Webflow has a reputation for being rock-solid… secure hosting, clean code, and less exposure to the usual plugin headaches you get with other platforms.
But as we found out recently, no platform is bulletproof if someone slips in the wrong line of code.
A client’s Webflow site suddenly started showing fake virus popups whenever someone opened the homepage. On mobile, it even redirected visitors to a scam page claiming their device was infected.
The client freaked out, quite understandably.
Here’s how it happened, how we fixed it, and what every Webflow user should know to prevent it.
What caused it
The problem came from a malicious code embed hidden at the top of the homepage.
It looked harmless enough, but it was loading scripts from shady ad networks like:
- effectivegatecpm.com
- highperformanceformat.com
- adblockerexperts.info
These scripts injected fake popups and redirects designed to trick visitors into tapping through to scam sites.
Seeing popups, redirects, or strange warnings?
It’s often a quick fix. We clean up compromised sites and lock them down properly.
Get it checked or use live chat if it’s urgent.
How we fixed it
We stripped the site back and cleaned everything out:
- Deleted the infected Embed blocks from the homepage and global symbols
- Unpublished the project to flush Webflow’s CDN cache
- Republished a clean version
- Scanned the site via Sucuri SiteCheck… came back clean
- Tested across Chrome, Safari, Firefox, Edge, and mobile… no more redirects or popups
After confirming the site was clean, we tightened the account security to stop anything similar from sneaking back in.
What to learn from it
This kind of thing can happen anywhere… Webflow, WordPress, Shopify, it really doesn’t matter.
The weak point usually isn’t the platform. It’s the code we paste in.
A few habits make a big difference:
- Don’t paste code from unknown “SEO” or “monetisation” tools
- Only use embeds from trusted sources like Google, Meta, or HubSpot
- Regularly check for hidden Code Blocks in your project
- Turn on two-factor authentication (2FA) for your Webflow account
- Run a quick malware scan monthly at sitecheck.sucuri.net
The result
The client’s site is now clean, stable, and loading normally across all devices. It’s a solid reminder that even the best platforms rely on good habits.
Webflow might handle the hosting, but security still starts with the person managing the project.
If your site ever starts behaving oddly… popups, redirects, layout gaps… don’t ignore it. A short security check can prevent bigger headaches later.