Website Security for
Vibe-Coded Sites

AI is a brilliant tool. It's enabling people to do things they'd only ever dreamed of. However, it doesn't always write code that's secure and has some habits that are going to leave applications exposed. We solve that issue.

Get started
Human oversight for AI-built sites

Fast to build.
≠ Safe to run.

Vibe-coded and AI-assisted sites ship fast. What ships with them isn't always as safe as it looks. We audit and validate what's actually running, so you can be confident it's not leaking data.

Validation Issues

AI is a fantastic tool but routinely exposes endpoints, credentials, misses auth checks, favors front-end technologies and will confidently tell you the sky is green. We triple-check its output.

Third-Party Dependencies

Modern coding stacks use a lot of third-party dependencies. Every single one of them might cause a leak or maintenance problems down the line. Best to know now what the risks are.

Direct, Human Recommendations

There are a lot of AI automated tools out there for security scanning vibe-coded apps. It's great it's evolving, but are you willing to bet your business on it? Automated tools are far from perfect. Humans are also far from perfect, so best to triple check.

Caught

Real problems, found on real sites
we monitored and audited.

Found

A manual audit of a recruitment company's website uncovered directory listing enabled on the WordPress uploads folder. Anyone who went to domainname.com/wp-content/uploads could browse and download every file inside it, no login required. Sitting there in plain sight: roughly four years of job applicants' CVs, complete with names, contact details, and work histories, quietly exposed the entire time and no-one at the company was aware it was happening.

SecurityRecruitment company website, Audit-only client— Manual audit (Complete Audit)
Fixed

The client disabled directory listing immediately after being notified, and a follow-up check confirmed the CVs were no longer publicly reachable. To close the underlying cause rather than just the symptom, the recommended fix was to move the uploads folder outside the public web root entirely and redirect the site's Gravity Forms submissions to a non-public storage location. This prevented the same exposure from quietly reopening down the line.

SecurityRecruitment company website, Audit-only client— Manual audit (Complete Audit)
Found

A weak admin password gave an attacker a way in. They used it to launch a DDoS attack, flooding the server with traffic in an attempt to take the site down entirely (a tactic more often aimed at large government and brand sites, here landing on a much smaller target). On top of the flood of traffic, they quietly added malicious code to fraudulently verify the site through Google Search Console, opening the door to further abuse of the site's search presence.

SecuritySmall business site, WebEnsure Small tier— Flagged by server load monitoring.
Fixed

Cloudflare's DDoS protection was already limiting some of the traffic, but we tightened the rules further and had the WAF block the attacker outright. We forced 2FA on every admin account so a guessed password alone could never get this far again, removed the malicious Search Console code, and swept the rest of the site for anything else they might have left behind. Confirmed clean just in time for Christmas dinner.

SecuritySmall business site, WebEnsure Small tier— Flagged by server load monitoring.
Found

Many SEO plugins generate an author-sitemap.xml file by default, sitting at yourdomain.com/author-sitemap.xml. WordPress itself already exposes a user's login via the author archive link, but the plugin's sitemap turns that into a clean, indexable list, no digging required. Instead of showing the friendly display name set on the account, it lists the actual login username. For a bot running automated login attempts, that's half the puzzle solved before it's even started. This issue has been seen everywhere from landing pages, to enterprise sites. It's a default behaviour sitting quietly on a huge share of WordPress sites running a popular SEO plugin, including ones that have never been touched by a developer who'd think to look for it.

SecurityAll WebEnsure customers, every platform tier — Found everywhere. We automatically check for it.
Fixed

Every site under WebEnsure management gets this sitemap removed, unless there is a real need for it. In which case we fix the setup. The real login is removed from public view, so the author sitemap stops handing attackers a head start on guessing logins.

SecurityAll WebEnsure customers, every platform tier — Found everywhere. We automatically check for it.
Found

A WooCommerce store built on a ready-made theme, previously migrated from Magento, kept corrupting its own product data — prices, images, and descriptions reset themselves every time a new product was added. Deactivating plugins and switching themes made no difference; the fault sat in the database itself, likely left over from the original migration.

LongevitySmall ecommerce business, WooCommerce store on a ready-made theme— Reported by the customer after repeated data loss.
Fixed

Rather than patch a database that couldn't be trusted, we rebuilt the store from a clean install, importing products fresh and carrying over WooCommerce, theme, and permalink settings carefully enough that search rankings didn't take a hit. The rebuild took longer than a repair would have, but it's the only way the site was going to hold up long-term.

LongevitySmall ecommerce business, WooCommerce store on a ready-made theme— Reported by the customer after repeated data loss.
Found

A small site kept reinfecting itself with spam links hidden inside its content which was invisible to logged-in users, appearing only at random for visitors, specifically to dodge both admins and malware scanners. Core files, plugins, and the WAF were all already up to date, which ruled out the obvious causes.

SecuritySmall business site, self-hosted with no DNS-level protection— Found during routine cleanup, confirmed by monitoring and logging over the following days.
Fixed

We restored a clean backup, fully replaced core files, and ran a file-integrity scan against the official WordPress repository to catch anything hidden elsewhere. A custom detection plugin was added to catch and hide any reappearance immediately, and the WAF rules were tightened further. It never came back.

SecuritySmall business site, self-hosted with no DNS-level protection— Found during routine cleanup, confirmed by monitoring and logging over the following days.
Found

A large company asked us to look into security issues across several aging WordPress sites. Beyond heavy bot traffic and spam, the sites were slow, hard to maintain, and running on a five-year-old theme with dependencies nobody could safely update without breaking the site.

AuditingEnterprise client, multiple legacy WordPress sites— Client-initiated audit request.
Fixed

We audited each site, identified which outdated plugins and theme dependencies were actually blocking safe updates, and worked with the client's junior development team to bring their process up to a maintainable standard: code review, staging tests, and a clear decision-maker for anything risky. Recommended a cadence of frequent, smaller audits over the infrequent, high-risk approach that had let the problems build up in the first place.

AuditingEnterprise client, multiple legacy WordPress sites— Client-initiated audit request.
Pricing

Request a Quote

Pricing is based on audit scope and complexity.

  • A complete 10+ page audit report
  • Referenced against ISO 19011:2026
  • Time estimates on every finding
  • We'll tell you the good stuff too!
  • Available in English or Finnish

Tell us about your app, what it does, what it's built with, and anything you're already concerned about. We'll confirm availability and get you booked in.

We'll contact you here. See our Privacy Policy.

Why WebEnsure

Human where it matters.
Automated where it makes sense.

Automated tools are great at catching predictable issues, but not so great at judgement calls. We validate everything and act before it breaks anything.

Transparency

Each month our customers are well informed about what's been happening on their site. We tell you exactly what the bots have been up to, what we've been up to and what we recommend next.

Longevity

We get to know your site better over time. The longer we work together, the more effectively we protect and improve your site. Your site gets better with age.

AI tools, human judgement

We use AI extensively, but we validate everything. The market is being flooded with "cheap" automated-only solutions nobody checks. We're the human oversight layer that makes the output actually trustworthy.

Platform-agnostic

WordPress, Laravel, Drupal, Lovable.dev, HTML, or something we haven't heard of yet; we manage it. WebEnsure is built around your site, not around a platform we resell.

Problems don't reach you

We are all about proactive security. Issues are best caught and resolved before you even know they exist. Proactive, not reactive, is the only model that gives you peace of mind.

Fully-managed, invisibly

Security patches, CMS updates, backup verification, uptime monitoring, performance tracking. All the nerdy stuff. Handled for you. Your website just works.

Your website deserves someone obsessed with it.

Website management as it should be.

Get startedContact us