How to secure a website you built with AI

A website you built with AI can be just as secure as a hand-coded one, but only if you ask for security explicitly and check it before launch. Most real-world problems come from four places: stolen account logins, secret keys in the wrong place, databases without access rules, and outdated dependencies. Fix those and you have covered the majority of the risk for a small business site.

AI tools are good at producing code that works. They are less consistent about code that is safe, because "safe" is rarely part of the prompt. Make it part of every prompt.

1. Lock down every account

Your website is controlled by a chain of accounts. The weakest one is the way in.

For each one: a unique password from a password manager, two-factor authentication with an authenticator app or passkey, and recovery codes stored safely. Remove access for anyone who no longer needs it. We cover the human side of this in cybersecurity for small businesses.

2. Keep secrets out of the code

API keys, database secrets, email service tokens and payment keys must never appear in front-end code or in your GitHub repository.

• Store them as environment variables in your host's dashboard.
• Add .env files to .gitignore before the first commit.
• Know which keys are public by design (such as Supabase's publishable key or a Stripe publishable key) and which are secret. Only server code should use secret keys.
• If a secret is ever committed or pasted somewhere public, rotate it immediately. Deleting the file does not remove it from Git history.
• Turn on GitHub secret scanning alerts where available.

Ask Claude: "Search this project for anything that looks like a key, token or password, and tell me which are safe to be public."

3. Protect the database

If you use Supabase or another backend, this is the highest-stakes step. Enable Row Level Security on every table, write policies that default to no access, and test as an anonymous visitor. The details are in what is Supabase and how authentication works. Watch for SQL injection if any code builds database queries from user input; parameterized queries or the official client libraries avoid it.

4. Handle forms and user input carefully

Forms are the most common way attackers and spammers touch a small site.

• Validate input on the server, not just in the browser.
• Escape anything users submit before displaying it, to prevent cross-site scripting.
• Add rate limiting and a CAPTCHA or honeypot field to public forms.
• Do not collect data you do not need. Every field is something you must protect.
• Never collect card numbers in your own form. Use a payment provider's hosted checkout. See why DIY ecommerce should use a platform.

5. Add security headers and HTTPS

Your host provides free SSL/TLS. Make sure every page redirects to HTTPS. Then add security headers in your host's configuration file:

Ask Claude to add them for your host (a netlify.toml, vercel.json or Amplify custom headers file) and then check the result with a free header scanner. Content-Security-Policy takes the most tuning, because analytics and embeds need to be allowed explicitly.

6. Keep dependencies current

A modern site pulls in dozens of open-source packages. A vulnerability in one is a vulnerability in your site, and a compromised package is a supply chain attack.

• Turn on Dependabot alerts in GitHub.
• Run npm audit (or ask Claude to) before each launch and monthly after.
• Prefer fewer, well-maintained packages. Ask Claude why each new dependency is needed.
• Commit your lock file so builds use the exact versions you tested.

7. Use the platform's protections

Netlify, Vercel and AWS include protections such as DDoS mitigation, and some offer a web application firewall. Check what your plan includes and turn on deploy protection for preview links if they show unreleased work. Our hosting guide for DIY sites compares the three.

8. Back up and monitor

• Your code is backed up in GitHub. Your database is not, unless you set it up. Follow the 3-2-1 backup rule for anything you cannot recreate. See backups and ransomware.
• Add free uptime monitoring so you hear about outages before customers do.
• Protect your domain's email with SPF, DKIM and DMARC, explained in domains, DNS, SSL and email authentication.

9. Ask Claude for a security review, then verify

Before launch, give Claude Code a review prompt like:

Review this project for security issues: exposed secrets, missing database access rules, unvalidated inputs, unsafe HTML rendering, missing security headers, outdated or unnecessary dependencies, and anything sent to third parties. List each finding with severity and the fix. Do not change code until I approve.

Read the findings, approve fixes one at a time and re-test. For sites that handle payments, health or financial data, get a professional review as well. Our general small business website security checklist is a good companion.

The short version

Two-factor on every account, secrets only in environment variables, Row Level Security on every table, validated forms, security headers, current dependencies and real backups. Ask Claude for security explicitly and review what it changes. Back to the main guide: how to build your own website with Claude. Want a second set of eyes? Ask us for a review.