Has anyone else using Webflow had clients report receiving emails claiming their website has been hacked and requesting ransom in bitcoin? We've had two clients report this issue in one morning. Any advice or insight would be greatly appreciated.
TL;DR
- These scam emails are common phishing hoaxes, not real breaches, often sent via scraped contact forms or WHOIS data.
- Confirm Webflow site security, enable form protections like reCAPTCHA, and educate clients to ignore, not respond, and never pay.
Yes, clients receiving scam emails claiming their Webflow site has been hacked is not uncommon. These are typically phishing or extortion hoaxes and not an actual security breach of their site or Webflow itself.
1. Understand What This Type of Email Is
- These are often email extortion scams, commonly known as sextortion or website-hacking ransom scams.
- The message usually claims the website was “hacked” and threatens to leak data or take down the site unless paid in Bitcoin or cryptocurrency.
- These emails are mass-distributed using scraped contact forms or public WHOIS data, not based on a true breach.
2. Confirm Webflow Site Security
- Webflow-hosted sites are secure by design, using global CDN, SSL by default, and are not easily exploitable via front-end interactions.
- Check if your client’s site has:
- Custom forms that forward user data—verify nothing sensitive is stored or shown.
- Any CMS Editor access—ensure strong passwords and unique emails are used.
3. Check for Contact Forms Vulnerability
- If the scam emails are received via form submissions on the site, ensure:
- Webflow’s spam filtering is enabled (reCAPTCHA or form rules).
- ReCAPTCHA v2 can be activated under Project Settings > Forms.
- Use form spam honeypots or require email confirmation to deter bots.
4. Educate the Client on This Type of Scam
- Make it clear this is a common automated scam, not a sign of a real breach.
- Advise:
- Do not engage or reply to the message.
- Do not pay any ransom. These attacks often rely on fear, not action.
- If they’re concerned, they may forward the message to their IT or security provider.
5. Scan for Actual Breaches (if concerned)
- While these emails are nearly always fake, if a client insists:
- Review change history in Webflow CMS or Designer.
- Reset Webflow passwords for any logged-in contributors.
- Check Google Search Console to ensure no site warnings or injections.
Summary
Your clients are likely receiving common email extortion scams that falsely claim their Webflow site is hacked. These emails are hoaxes and not linked to a real breach. Confirm Webflow form security, turn on reCAPTCHA, and reassure your clients there’s no need to pay or respond.