Webflow Developers Updates & Release Notes

Portable code library bundles

Add --portable to webflow devlink bundle or webflow devlink import to produce a production client bundle that you can host at a different origin or path.

webflow devlink bundle --portable --public-path https://example.com/assets/

A portable bundle:

• Loads its assets relative to the bundle, so you can serve it from any origin or path.
• Lists every emitted client asset under portable.files in Client/wf-manifest.json, so a host knows which files to copy.
• Keeps images, fonts, and other binary files intact. Before, binary files in a bundle could be corrupted.

Server-side rendering still uses absolute asset URLs. With devlink bundle --portable, pass --public-path with the URL prefix your host serves assets from. If you leave it out, server-rendered assets use http://localhost/ and the CLI prints a warning. With devlink import --portable, the CLI gets the prefix from Webflow.

--portable needs a production build, so it can't be used with --dev. If your bundler configuration sets output.publicPath, remove it when you use --portable.

One login session per region

webflow auth login now keeps one session for each region. Logging in to the US region no longer signs you out of the EU region.

webflow auth logout clears only the active region. Use --region to choose a different one.

Webflow Cloud deploys

webflow apps deploy accepts --environment-id and reuses the environment linked in webflow.json. A linked directory can deploy with --json without repeating --environment and --mount. The success JSON now includes branch and mount.

webflow apps env-vars import accepts --secret-env-file <path>, so you can import a file of secrets together with a plain .env file in one request.

Deploys accept build output up to the limit that Webflow sends, currently 4 GiB. The limit used to be a fixed 100 MB. The CLI also streams the archive during upload instead of loading the whole file into memory.

Consistent JSON output for apps commands

Apps commands that write data now include every --dry-run plan key in their success --json output, plus dryRun: false, so one parser handles both. Existing keys are unchanged.

apps deployments redeploy reports the deployment it ran again as sourceDeploymentId.

apps init --dry-run --json also reports manifestPath in its plan.

Other fixes

Fixed the CLI printing "Command completed successfully" in verbose mode after a command failed.

Fixed apps deployments trigger --wait and apps deployments redeploy --wait not following the requested deployment when other deployments run at the same time, or when you retry an identical request.

Upgraded Zod to 4.x. Validation errors for invalid configuration files and Sync API responses now use Zod 4's wording. For example, a missing results array now reports result.results: Invalid input: expected array, received undefined instead of result.results: Required.

Updated the adm-zip dependency to 0.6.1 to address ZIP processing vulnerabilities.

Upgrading

npm install -g @webflow/webflow-cli@latest

Original source

The new robots.txt content endpoints read and write the exact text value of the robots.txt field under Site settings > SEO > Indexing. The text is sent and returned in a content field, and Webflow keeps comments, blank lines, and directives such as Crawl-delay.

robots.txt Content

• Get robots.txt Content returns the field's text.
• Replace robots.txt Content replaces the field's text. The text must be 512,000 bytes (500 KiB) or smaller.
• Delete robots.txt Content clears the field.

Endpoints

• GET /beta/sites/{site_id}/robots_txt/content
• PUT /beta/sites/{site_id}/robots_txt/content
• DELETE /beta/sites/{site_id}/robots_txt/content

Requirements

• Scopes: site_config:read to read, site_config:write to replace or clear
• Plan: the site must be on an Enterprise plan
• Publishing: the published robots.txt file changes only after you publish the site

The robots.txt endpoints write the published robots.txt file directly. The next site publish replaces that file with the text from the robots.txt field, so changes made through the robots.txt endpoints are lost. Use one set of endpoints for a site, not both.

Original source

The new Sitemap Indexing endpoints read and update whether CMS items and static pages are listed in a site's sitemap.xml file. Each endpoint works with the includeInSitemap setting only, so you can change sitemap settings without sending item field data or page settings.

CMS items

• List Item Sitemap Settings lists the staged setting of each item in a collection.
• List Live Item Sitemap Settings lists the live setting of each item in a collection.
• Get Item Sitemap Setting returns the staged setting of one item.
• Get Live Item Sitemap Setting returns the live setting of one item.
• Update Item Sitemap Setting updates one item.
• Update Item Sitemap Settings updates up to 100 items in one request.

Pages

• List Page Sitemap Settings lists the setting of each static page on a site.
• Get Page Sitemap Setting returns the setting of one page.
• Update Page Sitemap Setting updates one page.
• Update Page Sitemap Settings updates up to 100 pages in one request.

Requirements

• Scopes: cms:read and cms:write for CMS items, pages:read and pages:write for pages
• Plan: the site must be on an Enterprise plan
• Beta access: the endpoints return 404 for workspaces that aren't in the sitemap indexing beta
• Publishing: item updates apply to staged items, and publishing an item doesn't rebuild sitemap.xml. The live sitemap.xml file changes after you publish the site. Publishing a single page from the Designer updates only that page's entry.

Original source

v2.15.0 lets code libraries turn server-side rendering off by default, fixes the names of installed skills, and updates a dependency.

Set a default for SSR in code libraries

Add "ssrDefault": false under library in your manifest file to set the default ssr value for all components in the library. A component's own ssr option still overrides it.

When no component has SSR enabled, webflow devlink import and webflow devlink bundle skip the server bundle, and devlink import no longer registers one.

Installed skills use the directory name

Installed skills now declare the same name as the directory they are installed into, for example webflow-cli-cloud. Before, the installed SKILL.md used the catalog name webflow-cli:cloud, which is not a valid skill name and caused warnings in Pi.

Existing installs are updated the next time you run webflow skills update. Skills you edited locally are left alone until you update them with --force. Pi now reads the shared .agents/skills folder instead of its own copy.

Other fixes

Updated form-data to 4.0.6 to address a multipart header injection issue (GHSA-hmw2-7cc7-3qxx).

Upgrading

npm install -g @webflow/webflow-cli@latest

Original source

The new Bulk Remove Workspace Members endpoint removes Members and cancels pending invites from an Enterprise workspace in one request. It is the only API endpoint that cancels an invite.

DELETE /v2/workspaces/{workspace_id}/members/bulk

Scope:workspace_members:write

• Limit: up to 100 Member and invite IDs combined, per request
• Partial success: the endpoint answers 200 even when some items fail. Read summary and results to see which IDs were removed and which failed. A 4xx response means Webflow refused the whole request and removed nothing.

Remove Workspace Member removes active Members only. It can't cancel an invite. Removing a Member from the workspace is broader than revoking their access to one site.

This endpoint shares a path with Bulk Update Workspace Member Roles. POST changes roles and DELETE removes.

Original source

v2.14.0

Stops writing access tokens to .env, makes code library builds fail when more than one React copy would ship, and tightens deploy interrupt recovery, --json output, and resource id validation.

Session-based auth — no token in .env

webflow auth login and webflow apps init no longer write your access token to .env. The CLI uses your login session instead (apps init still writes WEBFLOW_SITE_ID).

A token loaded from ./.env is never sent to the other region's API: a session for the region you're targeting takes precedence, and a command whose session belongs to the other region stops with exit code 3 before sending anything. Export WEBFLOW_API_TOKEN in your shell to override deliberately.

webflow auth logout warns if ./.env still holds a token, and now supports --json. webflow auth status labels a token that came from ./.env and reports a cross-region refusal as not ready.

Single React copy in code library builds

Code library builds now resolve react and react-dom from your library's root folder (the one with webflow.json). A dependency or workspace package that installs its own React no longer adds a second copy to the bundle.

If the build still finds more than one copy, or the react and react-dom versions don't match, it fails and lists where each copy comes from. Before this, those builds succeeded but the components crashed in the Designer.

Add --dry-run to webflow devlink import or webflow library share to run every build check without creating or uploading the library.

Other fixes

apps init --site-id now saves the site in webflow.json, so site-attached apps deploy can validate the mount (and auto-publish with --auto-publish) before the first deploy wrote the site.

Ctrl-C during apps deploy restores your framework config and marks the deployment failed (exit 130). A later deploy recovers the original config instead of overwriting a leftover backup.

--json output is exactly the JSON document — no leading blank line or one-space indent. cms --dry-run --json prints only the plan document.

Out-of-support Next.js majors (for example Next.js 15) build again on Webflow Cloud instead of failing OpenNext's support-policy check.

apps commands and cloud deploy reject malformed resource ids before calling the API (app/environment/deployment ids must be UUIDs; site/workspace ids must be 24-character hex), exiting 2 instead of a 404 or empty result.

Upgrading

npm install -g @webflow/webflow-cli@latest

Original source

In August we said automated guideline checks were coming to app submissions. They're live. The App submission form now checks your submission before it accepts it, and names the field to fix when a check fails.

What the form checks

Listing content, URLs, and install URL against the Marketplace Guidelines: English copy, disclosed pricing, explained scopes, review access that doesn't expire, hosted demo videos, and an install URL whose client_id and scopes match your submission and that starts a valid install when probed.

Submission artifacts. A published .webflow.io testing site with your app installed and, for new or changed Designer Extension bundles, the private review ZIP with source maps, package.json, and the lockfile.

Your App Review Preflight receipt. A receipt is now required for new Apps and for updates that change your App's code or scopes; listing-only updates skip it. The form verifies the receipt with Preflight and reads the result of that run. ready and needs_review pass. changes_required blocks submission until you fix every Blocker and Required update and run Preflight again.

Preflight's production-runtime findings don't block submission. The published-site practices they check, such as subresource integrity and immutable script URLs, are recommended practices, not review gates.

Preflight only blocks on certain matches

App Review Preflight now labels each finding on two axes. The published guideline sets the weight: a MUST is a Blocker or Required update, a recommended practice is a Suggested update. How certain the match is decides whether it gates: only a certain match produces changes_required, a probable match goes to Manual review (needs_review), and a hint stays a suggestion. A syntax-tree pass confirms context the pattern match can't see, such as whether window.open runs at load or inside a click handler, and React DOM's resource hoisting no longer registers as script injection.

What to do before you submit

Run Preflight on the bundle and review ZIP you're about to upload, fix what it reports, and paste the receipt into the form. A clean run is not an approval, but it removes the round where a reviewer finds what Preflight would have told you first. See Submitting your app for the full list of checks.

Questions

Open a ticket at support.webflow.com. Support tickets are the reliable path to the Marketplace team.

Original source

MCP v2.2 gives agents the data to run an optimization loop. They can read Optimize results to see which variation is winning, track your AEO performance across answer engines and AI crawlers, and use new page-level Analyze reports (scroll depth, window height, page flow, and goals) to understand why. Together, that gives agents what they need to validate the tests you run and improve your AEO scores.

v2.2 also adds team administration, so agents can manage workspace and site access and tie Webflow permissions into your other systems.

New tools

AEO

Agents get read access to answer engine optimization AEO data, which shows how AI bots visit your site and how answer engines mention and cite you. Agents can now:

• Measure LLM crawler traffic, as a total request count or as the pages crawlers request most.
• Review tracked prompts and the history of their executions, including the full response when it is still stored.
• Track brand visibility as one score or a time series, or grouped by topic or prompt.
• Analyze citations: citation rate by topic or prompt, the most-cited domains, cited paths for a domain, citation share for a page or CMS item, competitor citations, and individual citation rows.
• Read the query guide before building a query.

Optimize

Agents get read access to Webflow Optimize results, so they can report on which variation is winning. Agents can now:

• List the Optimize resources a token can access, and the optimizations in each with their type, status, and intervals.
• Read results for one optimization over a report window: per-variation results overall, split by an audience dimension, or per daily or weekly bucket.
• Discover the goals and dimensions available for an optimization, and the values a dimension took.

Team Admin

Agents can manage who can work in a workspace and on its sites.

• List a workspace's members and invites, the members with access to a site, and the built-in and custom site roles a workspace can assign.
• Invite someone to a workspace by email, with initial site access.
• Grant, change, or revoke a member's access to a site.
• Change workspace roles for one member, or for up to 100 members and invites in a single call.
• Remove a member from a workspace and all of its sites.

Updates

Analyze

Deep page-level data like scroll-depth distribution, average browser window height, page flow, site goals, and daily conversion counts

Campaigns

Campaigns can now personalize images. Agents can create image fields as well as text fields, and bind them to element settings and component props.

Box element

Agents can now build with Box, Webflow's single element for structure and layout. Box replaces the Div Block, Section, Container, Columns, Grid, V Flex, and H Flex elements, and the HTML tag is a setting on the Box: div, section, header, footer, nav, main, article, aside, address, or figure.

Agents can create a Box directly and set its tag.

Asking an agent for a Section or Container now creates a Box, with the section or div tag.

Elements already on your sites keep working.

Migration

No tool or action names changed in v2.2, and everything in this release is additive.

Learn more

See the MCP Reference for the full set of actions and required parameters.

Original source

The Analyze API now includes three new reports and two goals endpoints. They require the sites:read scope and a workspace with the Analyze add-on, like the existing Analyze reports.

Analyze

• Scroll depth: the scroll depth (in pixels) that 75%, 50%, and 25% of page views reached.
• Browser window height: average browser window height in CSS pixels over a time window.
• Page flow: pages visitors viewed immediately before or after a selected page, ranked by sessions, users, or page views.
• List goals: the goals configured for your site, including each goal's type, whether it's a site goal, and its integration source (HubSpot, Marketo, or Shopify).
• Goal performance: daily unique conversions for one goal, bucketed in the time zone you choose.

See Working with Analyze for a walkthrough of goal conversions.

Original source

The Designer API now includes a Box element preset. Box is a block element with a semantic HTML tag: div, section, header, footer, nav, main, article, aside, address, or figure.

Creating Box elements

Use webflow.elementPresets.Box to create a Box element:

const selectedElement = await webflow.getSelectedElement();
if (selectedElement?.children) {
const box = await selectedElement.append(webflow.elementPresets.Box);
if (box.type === 'Block') {
await box.setTag('section');
}
}

Creating an element by tag name also creates a Box element when you pass one of the 10 tags above, such as element.append('div') or element.append('section').

Deprecated presets

These presets still work but are deprecated. Use Box instead:

• DivBlock
• Section
• BlockContainer
• Grid
• Row
• HFlex
• VFlex

Migrating from the Section preset

The Section preset no longer returns an element with the type Section. It now returns a BlockElement with the type Block, the same as Box and DivBlock.

If your app checks for element.type === 'Section' after creating an element with the Section preset, update the check to Block.

Checking the HTML tag

A Block element can use any of the 10 tags, so the element type doesn't tell you the HTML element.

Narrow the element type, then use element.getTag() to read the tag. getTag() also works for custom elements.

const element = await webflow.getSelectedElement();
if (element?.type === 'Block') {
console.log(await element.getTag()); // for example, 'section'
}

For more information, see Element presets and Get HTML tag.

Original source

The AEO Analytics API lets you read how AI bots visit your site, and how answer engines mention and cite you. AEO, or answer engine optimization, is the practice of improving how your content appears in AI-generated answers. It works with sites that have the AEO analytics entitlement.

Bot traffic

• Get Bot Traffic — total requests from the AI bots Webflow tracks, by provider or category
• Get Bot Traffic by Page — the pages and files bots requested most

Prompts

• List Prompts — your tracked prompts, with each one's topic and status
• List Prompt Executions — answer engine responses to your prompts, with their mentions and citations
• Get Prompt Execution — one response, including its full text

Visibility

• Get Visibility Score — the share of responses that mention your organization
• Get Visibility Score Breakdown — the visibility score for each topic or prompt

Citations

• Get Citation Rate — the share of responses with citations that cited your domains
• Get Top Cited Domains — the domains cited most, with each one's share of all citations
• Get Cited Paths for a Domain — the cited paths on one domain
• Get Page Citation Share — one page's share of citations to your domains
• List Competitor Citations — responses that cited a competitor and not you
• List Citations — every response, with all its citations and mentions

All endpoints require the sites:read scope. Every endpoint except the two bot traffic endpoints also requires Webflow AI to be enabled for the workspace.

Original source

This update lets code component authors detect empty slots and render fallback content. Webflow now reserves prop names that start with _wf.

Packages:

• @webflow/react 2.7.0
• @webflow/data-types 2.6.0

Check for empty slots

Call isEmptySlot on a Slot prop value. It returns true when the slot has no children.

import { isEmptySlot } from "@webflow/react";
<div>
{content}
{isEmptySlot(content) ? <p>Drop content here</p> : null}
</div>

Render fallback content next to the slot, not instead of it. Replacing the slot removes the Designer drop target.

Learn more in the isEmptySlot reference.

Reserved _wf prop names

Webflow reserves prop names that start with _wf, in any letter case. The CLI rejects a library that declares one when you bundle it. Rename the prop so it doesn't use that prefix.

Original source

The Get Site Plan endpoint now returns the site's hosting plan consistently. This is a breaking change for any code that compares id or displayName against the previous values.

Starter sites

Sites without a paid hosting plan used to return the Starter workspace plan. They now return the Starter hosting plan.

Field Before After id workspace-starter-seat-v1 hosting-starter-v1 displayName Starter Workspace Starter

Public plan names

displayName now returns the public plan name instead of the internal invoice name. As a result, the names of some plans change. For example, Basic Hosting (circa 2016) is now Basic Hosting, and Enterprise is now Enterprise Hosting.

Original source