Legit.Show measured Webiny's Security frame at 90/100. Security headers present: CSP, HSTS, X-Frame-Options, X-Content-Type-Options. Served over HTTPS with a valid certificate.

How does Legit.Show measure Webiny?

Legit.Show scores seven frames — Performance, Accessibility, Security, Privacy, Reliability, Standards and Discoverability — deterministically from the public surface (URL, HTTP headers, real Lighthouse), with no LLM in the scoring path. See legit.show/methodology.

Content & Docs

Webiny

Source: webiny/webiny-js · ★ 7990 · TypeScript

Last updated 2026-06-06 · benchmark measured 2026-08-13 — deterministic & reproducible

Webiny is an open-source, self-hostable CMS designed to be extended with AI and code.

68/100

7/7 frames

Top 78% of 14,138 measured · #7 of 8 in headless cms

Legit Benchmark — the simple average of 7 measured frames. Frames we could not measure are left out of the average, never counted as zero. Every frame is shown below with its evidence.

Checked 2026-08-13 · scores move as sites change

Are you the maker of Webiny? Claim this listing. It is free, takes a meta tag, a DNS record or GitHub admin rights, and never changes the score.

Launched something? Add your product, free.

To cite this score: legit.show/s/gh-webiny-webiny-js/2026-08-13. That address never changes; this page moves with every re-measure.

Legit.Show scored Webiny 68/100 on 2026-08-13, measured across all 7 frames from its public surface. legit.show/s/gh-webiny-webiny-js/2026-08-13

Is Webiny production-ready?

Legit.Show scores Webiny 68 out of 100 — the simple average of its 7 measured frames. Legit.Show ran its deterministic 7-Frame production-readiness benchmark on Webiny (public-surface assessment), measured from the public surface with no LLM in the scoring path. Its strongest frame is Accessibility; its weakest is Privacy. Every frame it averages is published with its evidence on the Legit.Show listing.

The 7 Frames

Performance — 56/100
Accessibility — 91/100
Security — 90/100
How this compares across the catalogue: The Web Security Baseline
Privacy — 0/100
How this compares across the catalogue: The Privacy Gap
Reliability — 75/100
Standards — 79/100
Discoverability — 85/100

What we measured

Security headers present: CSP, HSTS, X-Frame-Options, X-Content-Type-Options.
Served over HTTPS with a valid certificate.
Real Lighthouse performance run — 1206 ms to first byte.
3 of 3 sampled routes reachable.
No privacy policy found.
Sets cookies / loads scripts with no consent prompt.
Discoverable: structured data, sitemap, OpenGraph image, canonical URL.

Who built it

product account @WebinyCMS

Who it's for

Developers · Enterprise teams · SaaS providers · Large-scale content operations · Fortune 500 companies

Pricing

Community free forever; Business $79/mo (S/M/L tiers with $299/$599/mo options); Enterprise custom pricing.

Sources and updates

Description: Taken from webiny.com's own website on 2026-06-06.
Operator: Webiny Inc., as named in webiny.com's terms, privacy page or footer.
Code: github.com/webiny/webiny-js.
Benchmark: Measured by Legit.Show from the live site, the way any visitor sees it — with no access to its code or accounts. Same method for every product, and no AI decides the score. Last checked 2026-08-13.

Put together from public information, without Webiny's involvement. If anything here is wrong, tell us and a person will check it.

Visit Webiny → · Alternatives to Webiny → · How this was measured →