It has never been faster to get a website running. Describe your business to an AI tool, answer a few questions, and within an hour you can have pages, a contact form, a booking widget and even custom code that connects them. For many small businesses, that speed is a real gift.

Speed, however, is not the same as readiness. An AI-built site can look finished while hiding problems that only appear after launch: a form that emails customer details to the wrong place, an admin page anyone can reach, a database query that accepts whatever a visitor types, or a plugin that nobody will update. This checklist explains what a professional review should cover before an AI-built website goes live, and why the review matters as much as the build.

Why AI-generated code still needs review

AI tools generate code by predicting what usually comes next. They are often right, and they can be impressively fast, but they do not know your business, your customers or the risks you are willing to accept. They may copy outdated patterns, skip security steps that were not mentioned in the prompt, or confidently produce code that works in a demo and fails under real use.

Security guidance has started to address this directly. In July 2024, the National Institute of Standards and Technology published Secure Software Development Practices for Generative AI and Dual-Use Foundation Models, a companion profile to its Secure Software Development Framework. The profile explains that its practices “do not distinguish between human-written and AI-generated source code, because it is assumed that all source code should be evaluated for vulnerabilities and other issues before use.”

That is the core principle of this checklist. Code written by a person and code generated by a tool deserve the same review. The tool that wrote the code should not be the only thing that checks it.

Start with ownership and access

Before looking at code, confirm who controls the site. Many problems with AI-built sites start with unclear ownership.

  • Domain: registered in the business’s name, with an account the owner controls.
  • Hosting: account owned by the business, with billing and recovery contacts the owner can reach.
  • AI tool and builder accounts: owned by the business, not a single employee or freelancer.
  • Code repository: a copy of all custom code stored somewhere the business controls.
  • Admin users: a list of everyone with administrator access, with any unknown accounts removed.

CISA’s Cyber Essentials Starter Kit makes the same point for any organization: setting approved access privileges requires knowing who operates on your systems and with what level of authorization and accountability. The kit recommends requiring multi-factor authentication for all users, starting with privileged, administrative and remote access users. Every account that can change the site, including the AI tool account, should use it.

Review the defaults the tool chose

AI tools and site builders make many decisions you never see. A professional review should look at each one deliberately.

In its October 2023 guidance, Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software, CISA and partner agencies describe secure by default products as those that are resilient against prevalent exploitation techniques out of the box. The guidance says a secure configuration should be the default baseline, and it urges eliminating default passwords. It also lists security features worth expecting, including multifactor authentication, security event audit logging and role-based access control.

The guidance is written for software makers, but it gives site owners a useful lens. For an AI-built site, ask:

  • Are any default or example passwords, keys or test accounts still active?
  • Are debug modes, sample pages or developer tools switched off?
  • Are file permissions and directory listings restricted?
  • Is every connection served over HTTPS?
  • Are admin areas protected by strong logins and multi-factor authentication?
  • Are logs being kept, and does someone know where to find them?

Check how the site handles visitor input

Contact forms, search boxes, booking widgets, logins and checkout pages all accept information from visitors. This is where many security problems begin.

The CISA guidance recommends ensuring that user input is validated and sanitized and is not entered directly into code, for example by using parameterized queries. In plain terms, the site should never trust what a visitor types. A reviewer should confirm that:

  • Database queries use parameterized queries or a trusted framework, not text pasted together from form fields.
  • Form fields check the type and length of what they accept.
  • Uploaded files are limited by type and size and stored safely.
  • Error messages do not reveal code, file paths or database details.
  • Forms include spam protection and rate limits.

These are exactly the kinds of details an AI tool may skip if the prompt did not ask for them.

Hands in navy sleeves sort blank amber and pink cards into two piles on a wooden desk.

Follow the data

Ask a simple question: where does every piece of customer information go?

Trace each form from the moment a visitor clicks submit. Does it send an email, write to a database, pass data to a third-party service, or all three? Who can read the results? How long is the information kept? A professional review often finds forms that send sensitive details by plain email, store submissions forever, or share data with services the owner never knowingly approved.

The Starter Kit advises organizations to know where their information resides and what applications store and process it, and to build security into and around those places. For a small business website, that means a short written map of what the site collects, where it goes, and who has access.

Review plugins, packages and integrations

AI-built sites often pull in plugins, code libraries and outside services to add features quickly. Each one is code the business now depends on. For every component, check:

  • Is it actively maintained, with recent updates?
  • Is it needed, or was it added for a feature you do not use?
  • Does it come from a reputable source?
  • Who is responsible for keeping it updated after launch?

Keep a simple list of components and versions. The CISA guidance encourages software bills of materials, which are formal inventories of software components. A small business does not need a formal one, but a written list makes future updates, audits and incident response much easier.

Test the business journeys, not just the pages

A site can pass a visual review and still fail at the tasks that matter. Before launch, a reviewer should complete every important journey as a real visitor would:

  • Submit each form and confirm the right person receives it.
  • Make a test booking or purchase, including a refund.
  • Create an account, reset a password and log out.
  • Use the site on a phone, a tablet and a computer.
  • Navigate with a keyboard only and check that headings and labels make sense.

Write down what passed, what failed and what was fixed. That record is useful the next time the site changes, especially if an AI tool makes the change.

Plan for updates, backups and problems

Launch is the beginning of the site’s life, not the end of the project. The Starter Kit recommends automatic backups of critical data and system configurations, enabling automatic updates whenever possible and replacing unsupported software, and it stresses being able to recover from known, accurate backups. Before launch, confirm:

  • Backups run automatically and are stored away from the live site.
  • Someone has tested restoring a backup.
  • Updates for the platform, plugins and packages have a named owner and schedule.
  • There is a short plan for what to do if the site is hacked or goes down, including who to call.
A florist in a navy apron smiles at his phone among buckets of orange and pink flowers.

Keep AI changes under the same rules

Many owners keep using AI tools to edit their site after launch. That is reasonable, but every change should follow the same process as the original build. Make changes on a staging copy, review the code or settings that changed, test the affected journeys, and keep a record. Avoid pasting passwords, customer data or private keys into AI prompts.

The CISA guidance also recommends that customers hold their software suppliers accountable for the security of their products and that decisions to accept risk be formally documented. For a small business, that can be as simple as a written note of what was reviewed, what risks remain and who approved the launch.

Questions to ask whoever built it

If a freelancer, employee or agency used AI tools to build the site, a few direct questions reveal a lot:

  • Which parts were generated by AI, and which were written or reviewed by a person?
  • What security testing was done, and can I see the results?
  • Which plugins, packages and outside services does the site rely on?
  • Where are the code, backups and account details stored?
  • Who will apply updates, and how quickly after a security fix is released?

Clear, specific answers are usually a good sign. Vague answers, or a reluctance to share access and records, suggest the site needs a much closer look before it launches.

When to bring in a professional

An owner can handle much of this checklist with care and time. A professional review is worth it when the site takes payments, collects sensitive information, connects to other business systems, or includes custom code the owner cannot read. A reviewer can spot unsafe patterns quickly, explain the risks in plain language and fix what matters most before launch.

If you want to understand how we approach reviews, see why choose Motta Industries. Our full list of services covers security reviews, development, hosting and ongoing maintenance for sites however they were built.

A fictional example

Consider a fictional yoga studio owner who used an AI tool to build a site with class schedules, a booking form and a members area in one weekend. Before launch, a developer reviewed the site. The review found a test admin account with a simple password, a booking form that stored payment details in plain text, and an outdated calendar plugin. The developer removed the test account, enabled multi-factor authentication, switched payments to a hosted checkout, replaced the plugin and set up daily backups. The site launched a week later than planned, with a written list of components and an update schedule.

An AI-built website review checklist

  • Confirm the business owns the domain, hosting, tool accounts and code.
  • Remove unknown admin users and require multi-factor authentication.
  • Remove default passwords, test accounts and debug settings.
  • Validate and sanitize all visitor input.
  • Map where customer data goes and who can read it.
  • List every plugin, package and integration with an owner.
  • Test every important journey on several devices.
  • Confirm automatic backups and a tested restore.
  • Review every AI-made change before it goes live.
  • Document what was reviewed and who approved launch.

Ready for a second set of eyes before you launch? Contact us to schedule a review.