You Built a Website With AI. But Is It Secure? 20 Things to Check Before You Share It

Key Takeaways

• Secure the domain, hosting, website and recovery email accounts with multifactor authentication and unique passwords.
• Test whether users can access only their permitted data; hidden links and buttons are not sufficient access controls.
• Treat scan grades as clues, test backups and ask AI builders for evidence of what they inspected.

First, Know Which Checks Apply to Your Website

Your new website looks professional. The contact form works. The payment button is ready. You built it using ChatGPT, Lovable, Bolt, Replit or another AI tool, perhaps without writing a single line of code.

But here's a question your AI builder may never have answered:

Can someone access information they're not supposed to see?

Imagine a customer logs into your website to view their order. They change one number in the website address, and suddenly another customer's name, address and purchase details appear.

The website works perfectly. But its security has failed.

This is why launching an AI-built website requires more than checking whether its buttons work.

A working website shows what visitors can do. A security check asks what they should never be able to do.

This guide walks through 20 practical security checks, with examples from familiar platforms, free tools and AI prompts you can use to investigate problems.

You don't need to become a cybersecurity expert. But you do need to understand what you're checking, where to look and when to ask for help.

How Do You Check Whether an AI-Built Website Is Secure?

Start with the accounts controlling your website, including your domain registrar, hosting provider and AI builder. Then check HTTPS, private API keys, database permissions, customer access, forms, software updates and backups.

Free tools can identify some security configuration problems. AI assistants with access to your project can help review code and explain findings. Neither can guarantee that your website is completely secure.

Not every check applies to every website. A personal portfolio has different risks from an online store collecting customer information.

For each check, record one of four results:

• Checked
• Needs fixing
• Handled by my provider
• Not applicable

If you don't know the answer, mark it for investigation rather than assuming everything is safe.

Start With Three Free Website Security Tools

Before inspecting your website's internal settings, run a few basic public checks.

Example: You built mybusiness.com using an AI website builder.

Open SSL Labs, enter your domain and review the results. Then run Security Headers or Mozilla Observatory to identify browser protection settings that may need attention.

These tools can be used without installing software. Only assess websites you own or have permission to check.

A high score doesn't mean your database is secure. A low score doesn't necessarily mean someone has hacked your website.

Security Headers and Observatory also overlap, so you don't need to treat them as three completely independent assessments.

AI Prompt — Understand My Website Security Scan

I built my website using [platform]. I'm not a cybersecurity expert.

Explain these security scan findings in simple English: [paste results].

Identify which findings are important, what they could mean for my website, which settings I should investigate and which changes might break existing features.

Separate confirmed problems from possible risks. Don't recommend changing settings merely to improve a score.

Remove sensitive information before sharing reports with an AI assistant.

Part 1: Protect the Accounts That Control Your Website

1. Secure Your Domain Account

Example: You bought your domain from Namecheap.

Your domain is your website's address, such as mybusiness.com. The company where you registered it controls important registration and DNS settings.

If someone takes over that account, they may be able to redirect visitors to a fraudulent website or interfere with services connected to your domain.

How to check in Namecheap

1. Visit Namecheap and sign in.
2. Open your account's Profile or Security settings.
3. Find two-factor authentication and enable it. Prefer an authenticator app or security key when available.
4. Open Domain List and select Manage beside your domain.
5. Find Registrar Lock or Domain Lock and confirm it is enabled.
6. Review your nameservers and DNS records to ensure they match the services you use.

The exact menu names may change.

What should you see?

Your domain account has multifactor authentication, current recovery information and transfer protection. Your DNS settings match your intended hosting and email providers.

What if something looks wrong?

Do not randomly change DNS records. An incorrect change could disconnect your website or business email. Ask your registrar or hosting provider to investigate unfamiliar settings.

AI Prompt

I purchased my domain from [Namecheap/GoDaddy/Cloudflare/other provider]. Explain step by step how to check account security, two-factor authentication, domain transfer lock, recovery information and DNS settings. Tell me which settings are safe to review and which I should not change without confirming their purpose.

2. Protect Your Website Builder and Hosting Accounts

Example: You built a website with Lovable and deployed it through Vercel.

Your domain account and hosting account are different.

Even if your domain is protected, someone who gains access to your hosting dashboard may be able to change the website, access deployment settings or interfere with services.

How to check

1. Sign in to your AI builder and hosting provider.
2. Open account security settings.
3. Enable multifactor authentication or a passkey where supported.
4. Review connected GitHub accounts, integrations and authorized applications.
5. Remove unfamiliar or unnecessary access.
6. Secure the email account used for password recovery.

Safe result: Only authorized people and integrations can control your website.

AI Prompt

My website was created using [AI builder] and hosted on [hosting platform]. List the accounts and integrations that could control my website. Explain how to review login security, recovery methods, connected services and unauthorized access without exposing private information.

3. Stop Reusing Passwords

Example: You use the same password for your email, domain registrar and website dashboard.

If that password is stolen through a breach of another service, an attacker may try it against your website accounts.

How to check

Open your password manager and review the passwords for your domain, hosting, website builder, email and payment services.

Replace reused passwords with unique, strong passwords. Use a password manager to store them.

Where available, enable passkeys or multifactor authentication.

Safe result: Each important account has a unique password or passkey and an additional security layer where supported.

AI Prompt

Create a beginner-friendly account security checklist for someone operating a small business website. Include domain, hosting, email, AI builder, database and payment accounts. Explain password managers, passkeys and multifactor authentication. Do not ask me to reveal any passwords.

4. Remove Unnecessary Administrators

Example: A freelancer helped build your website six months ago.

They no longer work with you, but their account still has administrator access.

If their account is compromised, your website may also be at risk.

How to check

1. Open your website builder's team or members settings.
2. Review all users and pending invitations.
3. Check your hosting, database and GitHub collaborators separately.
4. Remove access that is no longer required.
5. Give remaining collaborators only the permissions they need.

Safe result: Every administrator has a legitimate reason to retain access.

AI Prompt

Help me audit user permissions across my website builder, hosting provider, GitHub repository and database. Explain which roles normally need administrator access and how to identify unnecessary permissions. Do not remove anyone automatically.

Part 2: Check What Visitors Can See and Do

5. Confirm HTTPS Works Properly

Example: A customer enters their contact information on your website.

HTTPS helps protect information travelling between their browser and your website.

Without properly configured HTTPS, information may be exposed to interception or tampering.

How to check

1. Open your website using https://.
2. Check for browser certificate warnings.
3. Enter the http:// version of your address.
4. Confirm it redirects to HTTPS.
5. Run the domain through Qualys SSL Labs.

Safe result: Your website uses a valid HTTPS connection without certificate warnings.

Remember, HTTPS does not prove that your database, customer accounts or website code are secure.

AI Prompt

Explain how to verify HTTPS on my website, including certificate validity, HTTP-to-HTTPS redirects and SSL Labs findings. Tell me what each result means and which problems require my hosting provider's assistance.

6. Check Browser Security Protections

Example: Your website contains customer login pages, payment integrations and third-party scripts.

Browser security headers can help reduce risks involving malicious scripts, unwanted page embedding and insecure browser behaviour.

How to check

1. Open SecurityHeaders.com.
2. Enter your domain.
3. Review the results.
4. Pay attention to findings involving Content Security Policy, HSTS and other relevant headers.
5. Ask your hosting provider or developer which protections are appropriate for your website.

Safe result: Relevant browser protections are configured without breaking legitimate website functionality.

Do not copy random security header configurations into your website. An overly restrictive Content Security Policy, for example, can block legitimate scripts and services.

AI Prompt

Review these website security header results: [paste findings]. Explain which protections are missing, how serious each finding is, which settings apply to my hosting platform and how to test changes safely before publishing them.

7. Look for Exposed Private API Keys

Example: You connected your AI-built website to OpenAI, Stripe or an email delivery service.

Your website may need API keys to communicate with these services.

Some keys are designed to appear in browser code. Others must remain private.

How to check

1. Open your AI builder or coding project.
2. Find environment variables, secrets or configuration settings.
3. Identify which keys are intended to remain private.
4. Ask your builder to inspect accessible source code and project history for exposed credentials.
5. Verify that private keys are not included in public browser code or downloadable files.

Safe result: Private credentials remain in protected server-side settings.

If a private key was exposed, revoke or rotate it through the relevant provider. Removing it from the latest code does not make the old key safe.

AI Prompt

Review the project files and configuration you can access for exposed API keys and credentials. Identify which keys are intentionally public and which must remain private. Do not display secret values. Explain the evidence for each finding and how to rotate a compromised key safely. Do not change anything without approval.

8. Check Your Database Permissions

Example: You built an online store using Lovable and Supabase.

Customers submit contact details and place orders. That information is stored in a database.

A database can contain private information even when the website itself looks completely normal.

How to check

If your project uses Supabase:

1. Sign in to Supabase.
2. Open your project.
3. Go to the Table Editor and identify tables containing private information.
4. Review whether Row Level Security (RLS) is enabled for relevant tables.
5. Inspect the policies controlling which users can read, insert, update or delete records.
6. Ask your builder or developer to verify the policies using safe tests and dummy data.

RLS being enabled does not automatically mean the policies are correct.

Safe result: Public visitors and signed-in customers can access only the information they're authorized to use.

AI Prompt

My website uses Supabase. Review the database tables and Row Level Security policies you can access. Identify tables containing private information. Check whether anonymous users or authenticated customers could read or modify records they should not access. Explain the evidence, suggest safe tests using dummy data and propose fixes without applying them.

9. Test Whether Customers Can See Each Other's Information

Example: A customer visits:

mybusiness.com/orders/1001

That page shows their order.

But what happens if they change 1001 to 1002?

If another customer's private order appears, the website may have a broken access-control vulnerability.

How to check

1. Create two test customer accounts with dummy information.
2. Create a test order under each account.
3. Sign in as Customer A.
4. Try opening Customer B's test order using its address.
5. Confirm that unauthorized access is denied.
6. Have your developer or project-aware AI assistant verify the underlying server or database permissions.

Only perform these tests on accounts and data you control, preferably in a test environment.

Safe result: Customer A cannot read or modify Customer B's private information.

Hiding a page link is not enough. Access restrictions must be enforced behind the scenes.

AI Prompt

Review my application's authorization controls. Identify places where users access records using IDs in URLs or API requests. Explain how to test with two dummy accounts that each user can access only their own permitted records. Verify server-side enforcement where code access allows it. Do not test real customer accounts.

10. Protect Your Contact Form Against Spam and Abuse

Example: Your website has a contact form that sends an email whenever someone submits a message.

An attacker or automated bot may repeatedly submit the form, filling your inbox or generating unexpected service charges.

How to check

1. Open your website's form configuration.
2. Identify the service processing submissions.
3. Check whether server-side validation is used.
4. Review rate limits and available spam protections.
5. Verify that submitted data is handled safely.
6. Test that legitimate messages still arrive after any protection is added.

Safe result: The form accepts legitimate submissions while limiting obvious automated abuse.

AI Prompt

Review my website's contact form implementation. Check server-side validation, spam protections, rate limiting, email delivery and potential abuse-related costs. Explain which controls already exist, which are missing and how to test improvements without disrupting legitimate customers.

11. Check Whether Form Inputs Can Affect Database Queries

Example: Your website has a search box where visitors enter product names.

That text should be treated as information, not as instructions capable of changing a database command.

Poorly constructed database queries can create SQL injection vulnerabilities.

How to check

1. Ask your AI builder to identify database queries receiving user input.
2. Check whether queries use parameterized statements or equivalent safe database methods.
3. Review custom SQL and backend code carefully.
4. Ask for evidence showing how input is handled safely.

Safe result: User-provided text cannot alter the intended structure of database queries.

Avoid experimenting with attack strings on a live production website.

AI Prompt

Review the database queries in my project for SQL injection risks. Identify where user-controlled input reaches database operations. Check whether parameterized queries or equivalent safe methods are used. Provide file locations and evidence for findings, but do not execute attacks or modify the code.

12. Check Whether Submitted Text Can Run as Code

Example: Your website lets visitors leave comments or submit reviews.

A visitor's message should appear as text. It should not be able to execute JavaScript in another person's browser.

This type of problem can involve cross-site scripting, often called XSS.

How to check

1. Identify pages displaying visitor-submitted information.
2. Include comments, reviews, profiles and administrator dashboards.
3. Ask your builder how that content is rendered.
4. Confirm ordinary text is safely escaped.
5. If formatted content is supported, review whether appropriate sanitization is applied.

Safe result: Submitted content displays as intended without executing unauthorized scripts.

AI Prompt

Review how my website displays user-submitted content, including forms, comments, profiles and admin pages. Identify possible cross-site scripting risks. Explain whether output escaping or sanitization is appropriate for each location. Do not run malicious scripts or make changes automatically.

13. Restrict File Uploads

Example: Your website allows customers to upload profile pictures, documents or receipts.

A button labelled "Upload photo" doesn't guarantee that every uploaded file is safe.

How to check

1. Find the upload feature in your project.
2. Review allowed file types and maximum sizes.
3. Check where uploaded files are stored.
4. Confirm private files require appropriate authorization.
5. Ask whether uploaded content can execute as server code.
6. Review file validation and malware scanning where appropriate.

Safe result: The website accepts only permitted uploads and protects private files from unauthorized access.

AI Prompt

Review my website's file upload feature. Check file-type validation, size limits, storage permissions, private file access and whether uploaded content could execute as code. Explain which protections are present and which require additional verification.

14. Review Login Sessions and Password Recovery

Example: A customer signs in on a shared computer, uses your website and then clicks Logout.

Does the session actually end?

Could someone reuse an old session or exploit a poorly protected password-reset process?

How to check

1. Create a test customer account.
2. Sign in and then log out.
3. Confirm protected pages and actions no longer work using that session.
4. Test password recovery using your own test email.
5. Check whether reset links expire and are single-use where appropriate.
6. Ask your builder to review session cookies, token handling and login attempt protections.

Safe result: Sessions and recovery processes work for legitimate users without granting unauthorized access.

AI Prompt

Review my website's authentication and session management. Check logout behaviour, session invalidation, password-reset links, token handling, cookie settings and repeated login attempts. Explain how to verify each safely using a test account and identify anything you cannot confirm.

Part 3: Review the Software Behind Your Website

15. Update Software and Remove Unused Components

Example: Your website uses WordPress.

You installed several plugins when building the website. Some are no longer needed.

Outdated plugins and themes can contain known vulnerabilities.

How to check in WordPress

1. Sign in to your WordPress administrator dashboard.
2. Open Dashboard → Updates.
3. Review available WordPress, plugin and theme updates.
4. Open Plugins → Installed Plugins.
5. Identify plugins you no longer need.
6. Confirm you have a reliable backup before making important changes.
7. Update and remove components carefully, then test the website.

For AI-built applications, ask your coding assistant to review package dependencies and supported versions.

Safe result: Your website uses maintained software, unnecessary components are removed and important security updates are applied promptly.

AI Prompt

Review the software dependencies, plugins or packages used by my website. Identify outdated, unsupported or vulnerable components using available evidence. Explain the impact of updating each component, possible compatibility problems and how to test updates safely. Do not make changes without approval.

16. Review the Code AI Generated

Example: You asked an AI builder to create customer registration, a dashboard and an online payment feature.

The AI produced working code, but did it implement proper permissions, input validation and secure handling of private data?

You shouldn't assume that working code is secure code.

How to check

1. Open your project in an AI coding assistant with access to its files.
2. Ask for a security-focused review.
3. Prioritize authentication, authorization, private credentials, database access and third-party integrations.
4. Request evidence and relevant file locations for findings.
5. Ask the assistant to identify anything it couldn't inspect.

Safe result: Important security controls have been reviewed and verified, with unresolved risks clearly documented.

AI reviews can miss vulnerabilities. Websites handling sensitive information or important financial transactions may require an independent professional assessment.

AI Prompt

Act as a security reviewer for my AI-built website. Inspect the project code and configuration you can access for authentication flaws, broken authorization, exposed credentials, unsafe data handling, vulnerable dependencies and insecure integrations.

For every finding, provide the location, evidence, potential impact and a safe verification method.

Separate confirmed vulnerabilities, suspected risks and areas you could not inspect. Do not change code or perform destructive tests.

17. Check Hosting Protections and Public Files

Example: Your website is hosted on Vercel, Netlify, Cloudflare or another platform.

You may assume the hosting provider protects everything automatically.

In reality, the provider and website owner often have different responsibilities.

How to check

1. Open your hosting dashboard.
2. Review security and deployment settings.
3. Ask whether request filtering, rate limiting or firewall protections are available.
4. Check whether configuration files, logs or backups could be publicly accessible.
5. Review access to storage buckets and deployment environments.
6. Confirm which security settings your provider manages and which remain your responsibility.

Safe result: Sensitive files are protected, public access is intentional and relevant hosting protections are configured.

A firewall cannot fix a database permission problem.

AI Prompt

My website is hosted on [provider]. Explain the security responsibilities of the hosting provider versus the website owner. Review the hosting configuration you can access for publicly exposed files, insecure storage, missing traffic protections and excessive permissions. Tell me what requires manual verification.

Part 4: Make Sure You Can Recover After an Attack

18. Test Your Website Backups

Example: Your website stops working after a faulty update or security incident.

You discover that your last backup contains only website files, not the customer database.

A backup is useful only if it contains what you need and can actually be restored.

How to check

1. Open your hosting or backup provider's dashboard.
2. Find backup settings.
3. Confirm what is backed up.
4. Check how often backups run and how long copies are retained.
5. Verify that databases and uploaded files are included where needed.
6. Perform a test restoration in a separate environment.

Safe result: You can recover the necessary website files, data and configuration without overwriting your live website during testing.

AI Prompt

Help me create a backup verification checklist for my website hosted on [provider]. Explain how to check backup frequency, retention, database coverage, uploaded files and restoration procedures. Give me a safe test plan that does not overwrite production data.

19. Enable Useful Security Alerts

Example: Someone signs in to your hosting account from an unfamiliar device or changes an administrator's permissions.

Would you know?

Security alerts help you detect suspicious activity and service problems.

How to check

1. Open security and notification settings for your important accounts.
2. Enable available alerts for suspicious logins.
3. Review administrator-change and service-health notifications.
4. Check where alerts are delivered.
5. Confirm the notification email is monitored.
6. Decide who will investigate important alerts.

Safe result: Relevant warnings reach someone who can respond.

AI Prompt

Create a security monitoring checklist for my website using [platforms]. Identify useful alerts for administrator access, suspicious logins, website availability, unusual activity and service failures. Explain which alerts are available natively and which may require additional tools.

20. Create a Simple Website Recovery Plan

Example: You wake up and discover your website has been compromised.

Your hosting account is inaccessible, customer information may have been exposed and you don't know whom to contact.

A recovery plan helps you respond without improvising during an emergency.

How to prepare

Write down:

1. Your domain registrar and support contact.
2. Your hosting provider and recovery procedures.
3. The person responsible for website security.
4. Where backups are stored.
5. How to revoke compromised API keys.
6. How to restrict website access if necessary.
7. How to preserve evidence and investigate an incident.
8. Who will assess customer notification and legal obligations.

Store the plan somewhere accessible even when your website is offline.

Safe result: You know the first actions to take, who is responsible and how to recover essential services.

If customer information may have been exposed, obtain qualified assistance promptly.

AI Prompt

Create a beginner-friendly cybersecurity incident response plan for my small business website. My domain provider is [provider], hosting provider is [provider] and database service is [provider].

Include immediate containment, protecting accounts, preserving evidence, contacting providers, restoring backups, checking for exposed customer information and deciding when professional or legal assistance is needed.

Keep the instructions practical and do not assume that every incident requires shutting down the website.

Three AI Prompts to Use Before Launching Your Website

You don't need to paste all 20 checks into your AI builder separately. If your coding assistant can access your project, these three prompts can help organize the review.

AI Prompt #1: Audit My Entire Website

I built this website using AI and I am not a cybersecurity expert.

Review the code, configuration and integrations you can access for security risks.

Prioritize domain and account security, authentication, authorization, exposed private credentials, database permissions, forms, file uploads, software dependencies and backups.

For each of the 20 security checks, mark:

• Verified
• Potential problem
• Needs manual verification
• Handled by provider
• Not applicable

Explain your evidence in simple English. Do not claim a check passed unless you actually verified it.

Do not display secrets, modify code or run destructive tests.

AI Prompt #2: Explain What I Need to Fix First

Here are the findings from my website security review: [paste findings].

Rank them by urgency, considering the likelihood of exploitation, possible impact and whether sensitive customer information is involved.

For each issue, explain what could happen, what evidence supports the finding, who should fix it and how to verify the solution.

Separate confirmed problems from possibilities. Use beginner-friendly language.

AI Prompt #3: Help Me Fix Problems Safely

I want to address this security finding: [describe finding].

Explain the smallest effective fix, what might stop working, which backup or rollback option I need and how to test the change safely.

Provide a step-by-step implementation plan.

Wait for my approval before changing anything.

After the change, explain how to verify that the vulnerability is addressed and that existing features still work.

Important: An AI assistant that only knows your public website address cannot automatically inspect private source code, hosting settings or database permissions. It must have appropriate access to those resources, and even then its conclusions require verification.

Never paste passwords, private API keys or real customer records into an AI conversation.

Your Website Security Checklist Before Launch

Mark each applicable check as completed only when you have sufficient evidence. Record unresolved findings and who is responsible for fixing them.

How Often Should You Check Website Security?

Security is not something you complete once and forget.

Review administrator access, security alerts, software updates and backups regularly. Recheck relevant protections after adding new features, payment systems, customer accounts, plugins or external integrations.

A website that was secure before an update may develop new risks afterward.

Critical security warnings should be investigated promptly rather than waiting for a monthly review.

The Biggest Mistake People Make With AI-Built Websites

AI tools have made website creation dramatically more accessible. Someone without a traditional development background can now create a professional-looking website, connect a database and launch an online business.

But creating a feature and securing that feature are different tasks.

A customer dashboard may display information correctly while allowing unauthorized access behind the scenes. A contact form may work while exposing private submissions. A payment integration may function while sensitive credentials are handled incorrectly.

The solution isn't to stop using AI.

It's to ask better questions, require evidence and verify the answers.

You asked AI to build your website. Now ask it to explain how that website protects the people who use it.

---

Official Tools and Further Reading

• Qualys SSL Labs — SSL Server Test
• Security Headers
• Mozilla HTTP Observatory
• Namecheap Help Center
• TwikUp — Canada Issues Urgent Security Warning: Is Your WordPress Website at Risk?