Squarespace, WordPress, custom or AI-built? Where each one is weakest

Part 2 of 3 in our series on website security for business owners.

Every way of building a website has weak spots, and they sit in different places depending on what you use.

In part 1, I covered the five most common ways small business websites get broken into. This part shows where to look based on how your site was built.

Website builders (Squarespace, Wix, Shopify)

The builder handles the software for you. Their engineers patch it for every customer at once, so you can't fall behind on updates. That removes the top cause of breaches from part 1.

Your weak spots are somewhere else:

• Your login. One email and password protects your whole site and your customer list. Turn on two-step login in your account settings. It takes two minutes.
• Your domain. The 2024 Squarespace hijackings from part 1 hit accounts with no two-step login. Make sure the account that holds your domain has it on too.
• Add-ons. Shopify apps, Wix apps and pasted code snippets all get access to your site. Some can see customer data. Remove any you don't use.
• Old accounts. Former employees or an old agency may still be able to log in. Remove anyone who doesn't need access.

For most owners, this is the easiest option to keep safe. Most of the risk comes down to protecting your account.

WordPress

WordPress itself is in good shape. The risk comes from the plugins and themes people add to it.

Patchstack tracks WordPress security holes. It counted 11,334 new ones in 2025, up 42% from 2024. Plugins had 91% of them and themes had 9%. WordPress itself had only 6, and all were low priority.

Two more findings from that report matter for owners:

• Many holes had no fix yet. 46% had no update from the developer when they went public. Auto-updates can't install a fix that doesn't exist.
• Your host's firewall won't catch most attacks. Patchstack tested common hosting defenses against attacks on known holes. They blocked only 12% of them.

What to do:

• Delete every plugin you don't use. Deactivating one still leaves the code on your server.
• Avoid plugins that haven't been updated in the past year.
• Turn on automatic updates.
• Have someone check the site regularly. WordPress needs more ongoing care than the other options.

Custom-coded sites

This is how we build sites, so I'll lay out the trade-offs. A custom site usually gives attackers less to work with. Most have no public login page like WordPress's /wp-admin, so bots have nothing to guess passwords on.

Custom sites still need updates. They're built on frameworks and hundreds of open-source code packages, and those get security holes too.

In March 2025, researchers found a serious hole in Next.js, a popular tool for building websites. It let attackers skip login checks. Sites hosted on Vercel were safe because of how Vercel runs them. Some sites running Next.js on their own servers were exposed until they updated.

What to do:

• Make sure someone is in charge of updates after launch.
• Ask your developer where your secret keys are stored. These are the passwords your site uses to talk to services like your payment processor. They belong in your host's settings and never in the code itself.

Sites built with AI tools

This is the newest option, and it worries me the most. Tools like Lovable and Bolt can build a working app from a text prompt. A working app can still leak data, and these tools rarely warn you about it.

Here's a real example. In 2025, a researcher named Matt Palmer scanned 1,645 apps from Lovable's public showcase. About 1 in 10 let anyone on the internet read their database. Some also let strangers change it. The leaked data included names, emails, phone numbers and payment records. On one site, the researchers marked their own account as "paid" without paying.

The cause was a database setting called row-level security. It controls who can see which records. In these apps, it was missing or set up wrong. Lovable's position is that each customer has to protect their own app's data.

So if you build with an AI tool, you're the developer. The tool won't flag problems you don't know to ask about.

What to do:

• If your site only shows information and collects nothing from visitors, your risk is low.
• If it stores customer data, have someone who knows security review it before real customers use it.

Quick comparison

• Website builders: least upkeep. The main risk is your account login.
• WordPress: most upkeep. The main risk is plugins.
• Custom-coded: fewest openings for attackers. The main risk is nobody updating it after launch.
• AI-built: fastest to make. The main risk is data leaks you can't see.

Part 3 is a checklist that protects you on any platform. You can get through most of it in an afternoon.

If you want a second opinion on your setup, reach out through our contact page.