Webflow — marketing site review — sample audit, scored 4.7/10

What we found

1. criticalThree in-page links return a live 404 — including the homepage's Engineering-teams feature card

   Selecting the Engineering teams persona in the homepage section *"Everything marketing teams love about webflow"* renders a clickable 411 × 75 px card reading Integrate anything with custom code and MACH-certified APIs. Its href is /archive/developers-old, which returns 404 on a live fetch. The slug is self-describing:

2. critical/apps renders no <h1> at all on mobile — the first visible heading is the <h2> "Slack"

   At 375 px the /apps page ships two <h1> elements, both reading Supercharge your site with Apps, and both measure 0 × 0 px because each sits inside a display:none responsive-variant container. The heading a visitor actually sees is a <span> of 327 × 67 px at y = 96. Reproduced on two cache-busted loads. The first *rende

3. criticalTwo axe-critical WCAG failures on /apps — the filter buttons announce as unlabelled comboboxes

   axe-core reports button-name (impact critical, WCAG 2.0 A, criterion 4.1.2) on 2 elements: the marketplace filter controls #Rpl9jj66 and #R19l9jj66. Both *do* contain visible text (Paid + Free, Popular) — but each carries role="combobox", and the combobox role does not permit name-from-content. The visible label is dis

4. critical20 tracking cookies and five ad/analytics beacons fire before any consent interaction

   On a load of /feature/aeo with all cookies and localStorage cleared, the page set 20 cookies — including _ga, _fbp (Meta), _uetsid/_uetvid (Microsoft), _gcl_au (Google Ads), _mkto_trk (Marketo), _rdt_uuid (Reddit) and sa-user-id (StackAdapt) — and fired GA4 page_view, Google Ads AW-990123219, ad.doubleclick.net/ccm/s/c

5. criticalHomepage mobile: TBT 6,763 ms and TTI 31,306 ms — third-party code blocks the main thread for 6,660 ms

   Lighthouse mobile (lab) scores the homepage 30 / 100. Total Blocking Time is 6,763 ms and Time to Interactive is 31,306 ms; Largest Contentful Paint lands at 6,370 ms and Speed Index at 8,280 ms. Lighthouse attributes 6,660 ms of main-thread blocking to third-party code specifically. The named offenders it lists under

6. warning4,802 KiB page weight, a render-blocking font loader costing 879 ms, and 392 KiB of oversized images

   Lighthouse reports total page weight of 4,802 KiB. Three fixes it names are unusually cheap for the return. *Eliminate render-blocking resources* — est savings 970 ms — lists a single file: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js, 6,058 bytes that cost 879 ms of wasted render time. A 6 KB script

7. mobileHomepage at 375 px has no self-serve CTA above the fold — the first one is a 19 px text link at y = 983

   Measured live at 375 × 812: the announcement bar occupies the top 91 px, the <h1> starts at y = 209, and the first *visible* signup CTA — the words Get started — sits at y = 983, i.e. 171 px below the fold, and is a 19 px-tall text link, not a button. The only action rendered in the mobile header is Contact Sales; the

8. mobile/feature/aeo asks for six fields in the mobile hero — the submit button sits 429 px below the fold

   The only hero action on /feature/aeo is a Marketo Contact sales form: *Business email, First name, Last name, Company, Job title, Country*. At 375 × 812 the form starts at y = 571, stands 806 px tall — taller than the viewport — and its submit button lands at y = 1,241, 429 px below the fold. At 1440 px the same form i

9. warning/feature/aeo: category pills fail AA contrast at 4.03:1, and one link has no accessible name at all

   axe-core reports color-contrast (impact serious, WCAG 2.1 AA, criterion 1.4.3) on 2 elements — the .pill-text labels Availability and Product walkthrough. Measured: 4.03:1 (foreground #1366e2 on background #dae3f1, 12.8 px, weight normal) against the required 4.5:1. Confirmed live at all three viewports. The same page

10. warningFAQ schema ships as orphan Question nodes with no FAQPage parent — and /feature/aeo duplicates one

    /feature/aeo carries 6 JSON-LD blocks, all bare @type: Question — no FAQPage, no QAPage, no mainEntity, and no Organization or WebSite graph on the page at all. Google's FAQ structured data is defined as a FAQPage containing mainEntity; a standalone Question node has no documented container, so this markup is unlikely

11. warning/ai ships a 10-character title on a 2,353-word page; two pages have no twitter:image

    /ai has the title Webflow AI — 10 characters — and the description *"Learn how Webflow can help you elevate web experiences with the power of AI."* (76 characters). Its sibling pages use their full allowance: /feature/aeo at 54 characters, /enterprise at 54. On a page carrying 2,353 words and an <h1> of *"AI that turns

12. warningThe homepage ships two competing <h1> strings because the A/B variant is left in the HTML

    The homepage HTML contains two <h1> elements with different copy: the rendered Make your website a growth engine and a hidden Make websites that drive results. The second sits inside div.w-optimization[data-wf-experience-417257592][data-wf-variation-617170068][data-wf-hidden-variation] at display:none — it is the losin

13. warningThe site's own CSP blocks two of its own marketing tags, and Meta Pixel rejects a malformed currency

    Two paid-media tags are being dropped by Webflow's own Content-Security-Policy, on every page load, silently. LinkedIn cookie sync. The img-src directive allows https://*.ads.linkedin.com but not https://www.linkedin.com — so https://www.linkedin.com/px/li_sync?... is blocked. This is the LinkedIn Insight Tag's member-

14. warningX-Content-Type-Options absent site-wide, HSTS declares preload without includeSubDomains, and /apps ships no security headers at all

    Passive header observations only — nothing was probed or scanned. X-Content-Type-Options is missing on all five pages. It is a one-line header (nosniff) with no downside. HSTS is malformed. The homepage returns strict-transport-security: max-age=31536000; preload, max-age=31536000 — the header is being emitted twice an

15. warningOne signup button, six different labels — and /ai alone ships three punctuation variants of the same phrase

    Across the five audited pages the self-serve signup CTA appears under six distinct strings: Start for free, Get started, Start building, Get started — it's free, Get started - it's free, and Get started — it’s free. The last three are the same sentence with different punctuation, and all three ship on /ai — em dash wit

16. warning/apps is a separate Next.js app and diverges from the rest of the site on nav, headers, schema and localisation

    /apps is served by Next.js (data-next-head in the raw HTML) while the other four pages are Webflow-built. That is a reasonable architectural choice, but the marketplace has drifted far enough that it reads as a different product. Navigation. Desktop /apps shows Product · Marketplace · Learn · Resources with a mark-only