Secure Hosting with SSL

SSL (secure socket layer) establishes an encrypted connection between a web server and a browser, ensuring privacy and data integrity for all information transmitted.

Crucial: Websites lacking SSL may be marked as “insecure” by certain browsers, discouraging visitors from accessing your site. Occasionally, even if your site loads on HTTPS, it may still display “insecure” warnings. Learn how to troubleshoot these security issues on your website.

This tutorial will cover:

1. Advantages of Webflow SSL
2. Enabling SSL hosting
3. Disabling SSL hosting
4. Uploading a custom SSL certificate

Advantages of Webflow SSL

• Enhanced trust from Google and improved SEO
• Complete end-to-end encryption between your website and users
• Secure operation of ecommerce stores on Webflow with dynamic embeds

Key Features of Webflow SSL

• End-to-end SSL security between Webflow servers and your websites
• Automatic delivery of SSL for HTML/CSS/JS and all images
• Optimized SSL certificates for maximum compatibility
• Instant-on service with no setup needed

Important Information

• No need to generate a CSR. We handle the setup for you. Simply activate SSL in your Site settings.
• Webflow does not currently support named certificates
• Only Enterprise customers can utilize certificates from non-Webflow SSL providers at this time

Please note: Webflow SSL certificates are automatically renewed upon expiration, provided DNS records consistently point to Webflow and the site loads on Webflow SSL hosting servers. Custom SSL certificates are not automatically renewed; you must update them manually before expiration.

How to Activate SSL Hosting

Since 14 November 2018, SSL is enabled by default on all new Webflow sites. If you previously disabled SSL and wish to re-enable it, you can do so in Site settings.

To activate SSL hosting:

1. Navigate to Site settings > Publishing tab > Advanced publishing options
2. Switch on Enable SSL setting

Important: Whenever you toggle SSL on or off for a Webflow-hosted site, update your DNS records to ensure site functionality.

How to Deactivate SSL Hosting

Although you can disable SSL, we strongly advise against it as sites lacking SSL may be flagged as “insecure” by some browsers, dissuading visitors.

To deactivate SSL hosting:

1. Go to Site settings > Publishing tab > Advanced publishing options
2. Switch off Enable SSL setting

Note: SSL cannot be disabled on sites with Ecommerce or User Accounts functionality enabled for security reasons.

How to Upload a Custom SSL Certificate

For greater flexibility in hosting setup, you can upload your custom SSL certificates to your site.

Please note: Enterprise customers can avail the feature for custom SSL certificate uploads. Contact our sales team for further details.

Steps to Acquire a Custom SSL Certificate

You must obtain your custom SSL certificates from a third-party service as Webflow does not issue such certificates.

When obtaining your custom SSL certificate:

1. Generate a Certificate Signing Request (CSR) and private key. Utilize online CSR generators or local development tools like OpenSSL. Keep your private key secure as you’ll need it for Webflow installation later.
2. Select a Certificate Authority (CA) (a trusted SSL certificate issuer). Numerous commercial and free CAs are available.
3. Provide your CSR to the CA. When acquiring a certificate, the CA usually requires your CSR. Copy and paste the contents or upload the file to their platform.
4. Complete domain ownership verification steps and other validations. Depending on the CA and certificate type, you may need to prove domain ownership through methods like email verification or DNS records. Additional documentation might be necessary for certain certificates.
5. Receive and download the SSL certificate. Once approved, the CA will issue your custom SSL certificate. Download the certificate files provided by the CA and follow the instructions below for Webflow installation.

How to Add a Custom SSL Certificate

Note: Even with a custom SSL certificate, you must configure SSL settings on your Webflow site. Ensure SSL hosting is enabled and update DNS records accordingly.

Initially, access Site settings:

1. Visit your Dashboard
2. Select the desired site
3. Click on the “3 disclosure dots” to access site options
4. Choose Settings
5. Verify the site’s name and subdomain in the General tab

Next, follow these steps to add your custom SSL certificate:

1. Visit Publishing tab >  Custom SSL certificates
2. Click on Add Certificate
3. Enter your site’s domain in the Domain field (e.g., “yourdomain.com”) 
4. Paste your full certificate chain (RSA PEM format) into the SSL certificate chain field
5. Paste your private key into the Private key field
6. Click Add custom SSL certificate to finalize the process

Note: A single certificate can encompass multiple domains. If needed, upload the certificate multiple times for each domain.

How to Update a Custom SSL Certificate

If you opt for a custom SSL certificate, manual updates before expiration are necessary.

To update your custom SSL certificate, start by accessing Site settings:

1. Go to your Dashboard
2. Select the relevant site
3. Click on the “3 disclosure dots” to access site options
4. Choose Settings
5. Review the site’s name and subdomain in the General tab

To replace your original custom SSL certificate with an updated version, follow these steps:

1. Navigate to the Publishing tab > Custom SSL certificates
2. Click Delete next to the certificate you wish to replace
3. Upload your updated custom SSL certificate to the site