CMS
Webflow audit: headers you cannot set in the Designer
· Configuration notes, not a newsroom.
SiteRune fingerprints Webflow from data-wf-page and the runtime. CSP, HSTS, and frame-ancestors usually need Cloudflare in front. The playbook says that without a CDN essay.
What the Designer will not do
Webflow gives you CMS, hosting, and a decent export. It does not give you arbitrary response headers. SiteRune will still score missing HSTS and CSP. The fix is almost always a proxy (Cloudflare transform rules, or another CDN) — not another Webflow app.
What we still expect in HTML
Titles, descriptions, canonicals, one H1, Organization JSON-LD, llms.txt at the origin, robots that do not ban GPTBot. Those are page settings and hosted files, not headers. If the hero is an image with no words in the HTML, seo-thin will fire even though the Designer looks full.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.