Changelog

Over the past several weeks we’ve updated the Marketplace Guidelines, the app review process, and the tools available to you before you submit. Here’s what changed and what to expect next.

A clearer review scope

App review now focuses on the surfaces Webflow is responsible for: code that runs in the Webflow Designer, your app’s interactions with Webflow’s APIs, and how your app handles Webflow credentials and Webflow user data. How your app’s code behaves on your customer’s published site is part of your service relationship with your customer. The new Review scope section in the guidelines states this directly.

What this means in practice:

• Published-site code practices are now recommendations, not review gates. Subresource integrity, immutable script URLs, page-scoped injection, additive-only page changes, and similar practices moved to Recommended practices for published-site code. We still recommend all of them — your customers will hold you to them — but review won’t reject your app over them.
• Three gates remain for code you deliver to customer sites: deliver it through the Custom Code API, disclose what it does in your listing and submission, and remove your registered Custom Code on uninstall.
• One consolidated backend rule: no untrusted origin may read or mutate a Webflow-authenticated response or state. Review verifies this by probing your live endpoints — not by auditing your backend source.
• Data Client apps attest instead of being audited: provide three written attestations at submission — your app’s Webflow OAuth token is encrypted at rest, stored server-side only, and deleted on uninstall or revocation.

Updated docs and guidelines

We revised the Marketplace Guidelines and app submission docs, including:

• Expanded review criteria in the Marketplace Guidelines, organized into linkable rule groups
• Corrected guidance on installation scopes — configured scopes your app doesn’t use should be removed
• Reworked guidance for app-delivered code — the three gates above, plus recommended practices for published-site code; Designer Extensions still interact with the user’s site exclusively through the Designer APIs
• Documented submission artifacts — a published testing site, source maps with the package manifest and lockfile for compiled bundles, production bundles free of debug routes and staging residue, and the optional preflight receipt
• Listing language requirements — English listings, with disclosure for non-English product experiences

Reviews check exactly what’s published here

Our internal review checklist was rewritten to mirror the public docs. If a requirement isn’t published on developers.webflow.com, we don’t hold your submission to it. The docs you can read are the same standard we review against.

Every submission is reviewed against current guidelines — including updates

When you submit an update to an already-published app (including bug-fix releases), it’s reviewed against the guidelines as they stand today, not as they stood when your app was first approved. If your app was approved before a guideline existed, an update may surface findings that are new to you. Published apps are not being retroactively delisted — your live listing is unaffected until you submit an update, and when findings come up, the review feedback will tell you exactly what to fix.

Clearer review feedback

Review outcome emails now list each required change explicitly, with links to the relevant docs, and distinguish required changes from suggestions.

Pre-submission checks you can run yourself

The app submission form now offers a downloadable skill toolkit — two agent skills for the app lifecycle:

• webflow-app-preflight checks your app and bundle against the review gates and the recommended practices — development builds, custom-code cleanup, scope mismatches, backend authorization, and listing assets — and ends in a clear go/no-go before you submit.
• webflow-app-review-remediation helps you work through review findings and prepare a resubmission after you’ve received feedback.

A skill is a folder with a SKILL.md instruction file that AI coding agents load as step-by-step expert guidance. It’s an open, plain-Markdown format — you can also just read it. To use the skills:

• Claude Code: unzip and copy each skill folder into .claude/skills/ in your project (or ~/.claude/skills/ to use them everywhere), then run /webflow-app-preflight or ask Claude to preflight your app.
• Claude apps (claude.ai and desktop): upload a skill as a zip under Settings → Capabilities → Skills, then ask Claude to run it.
• Codex CLI: copy the skill folders into ~/.codex/skills, then ask Codex to run the preflight.
• Other agents: any agent that supports the open SKILL.md format can load them — or paste the SKILL.md contents directly into your agent’s chat.

What’s coming

In the coming weeks we’re adding automated guideline checks at submission. Submissions with guideline failures can be rejected on that basis. The preflight skill isn’t required — but it checks for the same kinds of issues, so running it before you submit is the easiest way to avoid a rejection. If your app has been live for a while, we recommend reviewing the current guidelines before your next update so nothing catches you by surprise.

Questions

Open a ticket at support.webflow.com — support tickets are the reliable path to the Marketplace team.