ShipPatrolScan your site for legal, security and SEO gaps, then fix them
Built with Framer

What Framer doesn't set up for you

Framer looks after more than most: HSTS, nosniff, an automatic sitemap and robots.txt, and a cookie banner component. The gaps are mostly in how those are set up, and in whatever gets pasted in as custom code.

What Framer gives you

Headers
Framer sets Strict-Transport-Security (one year) and X-Content-Type-Options: nosniff by default. Custom headers, including a Content-Security-Policy, need Advanced Hosting, an add-on on Pro and included on Enterprise. Source: framer.com (opens in a new tab)
SEO
sitemap.xml and robots.txt are included automatically. Titles and descriptions can be set for the whole site or per page, and bound to CMS fields. Source: framer.com (opens in a new tab)
Consent
A Cookie Banner component runs consent through Google Tag Manager with Google Consent Mode, with separate behaviour for the EU and the rest of the world. Source: framer.com (opens in a new tab)

What Framer already checks

The checklist

What's still on you

  1. Scripts that skip the banner

    Framer describes its Cookie Banner in terms of Google Tag Manager and Consent Mode. If you've pasted scripts straight into custom code or added embeds, check they also wait for consent rather than loading on the first view.

    Patch checks:Critical Trackers load before consentHigh No cookie banner

  2. Banner settings by region

    The banner can behave differently for the EU and the rest of the world, and it has a default-consent setting. Check which group UK visitors fall into, since UK rules also require consent for non-essential cookies, and that Reject is as easy to find as Accept. A default of 'accepted' rather defeats the point.

    Patch checks:High No cookie banner

  3. A privacy policy that matches what the site loads

    Framer gives you a cookie policy link per region, but the policy itself is yours. It should name the services the site uses: analytics, forms, embeds, newsletters.

    Patch checks:Critical No privacy policyMedium Privacy policy doesn't mention services the site uses

  4. Content-Security-Policy and framing rules

    HSTS and nosniff are on. A Content-Security-Policy, framing rules or a referrer policy need custom headers, which are part of Advanced Hosting, or a CSP meta tag, which Framer notes can slow the site down.

    Patch checks:Medium No Content-Security-Policy header

  5. Alt text you still have to write

    Framer optimises images for SEO automatically, but the alt text is yours to write. Image-heavy layouts are where it is easiest to skip.

    Patch checks:Medium Images without alt text

  6. Contrast and form labels

    Subtle text colours and placeholder-only form fields are common in polished designs. Check text has enough contrast against its background and every form field has a label a screen reader can announce.

    Patch checks:Medium Text contrast too lowMedium Form fields without labels

  7. Titles and link previews on CMS pages

    Pages override the site-wide defaults, and CMS pages need {{Title}} and {{Description}} bound to fields, plus a social image per item. Skip that and every post shares one preview.

    Patch checks:Medium Pages with missing or duplicate titles

  8. An Impressum, if you need one

    Businesses in Germany and Austria generally need a legal notice with specific details. Framer won't add one; it's a page you write and link from every page.

    Patch checks:Medium No Impressum

What ShipPatrol adds

  • Loads the published site from the UK, EU and US, clicks Accept and Reject, and records what fires before and after, including scripts outside Tag Manager.
  • Compares your privacy policy with the services the site actually loads.
  • Re-scans daily or from a deploy hook and emails you when something new turns up.

ShipPatrol isn't affiliated with Framer. Product names belong to their owners. Facts about Framer were checked against its own documentation on 21 October 2026 and may have changed since. Not legal advice.

Free scan

Scan your Framer site.

Paste the published address. Patch visits from the UK, the EU and the US and tells you what he finds. Free, no signup.

No signup needed. Not legal advice; every check names its source.

Sources