These are the working notes for Webflow for nonprofits and charities: what your plan includes, where each setting lives, and what catches people out. Every fact was checked on 4 November 2026 against Webflow's own documentation and carries its source. Webflow changes these details, so follow the link before you act on one.

Webflow is a strong second to a custom build made with AI-assisted development and owned by the organisation, and the right choice where an organisation already runs on it. These notes are for that second group. The same page covers how Squarespace compares if you are still choosing.

Webflow nonprofit pricing and plans

Webflow combined its CMS and Business Site plans into Premium on 13 May 2026. Some help articles still use the old names. Existing sites moved from 29 June 2026, at the next renewal or billable change. Sites in Freelancer or Agency Workspaces, or on legacy discounts from 2022 or earlier, follow from 16 November 2026. If an agency holds your site in its Workspace, ask which date applies.

Webflow's pricing page lists these prices in US dollars, per site, plus tax. The Starter limits include 1,000 monthly visits.

Site plan Billed yearly, a month Billed monthly Custom domain Static pages CMS items Form submissions
Starter Free Free No 2 50 50
Basic $15 $25 Yes 300 None Unlimited
Premium $25 $39 Yes 300 20,000 Unlimited

A Team Platform plan is listed from $2,500 a month on an annual contract, and Enterprise is by quote. Analyze, Optimize and Localize are add-ons, priced on the same page.

The Webflow nonprofit discount

Eligible nonprofits get 50% off a new annual Premium Site plan for 12 months, limited to one per Workspace per 12-month period. A charity registration certificate counts as proof, and foreign equivalents are accepted. Three conditions matter:

  • The code works only at the purchase of a new plan, and Webflow Support cannot apply it to an existing one.
  • Cancelling a paid plan to claim it forfeits the unused time, disconnects the custom domain and takes the site offline until you buy the new plan and reconnect. If the plan is close to renewing, Webflow's advice is to wait until it ends.
  • The plan renews at full price after 12 months. Keeping the discount means cancelling and reapplying, with the same offline gap.

Domains and DNS

A custom domain needs a paid Site plan. Webflow connects a domain from Site settings > Publishing > Production, which connects the root domain and www together. It normally asks for three records: an A record on @ pointing at 198.202.211.1, a CNAME on www pointing at cdn.webflow.com, and a TXT record on _webflow holding your one-time verification value. Copy them from that screen, because Webflow says records can differ from site to site. Set a default domain with Make default, and use Check status to confirm. Propagation can take up to 48 hours.

Legacy records. Since 13 January 2026 you cannot publish to a custom domain on Webflow's legacy DNS records. The site stays live, but changes do not go out. Workspace settings > Domain Updates lists each site's status. The old values are A records 75.2.70.75 and 99.83.190.102, and a CNAME to proxy-ssl.webflow.com.

Quick connect. This route uses a third party, Entri, which you authorise to change your DNS. Webflow offers manual connection if you would rather not.

Cloudflare. For standard Webflow hosting, set each record's proxy status to DNS only. The proxy can cause a 525 Handshake Error. If you want Cloudflare's security features as well, Webflow's route is Orange-to-Orange, which needs a site on the new records. Cloudflare's Zone Hold can also stop certificates being issued until it is released.

If the plan lapses. Cancelling a Site plan automatically disconnects every custom domain. After a failed payment you need to buy a new plan to reconnect. Plan fees go to the Workspace's default card, so check whose card that is.

SSL

Certificates renew automatically while the DNS records keep pointing at Webflow, so there is nothing to buy. Only Enterprise customers can use a certificate bought elsewhere. SSL is on by default for sites created after 14 November 2018.

If your domain has CAA records, Webflow needs both of its certificate authorities allowed: 0 issue "letsencrypt.org" and 0 issue "pki.goog; cansignhttpexchanges=yes". Without them, certificates may fail to issue or renew. For mixed content warnings, Webflow's fix is to paste only URLs that begin with https://.

Redirects

The 301 manager is in Site settings > Publishing > 301 redirects and needs a paid Site plan or paid Workspace plan. Four things decide whether your rules work:

  • A folder moves with a capture group: /oldfolder/(.*) to /newfolder/%1.
  • Special characters in the old path are escaped with %.
  • A live page at the old address has to be deleted, drafted or given a new slug first.
  • Older rules run first.

There is no hard limit on rules, but Webflow recommends 1,000 at most, because each one ships in a file browsers download.

A CSV import overwrites every existing redirect. Export first and add your rows to that file. The file limit is 16MB, and one invalid row fails the import. If you are moving from Wix, Squarespace or anywhere else, build the redirect map first.

Editors, seats and roles

The legacy Editor stopped being available on 4 August 2026, and on 5 October 2026 editing through ?edit was disabled. Anyone editing now needs an account with a seat. Users Webflow migrated were given the Content editor role. Handover notes that say "ask for Editor access" are out of date.

A seat lets someone in and a role decides what they can do, and unlimited full and limited seats can be purchased:

A Content editor can manage page passwords, SEO titles and descriptions and Open Graph settings, but cannot make design changes, add custom code, rename a page, edit folders or slugs, set a homepage or create Collections, and reaches the site from the Dashboard or by adding ?update to a page address.

The Can publish toggle sits on Growth and Agency plans, but a member restricted from publishing can still publish individual CMS items. A permission will not act as your review step. The same article reserves transferring a site and managing its Site plan and billing to the Site manager. Workspace billing details are open only to the Owner and admins.

When someone leaves, remove them from Workspace settings > Team on their last day, and empty a client seat at Site settings > Site access > Clients. Anyone with a design role should turn on two-factor authentication, under Account settings > Security. The nonprofit should own the Workspace, with agencies joining as guests.

Backups and restore

Restore points are made on every 50th auto-save and when you restore, and you can save one by hand with Control or Command + Shift + S. Wait for the "Changes saved" tick first, or your latest changes miss it. There are no scheduled backups. Paid Site plans keep unlimited backups, while a free Starter site can restore only one of its two most recent unless its Workspace is paid. Only a Site manager can open them, at Site settings > Backups, where you can preview a version first.

A backup restores the site as a whole, so getting back one deleted CMS item undoes everything since. A restore also has side effects. The "Published on" date of Collection items moves to the time of the restore, scheduled items are queued to publish, reCAPTCHA keys need re-adding and bot protection is turned off.

Keep a copy outside the site as well. Collection items export to CSV. Code export is on Workspace plans only and leaves out CMS, Ecommerce and localised content.

Forms and where submissions go

Each form can send to Webflow, email notifications, a webhook or a connected app, or bypass Webflow with a custom action. New forms use the first two by default. A custom action cannot be combined with those two.

Submissions stored in Webflow live at Site settings > Forms, export to CSV and are deleted by hand. That article describes no automatic expiry, so your privacy policy needs its own retention period and someone needs to carry it out. Webflow's data processing addendum retains customer personal information for the term of the agreement and, on termination, deletes or returns it at your choice unless the law requires otherwise. Deleting a submission also deletes its uploaded files. Give each form a descriptive name, because submissions are labelled by it and unnamed forms all appear as "Email Form". Recipients are set per form, so routing enquiries to different people means separate forms or an app. On Starter, the 50 submissions are a lifetime limit and notifications reach only five Workspace members.

File uploads need Premium or an Ecommerce Plus or Advanced plan, with a 10MB maximum per file. For spam, bot blocking is at Site settings > Apps & Integrations > Cloudflare Turnstile spam protection.

For a CRM, Webflow's HubSpot app works with HubSpot forms or native Webflow forms, leaving a native form's styling in Webflow, Zapier can act on a submission, and Salesforce Web-to-Lead works by embed or custom action. A HubSpot embed goes in a Code Embed element. A script shows only a placeholder on the canvas, so test it on the published site, and wrap it in a Div Block with a width limit, because embedded content can fill the width of its parent.

Webflow Analyze is a paid add-on that only Workspace admins can buy. Its tracking is off until you turn it on, at the Insights tab > Settings > Tracking, and it then defaults to Always track visitors. The other two options are Let visitors opt out and Don't track by default. Webflow says either of those needs a consent management solution, or Analyze and Optimize will not function properly. If you have not bought Analyze, none of this applies.

Webflow's documented routes are a consent app or integration (it names DataGrail and Finsweet), an existing provider connected through its APIs (it names TrustArc and OneTrust), or your own banner in custom code. CookieYes is not among those named, and its Webflow guide does not mention Analyze, so with Don't track by default Analyze stays off even after someone accepts the banner. Adopt a documented route, or leave Analyze off and run GA4 behind the banner.

The native Google Analytics field is at Site settings > Integrations tab and accepts GA4 measurement IDs only. That article does not mention consent, so settle how GA4 waits for it first. For Google Tag Manager, CookieYes's Consent Mode v2 guide puts the head snippet in Custom Code's Head Code and the body snippet in Footer Code. The analytics and consent guide sets out the banner and tag setup.

Embeds and head code

Site-wide code goes in Site settings > Custom code, with up to 50,000 characters each for head and footer. It needs an active Site plan or a paid Workspace, and only Site managers and Designers can add it. A Code Embed element holds the same limit on the page. Webflow's support team will not troubleshoot custom code, so keep a note of what each snippet does and who added it.

For donations, Donorbox gives an embed from Share & Embed and warns it can span the page unless you put it in a container. Fundraise Up's code goes last in the head. For structured data, site-wide JSON-LD goes in head code, and a Code Embed can pull in CMS fields so that page-level markup stays current.

Images and alt text

Webflow generates responsive variants for inline JPG, PNG and WebP images, but not for background images or images in rich text. AVIF is not on that list. Upload limit is 4MB. Images added through a CSV import or the API get no variants, so resize those first. The conversion tool replaces the original asset, so back up first, and choose WebP over AVIF for social sharing images. Set each image's loading behaviour to Lazy, Eager or Auto, with the hero image eager.

Alt text set on an asset in the Assets panel is inherited by every use of it, and an image can be marked decorative. In a rich text element, set it from the image's wrench icon, or in the rich text field if the text comes from the CMS. For a CMS image such as a thumbnail, add a plain text field to the Collection and bind the image's alt text to it. That is one part of accessibility. No platform or framework makes a site accessible by itself, so the build system matters, and the WCAG guide sets out what Lumos conventions settle and what your team must keep doing.

CMS content types

Webflow's Collection field types include plain text, rich text, image, file, date/time, option, number and reference. An impact report can use plain text for its title and period, rich text for the body, a file for the PDF, an image and a date. A team profile can use plain text for name and role, rich text for the biography, an image, an option for staff or trustee, and a number for display order. Choosing a nonprofit template does not settle this structure for you.

Premium holds 20,000 items in 40 Collections. Separately, a Collection list shows 100 items unless you paginate or use Skip, and scheduled publishing is not on Starter or Basic.

Localisation

Webflow Localize is an add-on in which each secondary locale inherits from the primary until you change it, and locales are served in subdirectories such as .com/es/. The pricing page lists Essential at up to 3 locales and 10,000 translated words per locale a month, and Advanced at up to 10 locales and 50,000. Once the allowance runs out you can opt in to spending AI credits. Localize does not support Ecommerce Site plan features. Webflow sets the HTML language per locale and generates hreflang tags, in the page or in the auto-generated sitemap. Machine translation still needs human review before it goes live.

Weglot is a third-party alternative worth evaluating. Its setup guide adds a script to the head code and a CNAME per language for subdomains, and for subdirectories it tells you to contact its support team rather than change your main DNS record. To place the language switcher, add <div id="weglot_here"></div> where you want it, which a Code Embed element can hold.

SEO settings

Next step

Before you change any record, read How to Connect Your Domain to Your Website Without Breaking Email. If you want these settings checked along with the rest of the site, that is the Blueprint Audit.