AI builds fast. Security is not part of the speed.
Tools like Bolt, Lovable, and Replit Agent can generate a working website from a text prompt in under an hour. The layout works, the forms submit, the navigation clicks. It looks finished.
But the code underneath was generated to work first and be secure second. That is not a theoretical risk. AI-generated code regularly ships with vulnerabilities that a careful developer would catch during review: exposed API keys in client-side code, forms that accept any input without validation, database queries built from user-supplied text, and authentication logic that skips the hard parts.
For a business owner, this does not matter until it matters a lot. A contact form that leaks customer data. A login page that lets anyone in. A site that gets flagged by Google as unsafe. These are not edge cases. They are the natural result of treating speed as the only goal.
What AI-generated websites get wrong
The problems are predictable because they come from how the tools work. AI generates code from patterns in its training data. Those patterns include insecure practices alongside secure ones. Without explicit instructions and review, the output tends toward the path of least resistance.
Forms without server-side validation. AI generates a contact form that looks right and submits data. But the validation happens only in the browser, where anyone can bypass it. A form that accepts anything can be used to send spam, inject malicious scripts, or overflow a database field. Server-side validation — checking the data again after it arrives — is the part that actually protects you.
Exposed secrets. API keys, database credentials, and service tokens sometimes end up in client-side JavaScript. Anyone who opens the browser developer tools can read them. This is a common result of AI tools connecting to external services: the connection works, but the credentials are visible to every visitor.
Missing security headers. HTTP security headers tell the browser how to behave: whether to allow iframes, whether to upgrade insecure connections, how to handle content types. AI tools rarely add these by default. Without them, the site is more vulnerable to clickjacking, content sniffing, and mixed-content attacks.
SQL injection and input handling. When a website takes user input and uses it to query a database, the input needs to be sanitised. AI-generated code sometimes builds queries by concatenating strings instead of using parameterised queries. This is the classic path to SQL injection, where an attacker can read, modify, or delete your database through a form field.
Outdated dependencies. AI tools generate code that uses libraries and packages. Some of those packages have known vulnerabilities. If the generated project does not include a process for updating dependencies, the site launches with known holes that get worse over time.
What to check before your AI-generated site goes live
You do not need to be a security expert to catch the most common problems. These checks cover the basics.
Open the browser developer tools and look at the source. Right-click on your page, select “View page source” or open the developer console. Search for API keys, tokens, or credentials in the JavaScript. If you find strings that look like keys (long random characters, often prefixed with sk-, pk-, or similar), those should not be there.
Test your forms with unexpected input. Try submitting your contact form with a very long string, with HTML tags, with SQL keywords like ’ OR 1=1—, and with empty fields. If the form accepts all of this without complaint, the server-side validation is missing or weak.
Check your security headers. Use a free tool like securityheaders.com to scan your site. It will show which security headers are present and which are missing. A green score means the basics are covered. A red score means the site is leaving doors open.
Run a basic vulnerability scan. Tools like Mozilla Observatory or Sucuri SiteCheck can scan your site for common vulnerabilities. They are not comprehensive, but they catch the obvious problems.
Ask your web partner about their security review process. If someone else built the site, ask them specifically: what security headers are set, how form input is validated, whether dependencies are updated, and how credentials are managed. A good partner will have clear answers. A vague answer is a warning sign.
How AI can actually help with security
The same tools that create security gaps can also help close them. The key is using AI for security review, not just for generation.
Code review. You can paste generated code into an AI tool and ask it to identify security vulnerabilities. The tool will flag common issues like unsanitised input, exposed credentials, and missing validation. This is not a replacement for a professional security audit, but it catches problems that would otherwise ship unnoticed.
Security header configuration. AI can generate the correct security header configuration for your web server or hosting platform. The headers themselves are well-documented, and AI is good at producing correct configuration files for specific environments.
Dependency auditing. AI can review your project’s dependency list and flag packages with known vulnerabilities. It can also suggest safer alternatives or updated versions.
Penetration testing guidance. AI can walk you through a basic penetration testing checklist: what to test, how to test it, and what the results mean. This is useful for a business owner who wants to understand their site’s security posture without hiring a penetration tester for every change.
Documentation. AI can generate security documentation for your site: what measures are in place, how credentials are managed, what the update process looks like. This is useful for internal records and for demonstrating due diligence to clients or regulators.
The cost of getting it wrong
Website security breaches are expensive. Not just in direct costs — though those are real — but in reputation, customer trust, and time.
A site flagged by Google as “This site may harm your computer” loses most of its traffic overnight. Removing the flag takes days to weeks, during which the business loses enquiries and credibility. A data breach involving customer information can trigger legal obligations, regulatory notifications, and lasting damage to the company’s reputation.
For a small business, the most common security incident is not a sophisticated attack. It is a compromised contact form used for spam, a hacked page that redirects visitors to a malicious site, or a brute-force attack on a weak admin password. These are preventable with basic measures that cost almost nothing to implement.
What to demand from your web partner
If you are hiring someone to build your website, security should be part of the conversation from the start, not an afterthought.
Ask about their development practices: do they validate form input on the server side? Do they use parameterised queries? Do they set security headers? Do they have a process for updating dependencies?
Ask about deployment: how are credentials managed? Are API keys stored securely? Is the site served over HTTPS? Are admin pages protected?
Ask about monitoring: will you be notified if the site goes down? Is there a process for applying security updates? Who is responsible if a vulnerability is discovered after launch?
A good web partner will have answers to these questions. They will not treat security as optional or as something to add later. They will build it in from the start because fixing a security problem after launch is always more expensive and more disruptive than preventing it.
How we approach security at iDoWeb
We treat security as a baseline, not an add-on. Every website we build includes server-side form validation, security headers, HTTPS, secure credential management, and a dependency update process. We review generated code for common vulnerabilities before it goes live.
This is not because we expect every site to be attacked. It is because the cost of prevention is low and the cost of a breach is high. A website that works but is not secure is a liability, not an asset.
If you are considering an AI-assisted website project and want to make sure the result is secure from day one, start by asking your web partner the questions above. The answers will tell you whether security is part of their process or something they hope will not come up.
Related service: Web design and content strategy