A customer signs in and sees their quotation. The demo works. But what happens if they request another customer’s quotation directly? The difference between those two questions separates a visible feature from a security decision. AI-generated code, a website builder and a custom framework all need appropriate checks when handling private information. The tool can help implement protection; someone still needs to understand and verify it.
Verify permission, not just identity
Authentication checks who a person is. Authorization decides what that person may access or change. Hiding an administration button does not protect the underlying action. Access must be checked where the request is processed. OWASP recommends checking permissions on every request and denying access unless it has been granted. Its authorization guidance provides the technical foundation for that review.
For an illustrative building contractor, test two ordinary customer accounts and a staff account. Confirm that each customer sees only their own documents, even when opening a copied address. Confirm that a staff member’s permitted actions match their role. These checks should happen in an authorized test environment with synthetic records, not by experimenting on another business’s website or using real customer documents unnecessarily.
Trace where private information travels
List the information collected in forms, uploads, accounts and integrations. Identify where it is stored, who can access it and how long it is needed. A quotation form may send data to a mailbox and a CRM, creating multiple places to manage. Removing the original form entry does not necessarily remove every copy. Technical design and operational responsibilities need to agree.
Keep privileged service credentials away from browser code and public files. A configuration that works locally can behave differently after deployment, so review the actual public application and its server settings. Security scanners can help find certain issues, but passing a scan does not establish that all business permissions are correct. A framework choice also does not by itself establish GDPR compliance.
Consider misuse and ordinary mistakes
A public endpoint can receive automated submissions, oversized uploads or repeated requests. Decide how to validate inputs, limit abusive traffic and handle suspicious activity without unnecessarily blocking genuine visitors. A system that rejects malicious input but silently loses legitimate enquiries still fails the business. Provide a clear recovery path for customers whose submission cannot be accepted.
Staff workflows matter too. Shared administrator accounts make responsibilities harder to trace. Grant access for actual duties, remove it when those duties end and protect important accounts appropriately. Record who controls the domain, hosting and connected services. If a sole employee’s personal email owns everything, an otherwise well-built site can become difficult to operate when that person leaves.
Prepare for updates and recovery
Dependencies, plugins and hosting services require continued attention. Agree who receives security notifications, evaluates updates and tests important journeys after a change. Backups need a restoration process, not just a reassuring label in a dashboard. Decide which data and files must be recoverable and test a restoration in a suitable environment. Record the steps and who can perform them.
Logs can help investigate problems, but they should avoid collecting passwords, secret keys or unnecessary personal details. Define who can read them and when they are removed. Our maintainability guide explains how documentation and clear ownership support ongoing work. Security remains a continuing responsibility after the first successful deployment.
Decide whether the site is ready for real customers
Ask for evidence about important permission boundaries and failure cases. An agency should be able to explain what was tested, which risks remain and who handles incidents. A brochure website and a customer portal have different exposure; the review should reflect the functions actually offered. Use our AI website launch checklist to connect security with other launch checks.
The professional website hub helps you assess the full project. Webility’s care plans and hosting service can support a defined maintenance arrangement. Discuss the information your website needs to protect before customers depend on accounts, documents or connected workflows.
