Why do users receive a "Passwords cannot be collected" popup when attempting to log in or sign up on our published Webflow site?
TL;DR
- Use Webflow Memberships or Ecommerce for password fields to comply with security restrictions.
- Enable SSL in Project Settings to secure your site and prevent the warning.
- Avoid collecting passwords through standard forms or integrate secure third-party authentication (e.g., Firebase, Auth0).
The "Passwords cannot be collected" popup appears because your Webflow site is using a password field outside of Webflow’s native form handling and without proper site security (HTTPS).
1. Webflow Restrictions on Password Collection
- Webflow does not allow custom forms with password inputs (type="password") to collect data unless they are part of the CMS Membership feature or Ecommerce functionality.
- This is a security measure to protect users from unintentionally submitting sensitive information to insecure or unauthorized systems.
2. Common Causes of This Issue
- You’ve added a custom login or signup form with a password field that is:
- Not tied to Webflow’s Membership or Ecommerce systems.
- Configured as a standard form without server-side processing.
- Your site might be running on HTTP rather than HTTPS, especially during development or using a custom domain without SSL enabled.
3. How to Fix It
- Use Webflow Memberships or Ecommerce:
- If you're trying to manage logins or user accounts, enable Memberships from the Users panel.
- Webflow will handle password fields securely, and no warning will appear.
- Avoid collecting passwords manually through standard or external forms unless you're integrating a secure third-party authentication system.
- Enable SSL for your domain:
- Go to Project Settings > Hosting, and ensure SSL is enabled.
- SSL must also be properly configured on your DNS level.
- Remove or repurpose password inputs:
- If the form isn’t meant to collect real passwords, consider using a different input type or explaining the field's purpose clearly.
4. Alternatives for Custom Authentication
- If you're integrating with a platform like Firebase or Auth0:
- Handle authentication logic client-side via JavaScript.
- Ensure the form is not submitted through Webflow’s native form mechanism.
- Do not collect passwords via Webflow's form submissions.
Summary
The popup is triggered by Webflow’s security settings when an unauthorized password field is used. To resolve it, use Webflow’s Membership feature, ensure SSL is enabled, or avoid collecting passwords with standard forms altogether.
