Webflow

How a site gets built and how far the owner can shape it: the editor (drag and drop, sections, AI drafts), the template range, responsive and mobile editing, fonts and brand styles, multilingual pages, custom code, and roles for collaborators or clients.

0 — Not a website editor; the product hosts files or code that are built elsewhere.

3 — An editor with a small set of templates and fixed layouts, where colours and texts change but structure, mobile view and languages are not described.

5 — A visual editor with a template gallery for several industries, layouts that adapt to mobile, brand colours and fonts, a blog, and the option to add pages in a second language or custom code snippets.

8 — Fine design control documented: free layout or section editing, separate mobile and breakpoint editing, reusable components or global styles, built-in multilingual sites with translated URLs, user roles for collaborators or clients, and site versions or history that can be restored.

10 — Design work at a professional level without leaving the tool: a design system with variables and components, interactions and animations, a CMS with custom collections, staging or branching before publishing, client handover with restricted editing, and the editor documented in depth.

What runs the site once it is built: included hosting, custom domains and domain registration, SSL, email mailboxes, speed (CDN, image optimisation), backups and restore, availability commitments — and whether pages, content and media can be exported when the owner moves on.

0 — No hosting; the product produces a design or files and the owner finds a host.

3 — Hosting on a subdomain with a custom domain on paid plans, but SSL, backups, storage limits and export are not described.

5 — Hosting included with a custom domain (or one included for a first year), free SSL, stated storage or bandwidth, a CDN or speed optimisation, automatic backups or a restore function, and an export of at least blog posts or content.

8 — Hosting described in depth: data-centre locations named, a stated uptime commitment, versioned backups with self-service restore, email mailboxes on the own domain, performance figures or Core Web Vitals addressed, and a documented export of pages, content and media.

10 — Hosting the owner can rely on and leave: an uptime SLA with credits, the hosting region selectable, DDoS and security measures named, a complete site export (code or standard formats) documented step by step, and domains transferable without fees or lock-in.

How the site is found and measured: page titles and descriptions, clean URLs and redirects, sitemaps and indexing, structured data, local SEO, page speed for search, built-in or connectable analytics, newsletter or social sharing, and guidance for the owner who is not an SEO.

0 — No search settings at all; pages cannot be given titles or descriptions.

3 — Page titles and descriptions can be edited, but sitemaps, redirects, analytics and indexing control are not described.

5 — Editable titles, descriptions and URLs, an automatic sitemap, 301 redirects, social sharing previews, built-in visitor statistics or a documented connection to an analytics tool, and SEO guidance or a checklist inside the product.

8 — SEO documented in depth: structured data, canonical and noindex control, robots.txt editing, image alt texts and compression, local business listings or a Google Business connection, multilingual SEO with hreflang, and privacy-friendly analytics without third-party cookies.

10 — Visibility as a strength: full technical SEO control including server-side rendering and speed figures, AI search or answer-engine readiness addressed, search data shown inside the editor, marketing tools (newsletter, campaigns, A/B tests) built in, and every setting explained in the help centre.

What the site does for the business beyond showing pages: contact and custom forms with spam protection and notifications, where form entries are stored, appointment bookings, member areas, events, integrations with CRM or calendar, payments and a small shop as an add-on — judged as features of a website, not as a shop system.

0 — No forms and no interactive features; the site shows pages only.

3 — A contact form that sends an email, with spam protection, storage of entries and further business features not described.

5 — Custom forms with several field types, spam protection and email notifications, entries stored or exportable, and at least one further business feature (bookings, member area, events or a small shop) described.

8 — Business features documented in depth: forms with conditional fields, file uploads and confirmation emails, appointment booking with calendar sync, member areas or gated pages, payments, integrations with named CRM, newsletter or automation tools, and an app or extension marketplace.

10 — The site runs a small business: forms, bookings, payments, invoices or memberships work together with consent and data retention settings per form, an API or webhooks for form data, and a documented integration ecosystem — while the shop stays one feature among several.

What the product does so that the owner's site is legal in Germany and the EU: an imprint page, privacy-policy and legal-text generators or partners, a cookie consent banner that blocks scripts until consent, GDPR-compliant forms, a data processing agreement for visitor data, fonts and media served without third-country transfers, and accessibility under the European Accessibility Act.

0 — Nothing for the site's legal obligations; the owner is left to add every legal page and banner from outside.

3 — Pages for an imprint and privacy policy can be added by hand, and a simple cookie notice exists, but consent blocking, a data processing agreement and form data handling are not described.

5 — A cookie consent banner, a data processing agreement offered to customers, documented GDPR handling of form entries, and help for imprint and privacy pages (templates, a generator, a named legal-text partner or a help article).

8 — Compliance worked out for EU sites: a consent banner that blocks scripts and embeds until consent and logs it, legal texts kept current by a named provider or a warranty against cease-and-desist letters, fonts and maps served without US transfer, and accessibility features or an accessibility statement.

10 — Compliance as part of the product: consent management with granular categories and records, legal texts maintained for several EU countries, every embed and script assessed for consent, accessibility to WCAG 2.1 AA documented with tooling, and the vendor's share of liability stated in its terms.

Who the contracting entity and the parent company are, where the sites, the form entries and the visitor data are hosted, and who the subprocessors are (hosting, CDN, email delivery, analytics, payments, AI features). Independently sourced by the sovereignty pipeline; the data subjects here are the owner's own visitors and customers, so the whole chain counts, not only the editor.

0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.

3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.

5 — EU hosting available or an EU contracting entity, a data processing agreement offered, but parts of the chain (CDN, email, analytics, AI features, support) run through non-EU providers or the subprocessors are listed without locations.

8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.

10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.

Whether a buyer can compute the real cost over two or three years from public pages alone: the monthly price per plan, the introductory price and how long it lasts, the renewal price after it, setup fees, minimum term and notice, domain and mailbox renewals, transaction fees on sales, and which features (ad removal, extra languages, bookings, more storage) cost extra.

0 — No public prices at all; every customer is a sales call.

3 — A starting price or a free plan is shown, but what the plans include, what they cost after the first term or how the cost scales is unclear.

5 — Plans are public with prices and their main inclusions, but at least one commonly needed piece (the price after an introductory offer, domain renewal, a mailbox, transaction fees, an add-on) is unpriced or hard to find.

8 — Every plan priced publicly with the introductory price, its duration and the regular price after it, setup fee, minimum term and notice period, domain and add-on prices listed, and VAT treatment stated.

10 — Complete price computability: the cost of a given site over several years derivable from public pages, with every add-on, renewal, transaction and support fee, the cancellation terms and what happens to the site and domain after cancellation published.