Webflow sites tend to start from a better place than most on this rubric, because the Designer writes ordinary HTML and the copy on the page is in the document an agent fetches. The points a Webflow site drops are usually in two places: structured data, which the platform does not write for you and which is easy to break when you add it by hand, and the plain text files at the root of the domain, which the hosting was not built to serve. Both are fixable from the dashboard. This post covers what the platform does by default, what it tends to get wrong, and the fixes in order of effort.
Everything below describes documented default behaviour as of this writing; confirm any detail you are about to rely on against the current developer documentation.
What Webflow does by default
By default a published Webflow site is a set of static HTML pages with a stylesheet and one site-wide script. The text you place on the canvas is in the HTML, so the raw fetch and the rendered page contain the same words. That is the property check A7 measures, and it is worth confirming rather than assuming: fetch a page with curl and look for your headline in the response.
The Designer lets you choose the HTML tag for a block, so a site built with a little care has a real nav, main and footer and one h1 per page, which is what check B3 looks for. Page settings carry a title, a meta description and Open Graph fields per page, and Collection page templates can fill those from CMS fields, which covers most of check B4 across a whole collection at once.
Site settings carry an SEO tab with an automatically generated sitemap and an editable robots.txt. Left alone, the generated sitemap lists your published pages, and robots.txt contains nothing that blocks a crawler. Checks A1, A2 and A3 are usually fine by default, but read the live robots.txt after publishing anyway.
What it tends to get wrong
Structured data is not written for you. As of this writing, Webflow does not emit JSON-LD for a page by default. Check B1 wants at least one parseable application/ld+json block on the homepage, and on half or more of the crawled pages; B2 wants Organization or WebSite sitewide plus a type that matches what the site is. A Webflow site with nothing added scores zero on both, which is ten points.
Hand-added JSON-LD breaks in a specific way. The usual route is a custom-code field, and the usual mistake is a CMS field dropped into the middle of a JSON string. A product name with a double quote, an apostrophe rendered as an entity, or a description with a line break turns the block into invalid JSON. Invalid JSON counts as if it were absent, and the report's pagesWithInvalidJsonLd field tells you how many pages are affected. JSON-LD that parses covers the other four ways this goes wrong.
Root text files have nowhere to live. llms.txt, llms-full.txt, agents.json and /.well-known/security.txt are all files served at a fixed path on your own domain. Webflow's asset manager hosts uploads on its own CDN host, not at a path on your site, so by default there is no place to put a file called /llms.txt. Check A4 alone is four points.
Custom code has limits. Each custom-code field has a documented character limit, custom code does not render inside the Designer, and site-wide head code requires a paid site plan. None of these stops the fixes below.
Fixes in order of effort
The rubric rates each check by remediation effort. Here they are in that order.
Low effort, robots.txt, sitemap and llms.txt
Check the SEO tab once. The sitemap should be on, robots.txt should not disallow the six agents A2 names, and the Sitemap: line should point at the generated file. That is A1, A2 and A3 for the cost of reading a settings page.
For llms.txt, the workable route on Webflow as of this writing is a redirect. Write the file, upload it as an asset, and add a 301 in the site's redirect settings from /llms.txt to the asset URL. The scanner follows redirects when it fetches root files, so what it scores is the body it ends up with. For A4 that body needs three or more links in the form the check looks for, a Markdown link followed by a colon and a description:
# Example Co
> Short summary of what the company does.
- [Pricing](https://example.com/pricing): Plans, what each includes, and how billing works.
- [Docs](https://example.com/docs): Setup guides and the reference.
- [Contact](https://example.com/contact): How to reach a person.
Fewer than three described links scores one point out of four. How to write an llms.txt that earns its place covers what belongs in the file. The same redirect route works for /.well-known/security.txt if the redirect settings accept a path with a leading dot; if they do not, check the current documentation for whether a hosting feature now serves files at a path. Webflow has been adding hosting capabilities, and this is the kind of gap that closes without an announcement.
Two cautions: the redirect points at another host, which not every consumer follows, and an uploaded asset is a snapshot that does not change when the site does.
Medium effort, structured data
Do this at the template level, not page by page. Structured data across templates makes the general case; on Webflow it means three pieces of code.
Sitewide, put an Organization block in the site-wide head custom code. This is a fixed block with no dynamic fields, so it cannot break. Include a sameAs array with at least one profile URL, because check D2 reads it too.
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "Organization",
"name": "Example Co",
"url": "https://example.com/",
"sameAs": ["https://www.linkedin.com/company/example-co"]
}
</script>
Per collection, put a type-specific block in the Collection page template's custom code with CMS fields inserted where the values go. Keep every inserted field inside a string and keep the fields to ones you control: a plain-text name, a date, a URL. Do not insert rich-text fields into JSON. If a field can contain a quote, either escape it at the source or leave it out of the block.
Per static page, decide whether the page needs a type at all. For a SaaS or content site B2 is satisfied by one page carrying Article, FAQPage, SoftwareApplication or Service.
Then publish and validate the output on the live site, because the first time the JSON exists is after publishing. Fetch the page, extract the block, and pass it through a JSON parser; the json-ld.org playground will do, and so will jq. If Webflow's SEO settings offer native structured data fields by the time you read this, prefer them, because a field that writes valid JSON for you removes the failure mode above.
High effort, machine endpoints
Check C4 wants an agents.json, an OpenAPI spec, an MCP manifest or a link to API documentation. The redirect route serves a static agents.json if you have something true to put in it; otherwise accept the zero.
What is not fixable without leaving the platform
Response headers. Check D1 awards a point for a Strict-Transport-Security header, and by default Webflow hosting sets the headers, not you. Check the current documentation for whether custom headers are available on your plan; as of this writing this is the one point on the rubric a Webflow site cannot reach from the dashboard.
A real API. If your product has one, it lives elsewhere, and C4 looks for a link to its documentation on the homepage. That is a footer link, and the link is all Webflow needs to carry. Everything else on the rubric is reachable from settings, custom code and redirects.
Check your own site
Run the free scan on the published site and read the B1 and A4 evidence first; those two checks are where a Webflow site most often leaves points. The full definitions are under understanding and discovery and access on the methodology page, and our own llms.txt is at /llms.txt if you want a working example of the format.