Webflow Release Notes

Find the right comments faster with search and filters

Search, filter, and sort comments by name, page, or text. Find the feedback you need faster on projects with hundreds of comments.

On a major project, feedback can add up to hundreds of comments, and filtering the ones that matter to you can take a lot of time. Now, you can search, filter, and sort through all comments so you can focus on the feedback most relevant to you.

What's new:

• Search by commenter name, page name, and comment text.
• Filter by Unread only, Author, Page or Locale.
• Sort by Recently updated or Oldest first.
• Filter indicator: A dot appears when filters are active, so you always know your view is filtered.

Access the Webflow MCP in Microsoft Copilot

Webflow is now available in Microsoft Copilot. Build, update, and optimize your sites with natural language prompts and built-in Skills.

You can now connect the Webflow MCP to Microsoft Copilot to build, update, and optimize your Webflow sites. This new experience supports built-in Skills, specialized workflows that automate complex tasks while following Webflow best practices.

Here’s what you can do:

• Build on brand, faster: Create responsive pages and reusable components based on your designs and brand.
• Manage content at scale: Set up and restructure CMS collections, then write and update items in bulk.
• Add motion and interactions to pages: Build interactions on page, then fine-tune results yourself on a visual timeline in Webflow.
• Get visibility into site performance: Ask questions about traffic, top pages, and engagement over time without leaving your conversation in Copilot.
• Find and fix issues in one pass: Improve SEO/AEO and audit for accessibility, broken links, performance, and content quality.
• Read AI crawler and answer engine data: See which pages LLM crawlers request most, plus your tracked prompts and how answer engines responded.

Webflow for Copilot is free to install and doesn't currently use Webflow AI credits.

Portable code library bundles

Add --portable to webflow devlink bundle or webflow devlink import to produce a production client bundle that you can host at a different origin or path.

webflow devlink bundle --portable --public-path https://example.com/assets/

A portable bundle:

• Loads its assets relative to the bundle, so you can serve it from any origin or path.
• Lists every emitted client asset under portable.files in Client/wf-manifest.json, so a host knows which files to copy.
• Keeps images, fonts, and other binary files intact. Before, binary files in a bundle could be corrupted.

Server-side rendering still uses absolute asset URLs. With devlink bundle --portable, pass --public-path with the URL prefix your host serves assets from. If you leave it out, server-rendered assets use http://localhost/ and the CLI prints a warning. With devlink import --portable, the CLI gets the prefix from Webflow.

--portable needs a production build, so it can't be used with --dev. If your bundler configuration sets output.publicPath, remove it when you use --portable.

One login session per region

webflow auth login now keeps one session for each region. Logging in to the US region no longer signs you out of the EU region.

webflow auth logout clears only the active region. Use --region to choose a different one.

Webflow Cloud deploys

webflow apps deploy accepts --environment-id and reuses the environment linked in webflow.json. A linked directory can deploy with --json without repeating --environment and --mount. The success JSON now includes branch and mount.

webflow apps env-vars import accepts --secret-env-file <path>, so you can import a file of secrets together with a plain .env file in one request.

Deploys accept build output up to the limit that Webflow sends, currently 4 GiB. The limit used to be a fixed 100 MB. The CLI also streams the archive during upload instead of loading the whole file into memory.

Consistent JSON output for apps commands

Apps commands that write data now include every --dry-run plan key in their success --json output, plus dryRun: false, so one parser handles both. Existing keys are unchanged.

apps deployments redeploy reports the deployment it ran again as sourceDeploymentId.

apps init --dry-run --json also reports manifestPath in its plan.

Other fixes

Fixed the CLI printing "Command completed successfully" in verbose mode after a command failed.

Fixed apps deployments trigger --wait and apps deployments redeploy --wait not following the requested deployment when other deployments run at the same time, or when you retry an identical request.

Upgraded Zod to 4.x. Validation errors for invalid configuration files and Sync API responses now use Zod 4's wording. For example, a missing results array now reports result.results: Invalid input: expected array, received undefined instead of result.results: Required.

Updated the adm-zip dependency to 0.6.1 to address ZIP processing vulnerabilities.

Upgrading

npm install -g @webflow/webflow-cli@latest

The new robots.txt content endpoints read and write the exact text value of the robots.txt field under Site settings > SEO > Indexing. The text is sent and returned in a content field, and Webflow keeps comments, blank lines, and directives such as Crawl-delay.

robots.txt Content

• Get robots.txt Content returns the field's text.
• Replace robots.txt Content replaces the field's text. The text must be 512,000 bytes (500 KiB) or smaller.
• Delete robots.txt Content clears the field.

Endpoints

• GET /beta/sites/{site_id}/robots_txt/content
• PUT /beta/sites/{site_id}/robots_txt/content
• DELETE /beta/sites/{site_id}/robots_txt/content

Requirements

• Scopes: site_config:read to read, site_config:write to replace or clear
• Plan: the site must be on an Enterprise plan
• Publishing: the published robots.txt file changes only after you publish the site

The robots.txt endpoints write the published robots.txt file directly. The next site publish replaces that file with the text from the robots.txt field, so changes made through the robots.txt endpoints are lost. Use one set of endpoints for a site, not both.

The new Sitemap Indexing endpoints read and update whether CMS items and static pages are listed in a site's sitemap.xml file. Each endpoint works with the includeInSitemap setting only, so you can change sitemap settings without sending item field data or page settings.

CMS items

• List Item Sitemap Settings lists the staged setting of each item in a collection.
• List Live Item Sitemap Settings lists the live setting of each item in a collection.
• Get Item Sitemap Setting returns the staged setting of one item.
• Get Live Item Sitemap Setting returns the live setting of one item.
• Update Item Sitemap Setting updates one item.
• Update Item Sitemap Settings updates up to 100 items in one request.

Pages

• List Page Sitemap Settings lists the setting of each static page on a site.
• Get Page Sitemap Setting returns the setting of one page.
• Update Page Sitemap Setting updates one page.
• Update Page Sitemap Settings updates up to 100 pages in one request.

Requirements

• Scopes: cms:read and cms:write for CMS items, pages:read and pages:write for pages
• Plan: the site must be on an Enterprise plan
• Beta access: the endpoints return 404 for workspaces that aren't in the sitemap indexing beta
• Publishing: item updates apply to staged items, and publishing an item doesn't rebuild sitemap.xml. The live sitemap.xml file changes after you publish the site. Publishing a single page from the Designer updates only that page's entry.

v2.15.0 lets code libraries turn server-side rendering off by default, fixes the names of installed skills, and updates a dependency.

Set a default for SSR in code libraries

Add "ssrDefault": false under library in your manifest file to set the default ssr value for all components in the library. A component's own ssr option still overrides it.

When no component has SSR enabled, webflow devlink import and webflow devlink bundle skip the server bundle, and devlink import no longer registers one.

Installed skills use the directory name

Installed skills now declare the same name as the directory they are installed into, for example webflow-cli-cloud. Before, the installed SKILL.md used the catalog name webflow-cli:cloud, which is not a valid skill name and caused warnings in Pi.

Existing installs are updated the next time you run webflow skills update. Skills you edited locally are left alone until you update them with --force. Pi now reads the shared .agents/skills folder instead of its own copy.

Other fixes

Updated form-data to 4.0.6 to address a multipart header injection issue (GHSA-hmw2-7cc7-3qxx).

Upgrading

npm install -g @webflow/webflow-cli@latest

The new Bulk Remove Workspace Members endpoint removes Members and cancels pending invites from an Enterprise workspace in one request. It is the only API endpoint that cancels an invite.

DELETE /v2/workspaces/{workspace_id}/members/bulk

Scope:workspace_members:write

• Limit: up to 100 Member and invite IDs combined, per request
• Partial success: the endpoint answers 200 even when some items fail. Read summary and results to see which IDs were removed and which failed. A 4xx response means Webflow refused the whole request and removed nothing.

Remove Workspace Member removes active Members only. It can't cancel an invite. Removing a Member from the workspace is broader than revoking their access to one site.

This endpoint shares a path with Bulk Update Workspace Member Roles. POST changes roles and DELETE removes.

Add a default component to a slot so it’s auto-populated on every component instance.

Component slots provide a lot of configurability, but they can also lead to ambiguity and redundant work for cross-functional collaborators.

An empty slot gives Marketers zero indication of what belongs there. Designers know how each component should be used, but handing it off means documenting the dos and don'ts or rebuilding the same setup on every instance.

So starting today, Designers can add components to a slot on a main component to make it the slot's default. For example, if you add a button component to a slot on a main card component, the next time you add that card to a page, it will arrive with its button components already in the slot, ready to customize.

When you update the default in a main component, every instance that still uses that component will update too. But marketers still retain flexibility. They can swap the content for other components, reset the slot to the default, or clear it for customized instances.

Default components for slots join show/hide controls for Marketers and slot restrictions as new guardrails to help you confidently hand-off a component system.

Good to know

• Slot defaults accept components only. Components in CMS Rich Text show their slot defaults, but you can't edit slot content there.
• Default components for slots are available on all plans and should be available to all Webflow users by tomorrow.

You can now see where an agent is working live on the canvas, the same way you’d see a teammate.

AI Agents can support work across your site with incredible speed. But until now, most of that work happened behind the scenes, with changes “automagically” appearing as the agent completed each task.

Earlier this year, we added AI attribution to the site activity log, giving you a clear record of what agents changed, when, and who prompted the work. But a log only tells you what already happened.

That’s why we’re introducing agent presence. Now, when an agent connects to your site through Webflow’s MCP server, you’ll see where it’s working live on the canvas, the same way you’d see a teammate.

Whether you’re working alongside your own agent, or those of your teammates, agent presence provides the real-time visibility you need to collaborate with agents confidently at scale.

Agent presence starts rolling out today and will be available in all Workspaces by the end of next week, at no additional cost.

If you haven’t already connected an agent to the Webflow MCP, check out our quick start guide to give it a spin. Already using the MCP? Visit our help center to learn more about agent presence and all the ways your agent can interact with Webflow.

v2.14.0

Stops writing access tokens to .env, makes code library builds fail when more than one React copy would ship, and tightens deploy interrupt recovery, --json output, and resource id validation.

Session-based auth — no token in .env

webflow auth login and webflow apps init no longer write your access token to .env. The CLI uses your login session instead (apps init still writes WEBFLOW_SITE_ID).

A token loaded from ./.env is never sent to the other region's API: a session for the region you're targeting takes precedence, and a command whose session belongs to the other region stops with exit code 3 before sending anything. Export WEBFLOW_API_TOKEN in your shell to override deliberately.

webflow auth logout warns if ./.env still holds a token, and now supports --json. webflow auth status labels a token that came from ./.env and reports a cross-region refusal as not ready.

Single React copy in code library builds

Code library builds now resolve react and react-dom from your library's root folder (the one with webflow.json). A dependency or workspace package that installs its own React no longer adds a second copy to the bundle.

If the build still finds more than one copy, or the react and react-dom versions don't match, it fails and lists where each copy comes from. Before this, those builds succeeded but the components crashed in the Designer.

Add --dry-run to webflow devlink import or webflow library share to run every build check without creating or uploading the library.

Other fixes

apps init --site-id now saves the site in webflow.json, so site-attached apps deploy can validate the mount (and auto-publish with --auto-publish) before the first deploy wrote the site.

Ctrl-C during apps deploy restores your framework config and marks the deployment failed (exit 130). A later deploy recovers the original config instead of overwriting a leftover backup.

--json output is exactly the JSON document — no leading blank line or one-space indent. cms --dry-run --json prints only the plan document.

Out-of-support Next.js majors (for example Next.js 15) build again on Webflow Cloud instead of failing OpenNext's support-policy check.

apps commands and cloud deploy reject malformed resource ids before calling the API (app/environment/deployment ids must be UUIDs; site/workspace ids must be 24-character hex), exiting 2 instead of a 404 or empty result.

Upgrading

npm install -g @webflow/webflow-cli@latest

Your next campaign shouldn’t have to wait in the web team's backlog. Recently announced at Webflow Conf, Webflow Campaigns is now available for purchase.

Built for demand gen, growth, and performance marketers, this new standalone tool brings on-brand landing pages, personalized variations, ad creative, and reporting into one workflow. Build and launch on your own timeline, without waiting in the web team’s queue. Campaigns runs independently of your core website, so marketers can launch on their own terms.

Here’s how it works

Create on-brand landing pages and ads

Campaigns extracts your brand into a reusable design system, then uses your campaign brief to generate landing pages and message-matched ads. Customize copy, layouts, and creative in a visual canvas built for marketers, or build through your preferred AI tools using Webflow’s MCP.

Personalize pages for your audiences

Create page variations for different personas, industries, or individual accounts. Each variation has its own URL, so you can direct audiences to relevant messaging.

Connect your forms and launch

Connect Marketo or HubSpot forms so leads enter your existing marketing workflows. With the Google Ads integration, you can set up and launch Performance Max campaigns directly in Webflow.

Measure performance and improve

Track sessions and conversions, and connect HubSpot or Salesforce to understand pipeline impact. AI insights surface recommendations to help you decide what to improve next.

Ready to launch your next campaign?

Read more about the product launch. Book a demo today to see Webflow Campaigns in action.

In August we said automated guideline checks were coming to app submissions. They're live. The App submission form now checks your submission before it accepts it, and names the field to fix when a check fails.

What the form checks

Listing content, URLs, and install URL against the Marketplace Guidelines: English copy, disclosed pricing, explained scopes, review access that doesn't expire, hosted demo videos, and an install URL whose client_id and scopes match your submission and that starts a valid install when probed.

Submission artifacts. A published .webflow.io testing site with your app installed and, for new or changed Designer Extension bundles, the private review ZIP with source maps, package.json, and the lockfile.

Your App Review Preflight receipt. A receipt is now required for new Apps and for updates that change your App's code or scopes; listing-only updates skip it. The form verifies the receipt with Preflight and reads the result of that run. ready and needs_review pass. changes_required blocks submission until you fix every Blocker and Required update and run Preflight again.

Preflight's production-runtime findings don't block submission. The published-site practices they check, such as subresource integrity and immutable script URLs, are recommended practices, not review gates.

Preflight only blocks on certain matches

App Review Preflight now labels each finding on two axes. The published guideline sets the weight: a MUST is a Blocker or Required update, a recommended practice is a Suggested update. How certain the match is decides whether it gates: only a certain match produces changes_required, a probable match goes to Manual review (needs_review), and a hint stays a suggestion. A syntax-tree pass confirms context the pattern match can't see, such as whether window.open runs at load or inside a click handler, and React DOM's resource hoisting no longer registers as script injection.

What to do before you submit

Run Preflight on the bundle and review ZIP you're about to upload, fix what it reports, and paste the receipt into the form. A clean run is not an approval, but it removes the round where a reviewer finds what Preflight would have told you first. See Submitting your app for the full list of checks.

Questions

Open a ticket at support.webflow.com. Support tickets are the reliable path to the Marketplace team.

Agents using Webflow’s MCP server can now read how your site is performing across Analyze, Optimize, and AEO Analytics. Ask about page-level traffic, goal data, experiment results, and AI visibility alongside the rest of your site context.

You can now access these insights from Google Gemini, which joins Claude and ChatGPT as a connector for Webflow’s MCP server. Gemini support for Webflow Enterprise plans is in development.

Here’s what’s new.

• Query page-level traffic and goal data from Analyze
• Read Optimize experiments and their results
• Read the pages LLM crawlers request most, plus your tracked prompts and how answer engines responded
• Connect Google Gemini to your site through Webflow’s MCP server
• Invite people, change roles, and remove access to your workspace and sites from an agent or script with Team Administration

Resources

• Read the full announcement
• Check out our developer docs to see how it works
• Learn more about the Google Gemini connector

MCP v2.2 gives agents the data to run an optimization loop. They can read Optimize results to see which variation is winning, track your AEO performance across answer engines and AI crawlers, and use new page-level Analyze reports (scroll depth, window height, page flow, and goals) to understand why. Together, that gives agents what they need to validate the tests you run and improve your AEO scores.

v2.2 also adds team administration, so agents can manage workspace and site access and tie Webflow permissions into your other systems.

New tools

AEO

Agents get read access to answer engine optimization AEO data, which shows how AI bots visit your site and how answer engines mention and cite you. Agents can now:

• Measure LLM crawler traffic, as a total request count or as the pages crawlers request most.
• Review tracked prompts and the history of their executions, including the full response when it is still stored.
• Track brand visibility as one score or a time series, or grouped by topic or prompt.
• Analyze citations: citation rate by topic or prompt, the most-cited domains, cited paths for a domain, citation share for a page or CMS item, competitor citations, and individual citation rows.
• Read the query guide before building a query.

Optimize

Agents get read access to Webflow Optimize results, so they can report on which variation is winning. Agents can now:

• List the Optimize resources a token can access, and the optimizations in each with their type, status, and intervals.
• Read results for one optimization over a report window: per-variation results overall, split by an audience dimension, or per daily or weekly bucket.
• Discover the goals and dimensions available for an optimization, and the values a dimension took.

Team Admin

Agents can manage who can work in a workspace and on its sites.

• List a workspace's members and invites, the members with access to a site, and the built-in and custom site roles a workspace can assign.
• Invite someone to a workspace by email, with initial site access.
• Grant, change, or revoke a member's access to a site.
• Change workspace roles for one member, or for up to 100 members and invites in a single call.
• Remove a member from a workspace and all of its sites.

Updates

Analyze

Deep page-level data like scroll-depth distribution, average browser window height, page flow, site goals, and daily conversion counts

Campaigns

Campaigns can now personalize images. Agents can create image fields as well as text fields, and bind them to element settings and component props.

Box element

Agents can now build with Box, Webflow's single element for structure and layout. Box replaces the Div Block, Section, Container, Columns, Grid, V Flex, and H Flex elements, and the HTML tag is a setting on the Box: div, section, header, footer, nav, main, article, aside, address, or figure.

Agents can create a Box directly and set its tag.

Asking an agent for a Section or Container now creates a Box, with the section or div tag.

Elements already on your sites keep working.

Migration

No tool or action names changed in v2.2, and everything in this release is additive.

Learn more

See the MCP Reference for the full set of actions and required parameters.

The Analyze API now includes three new reports and two goals endpoints. They require the sites:read scope and a workspace with the Analyze add-on, like the existing Analyze reports.

Analyze

• Scroll depth: the scroll depth (in pixels) that 75%, 50%, and 25% of page views reached.
• Browser window height: average browser window height in CSS pixels over a time window.
• Page flow: pages visitors viewed immediately before or after a selected page, ranked by sessions, users, or page views.
• List goals: the goals configured for your site, including each goal's type, whether it's a site goal, and its integration source (HubSpot, Marketo, or Shopify).
• Goal performance: daily unique conversions for one goal, bucketed in the time zone you choose.

See Working with Analyze for a walkthrough of goal conversions.