Website Security: Who’s Actually Looking After Your Website?
Nobody gets excited about website security. We spend so much time discussing how websites look, how quickly we can build them and how much they cost, but security is the boring stuff nobody thinks about until something goes wrong. I think website security is going to become an increasingly important conversation as more businesses launch websites and applications without traditional development teams.
The PHP Scandal
Recently, I’ve had a few clients call me, worried about the PHP2Shell security scandal.
And I must admit, it felt pretty damn good to tell them: relax, you’re on Wix. This particular vulnerability isn’t something you need to deal with.
PHP is a programming language that powers a huge number of websites, including much of the WordPress ecosystem. Like any software, PHP occasionally has security vulnerabilities. Some are minor. Others can potentially allow attackers to interfere with a website or its underlying server.
When a serious vulnerability is discovered, affected systems need to be updated or patched, sometimes urgently.
Who knows there’s a problem? Who’s responsible for the update? Who checks that everything still works afterwards? And what happens if nobody does?
The ongoing cost of keeping a website secure
One of the biggest misconceptions about websites is that once they’re built and launched, the technical side is taken care of. Is understandable, you don’t buy a new car expecting to become a mechanic.
Websites are software, and software needs maintenance. Depending on how your website is built, that maintenance might include updating the content management system, installing security patches, checking plugins, monitoring server vulnerabilities and making sure those updates haven’t broken something else. Sometimes an update intended to fix a security issue can create a compatibility problem elsewhere.
With self-hosted platforms like WordPress, someone needs to take care of software updates, security patches, plugins and hosting. WordPress itself can be very secure, but outdated plugins and neglected updates are common sources of vulnerabilities. Unless you’re using a managed hosting service that handles much of this for you, the responsibility usually falls on your developer, maintenance provider or you.
Platforms like Shopify, Squarespace, Webflow and Wix work differently. They manage their own infrastructure, including core software updates, server maintenance and security patches. You don’t need to worry about updating the platform yourself.
How secured AI-Generated Websites?
AI can produce functional code for your website, that's fantastic, but what about security?
It can introduce vulnerabilities, use outdated dependencies or create functionality that doesn’t adequately protect sensitive information.
And because the person generating the website may have little or no programming experience, they might not recognise those problems.
The important distinction here is between using AI within an established managed platform and using AI to generate an independent application.
If you’re using AI to create a website within a platform that manages hosting, infrastructure and core security, those protections still apply. You are safe here.
If you’re generating custom code and deploying it independently, somebody needs to take responsibility for the entire technical environment. That includes reviewing the code, managing dependencies, protecting databases, configuring access permissions and keeping everything updated.
What makes Wix websites secure?
Let’s get slightly technical, but I promise to keep it painless.
1. Security updates are managed centrally.
Wix maintains its own platform infrastructure and deploys security fixes without requiring individual website owners to install updates. When a platform-level vulnerability needs attention, the response is managed centrally rather than relying on thousands of individual website owners to take action.
2. Websites are protected by managed infrastructure.
Wix operates its hosting environment and manages the technical systems that deliver websites to visitors. This includes protections against common network attacks, such as distributed denial-of-service attacks (DDoS), where attackers overwhelm a website with enormous amounts of traffic.
3. Data is encrypted in transit.
Wix websites support HTTPS with SSL/TLS certificates managed by the platform.
In simple terms, this helps protect information travelling between a visitor’s browser and the website. You know that little padlock in your browser? That’s part of what it’s telling you.
4. Security is monitored 24/7.
Wix uses continuous security monitoring, automated detection and dedicated security teams to identify and respond to threats. Rather than expecting individual designers or business owners to monitor server activity, much of that work happens at the platform level.
5. There are fewer maintenance dependencies.
One of the things I particularly appreciate is that many features are built directly into the Wix ecosystem: forms, ecommerce, bookings, content management and other functionality can be handled through integrated platform tools.
That reduces the need to assemble a website from numerous independently maintained plugins. Having a more integrated ecosystem simplifies ongoing maintenance considerably.
6. Access and permissions can be controlled.
Not everyone working on a website needs access to everything. Wix allows website owners to assign roles and permissions, helping limit what different collaborators can see and change.
Combined with account security measures such as two-factor authentication, this adds another important layer of protection.
If you’re collecting customer information, processing payments or connecting external services, you still have responsibilities around how that data is handled.
Wix takes care of a substantial part of the technical infrastructure. It doesn’t remove the need for common sense, but it does remove a significant amount of technical maintenance from the business owner’s shoulders. That’s exactly what Wix users pay for.
Which websites are Most vulnerable to security threats?
Some website setups carry significantly more security risks than others. Here are the ones I’d be particularly cautious about:
Outdated WordPress websites.
Especially self-hosted websites running old versions of WordPress, themes or plugins with known security vulnerabilities.
Websites with abandoned plugins. Third-party plugins that are no longer maintained or supported can leave security vulnerabilities unpatched.
Custom-coded websites without ongoing maintenance. Websites built from scratch that don’t have a developer or technical team responsible for security updates, monitoring and vulnerability fixes.
AI-generated websites without security reviews. AI can generate functional code that contains security flaws, outdated dependencies or poorly protected databases. Without someone reviewing and maintaining that code, vulnerabilities can go unnoticed.
Websites running outdated server software. Older versions of PHP, web servers and other backend technologies can expose websites to known vulnerabilities if security patches aren’t applied.
Websites with poorly secured third-party integrations. External applications, APIs and services can introduce vulnerabilities, particularly when they have excessive permissions or aren’t properly maintained.
Websites with weak access controls. Shared administrator accounts, reused passwords and missing two-factor authentication can make even technically secure websites vulnerable to account takeovers.
Security is one of the many other reasons I choose Wix
I’ve been building websites on Wix for 15 years. I have built more than 500 websites. Guess how much time I’ve spent updating PHP, patching servers or dealing with security plugins? Zero.
I chose a platform where that responsibility is handled centrally. And after all these years, I consider that one of its biggest advantages. All those invisible things that make a website reliable long after the excitement of launch has worn off.
I want to spend my time thinking about brand strategy, design, content, I don’t enjoy patching servers and I certainly don’t want my clients worrying about vulnerabilities they don’t understand and shouldn’t have to manage themselves. That’s one of the reasons I’ve stayed with Wix for so long.
