forms post to.
• An old copy of the previous WordPress site that is still online.

The NCSC's advice is to find every system that runs PHP, including products that bundle it. Make a short list and ask each vendor.

Moving off PHP is one option, not the only one

A hosted builder leaves server patching to someone else. A managed WordPress host may do the same. Our guide to Webflow and WordPress for a service business covers when each fits, and how much a Webflow website costs covers the budget.

How we help

We build and look after Webflow sites, so we can work through this checklist with you: roles and two-factor sign-in, the custom code and third-party scripts on each page, and a backup routine you can restore from. If you are on WordPress and want to leave server patching behind, Webflow migration moves the site with its URLs. For ongoing care, see Webflow maintenance and Webflow development. After final payment, the accounts for domain, hosting and analytics are registered to you.

Frequently asked questions

Is Webflow secure?

Webflow publishes SOC 2 Type II and ISO 27001 status on its Trust Center, and says hosting includes SSL, DDoS protection and automated patches and updates. That covers the platform. Your account, team roles, custom code and third-party scripts are still yours to look after.

Does Webflow use PHP?

Webflow's Trust Center says its core services are not built on PHP. It also says it is assessing non-production systems that use PHP. A Webflow site you publish has no PHP version for you to manage.

Was Webflow affected by the October 2026 PHP flaws?

Webflow says its core services are not affected and that no customer action is required. We cannot test that from outside, so treat it as Webflow's statement. We would also check any tool you connect to the site.

Do I need to update anything on my Webflow site?

Webflow says no customer action is required for the PHP flaws. It is still a good time to review who has access, turn on two-factor sign-in and list the third-party scripts on your pages.

Can my Webflow site be hacked?

No platform can promise that. Common risks for a hosted site are stolen logins, an over-trusting team role, or a bad script added through custom code. These are the parts that stay with the owner on any platform.

Does Webflow back up my site?

Webflow's hosting page lists backups and versioning, with automatic backups you can preview and restore. Plan limits are on its help pages. Make a named backup before large changes.