Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
Post History
There are SaaS providers for building and hosting websites made with WYSIWYG and LLM-prompt website builders, such as WordPress.com, Webflow, etc. I guess these services should be secure-by-default...
#2: Post edited
by
FractionalRadix
·
2026-05-28T14:36:26Z (4 months ago)
Fixed grammar.
How do websites built by website builders defend security threats or follow secure coding?
There are SaaS providers for building and hosting website made with WYSIWYG and LLM-prompt [website builder](https://en.wikipedia.org/wiki/Website_builder), such as WordPress.com, Webflow, etc. I guess these services should be secure-by-default and secure-by-design, e.g. the builders should be guided to generated code to follow [secure coding in JavaScript](https://stackoverflow.blog/2025/10/15/secure-coding-in-javascript/), and the hostings should provide [automated vulnerability detection](https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools). However, I'm not sure if the generated code can effectively defend [security threats](https://en.wikipedia.org/wiki/Application_security#Security_threats) or [likely attacters](https://wiki.owasp.org/index.php/Security_by_Design_Principles#About_attackers).In my understanding, most components are merely HTML snippets, so they are bullet-proof. Dynamic components like routing, login, payment or APIs to third-party services can be made secure-by-default and secure-by-design. So a toy made from secured lego bricks should be secured as well? I wonder if the security decreases when LLMs involve, because at the end of the day they can introduce new codes that are not provided by the builders?And what certifications would be relevant on this? For example, the [security page of Webflow](https://webflow.com/security) has information about the product security (Webflow itself), with various certifications. There are also place where they say the websites built by their builder are secured, but I'm unable to see how they defend security threats (broken access control, injection, etc.) or follow secure coding (cross-site scripting, inline script, etc.).
- There are SaaS providers for building and hosting websites made with WYSIWYG and LLM-prompt [website builders](https://en.wikipedia.org/wiki/Website_builder), such as WordPress.com, Webflow, etc. I guess these services should be secure-by-default and secure-by-design, e.g. the builders should be guided to generate code to follow [secure coding in JavaScript](https://stackoverflow.blog/2025/10/15/secure-coding-in-javascript/), and the hosting providers should provide [automated vulnerability detection](https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools). However, I'm not sure if the generated code can effectively defend against [security threats](https://en.wikipedia.org/wiki/Application_security#Security_threats) or [likely attackers](https://wiki.owasp.org/index.php/Security_by_Design_Principles#About_attackers).
- In my understanding, most components are merely HTML snippets, so they are bullet-proof. Dynamic components like routing, login, payment or APIs to third-party services can be made secure-by-default and secure-by-design. So a toy made from secured lego bricks should be secured as well? I wonder if the security decreases when LLMs are involved, because at the end of the day they can introduce new code that is not provided by the builders?
- And what certifications would be relevant on this? For example, the [security page of Webflow](https://webflow.com/security) has information about the product security (Webflow itself), with various certifications. There are also places where they say the websites built by their builder are secured, but I'm unable to see how they defend security threats (broken access control, injection, etc.) or follow secure coding (cross-site scripting, inline script, etc.).
#1: Initial revision
by
Ooker
·
2026-05-28T09:53:12Z (4 months ago)
How do websites built by website builders defend security threats or follow secure coding?
There are SaaS providers for building and hosting website made with WYSIWYG and LLM-prompt [website builder](https://en.wikipedia.org/wiki/Website_builder), such as WordPress.com, Webflow, etc. I guess these services should be secure-by-default and secure-by-design, e.g. the builders should be guided to generated code to follow [secure coding in JavaScript](https://stackoverflow.blog/2025/10/15/secure-coding-in-javascript/), and the hostings should provide [automated vulnerability detection](https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools). However, I'm not sure if the generated code can effectively defend [security threats](https://en.wikipedia.org/wiki/Application_security#Security_threats) or [likely attacters](https://wiki.owasp.org/index.php/Security_by_Design_Principles#About_attackers). In my understanding, most components are merely HTML snippets, so they are bullet-proof. Dynamic components like routing, login, payment or APIs to third-party services can be made secure-by-default and secure-by-design. So a toy made from secured lego bricks should be secured as well? I wonder if the security decreases when LLMs involve, because at the end of the day they can introduce new codes that are not provided by the builders? And what certifications would be relevant on this? For example, the [security page of Webflow](https://webflow.com/security) has information about the product security (Webflow itself), with various certifications. There are also place where they say the websites built by their builder are secured, but I'm unable to see how they defend security threats (broken access control, injection, etc.) or follow secure coding (cross-site scripting, inline script, etc.).