Webflow provisions free SSL certificates automatically for both webflow.io subdomains and connected custom domains. Enforcement is controlled under Project Settings → Hosting.
Enabling the redirect
Confirm "HTTPS" is enabled in the hosting settings — Webflow will then automatically redirect http:// requests to https:// for the published site. This applies at publish time, so republish the site after connecting a new domain if HTTPS doesn't appear active immediately.
Internal links
Webflow generally generates internal links using relative paths rather than hardcoded http://, so a full redo of internal links usually isn't necessary — but if you've pasted absolute http:// URLs into rich text fields or custom code embeds, those are worth checking manually.
Why republishing matters more on Webflow than some other platforms
Webflow's HTTPS settings and redirect behavior apply at publish time specifically, meaning a setting change made in the project settings panel won't take effect on the live site until you explicitly republish — a step that's easy to forget after making a settings change rather than a content change.
What to check if a custom domain shows HTTPS as pending indefinitely
A custom domain stuck showing pending SSL status for more than a day typically points to a DNS configuration issue rather than a Webflow-side problem — confirm your domain's DNS records exactly match Webflow's current documented values, since Webflow can't complete certificate issuance until it can verify the domain actually points to its infrastructure.
How Webflow handles the transition if you're pointing an existing domain at it
Connecting a domain that previously pointed elsewhere follows the same DNS-then-certificate sequence as any new domain connection — expect a similar brief provisioning window while Webflow verifies DNS ownership and completes issuance before HTTPS becomes fully active.
How Webflow's staging environment handles HTTPS differently from the live site
Webflow's staging/preview URLs (on the webflow.io subdomain) have their own automatically issued certificate independent of your custom domain's certificate, meaning HTTPS works correctly in both environments without needing separate configuration for staging versus production.
What CMS-driven dynamic content means for hardcoded URL risk on Webflow
Content managed through Webflow's CMS collections is generated dynamically from structured data fields rather than free-form HTML, which meaningfully reduces the risk of hardcoded http:// URLs compared to platforms where all content lives in a single rich-text field — though custom code embeds within CMS items can still introduce this risk.
Why exporting and re-importing Webflow code doesn't affect the live site's HTTPS
Downloading and inspecting Webflow's exported code for development purposes has no effect on your actual published site's HTTPS configuration, which remains entirely managed by Webflow's hosting — exported code is a separate, offline copy rather than a live deployment target.
What to check if a custom domain shows HTTPS as pending indefinitely
A custom domain stuck showing pending SSL status for more than a day typically points to a DNS configuration issue rather than a Webflow-side problem — confirm your domain's DNS records exactly match Webflow's current documented values, since Webflow can't complete certificate issuance until it can verify the domain actually points to its infrastructure.
What Webflow's own uptime and status page can tell you during a suspected outage
If HTTPS or certificate issuance seems broadly affected rather than specific to your one domain, checking Webflow's public status page rules out a platform-wide incident before assuming the issue is specific to your configuration.
How this guide's steps apply identically to Webflow Ecommerce sites
Webflow's Ecommerce plans use the same underlying hosting and certificate infrastructure as standard Webflow sites, meaning HTTPS and redirect handling work identically regardless of whether Ecommerce features are enabled — no separate configuration is needed specifically for a store versus a standard site.