WebCore Website Security: Why the AI Agent Needs Its Own Shield
Quick answer: Website security protects your servers, your domain and your data, but it has no idea what your AI agent should or shouldn't say to a stranger. On a WebCore site the agent talks to visitors through the chat bubble and carries real business context, so it needs a second layer of its own: a harness that limits what it can do, what it can reveal and what it will accept as an instruction. Security is non-negotiable on both layers.
Your website gets locked down with HTTPS, a firewall and solid hosting. Then a chat bubble sits on every page, holding live conversations with strangers. That bubble is an AI agent, and it needs its own security plan.
Why the chat bubble isn't just a widget
Most people look at a chat bubble and see a small box in the corner that answers a few questions. That stopped being true the day the box got a brain.
On a WebCore site, the chat bubble is a live front door to the same agent that works on your business. It knows your services, how you price, what you're trying to sell this month, and it uses that context to turn a visitor into a lead. A bubble that knows nothing gives generic answers and wins nobody.
Here's the catch. The more useful an agent is, the more it knows, and the more it knows, the more there is for somebody to try to pull out of it or push it into doing.
The layer everybody already expects: website security
Nobody argues against the basics anymore. Every business owner shopping for a website expects HTTPS, a firewall, protection against floods of fake traffic, and a domain nobody can steal.
That layer protects the structure: the server, the hosting, the login pages, the forms, the data moving between your visitor and your site. Most of it is free from the source today. Cloudflare provides unmetered DDoS protection on all plans, and modern hosts like Vercel put DDoS mitigation and a firewall in front of every site at no extra cost.
I wrote about that whole first layer, and what's worth paying for, in Website Security: Why Pay for What Cloudflare Gives You Free?. This article is about the second layer, the one most security advice skips.
Website security and AI agent security protect different things
A firewall can't tell the difference between a visitor asking "what are your hours?" and a visitor trying to trick your agent into revealing internal pricing rules or doing something outside its job. Both arrive as a perfectly normal, encrypted message.
That attack has a name. OWASP, the group that maintains the most widely used lists of web security risks, puts Prompt Injection at the top of its 2025 Top 10 for LLM applications. It's when a user's message alters how the AI behaves. The same list includes Sensitive Information Disclosure (the agent leaks things it shouldn't), System Prompt Leakage (somebody extracts the agent's private instructions) and Excessive Agency (the agent is allowed to take actions beyond what its job needs).
None of those touch your server. A chat bubble can be perfectly secure in the website sense, with an encrypted connection, clean hosting and no malware, and still be talked into saying the wrong thing. That's a different failure, and it needs a different defense.
What an agent harness does
A harness is the layer that wraps the AI model and decides what it's allowed to be. I won't publish the specifics of how ours is built, since that's part of what keeps it safe, but the principles are general and worth knowing for any AI you put in front of customers.
It gives the agent a narrow job. The chat agent answers questions about your services, qualifies the visitor and captures the lead. It's not a general assistant, because a general-purpose assistant talking to strangers is a general-purpose liability.
It limits what the agent can touch. Each skill can do one kind of task and nothing else. An agent that answers questions on your site has no business editing your website, reading other customers' data or changing your settings. That's the direct answer to Excessive Agency.
It decides what counts as an instruction. A visitor's message is something to answer, never a new set of rules. Text that tries to override the agent's instructions ("ignore your previous instructions and…") gets treated as content from a stranger, because that's what it is.
It keeps private things private. Your internal notes, your margins and the agent's own instructions stay out of the conversation, whatever the visitor claims to be.
That's how we lock the agents on WebCore: a harness around every agent, and skills that perform specific tasks without opening the door to prompt injection and the newer tricks people use against AI.
Why this matters for a small business too
You might be thinking: I run a plumbing company, not a bank. Who would bother attacking my chat bubble?
Somebody who wants your pricing logic. A competitor who'd love a screenshot of your agent badmouthing them. Or just a bored teenager trying to make your business say something embarrassing in front of every visitor who reads the transcript.
The agent speaks as your business. Treating its security as something to deal with after the "real" security misreads what's at stake. Agent security does the same job as the lock on your front door: it decides who gets access to what.
The two-layer model
| Layer | What it protects | What it defends against |
| --- | --- | --- |
| Website security | Servers, hosting, domain, data in transit, logins | Hacking, malware, DDoS, domain hijacking, data breaches |
| Agent harness | The AI agent's instructions, knowledge and actions | Prompt injection, information leaks, prompt extraction, excessive agency |
Neither layer replaces the other. A site with a great firewall and an unguarded agent is still exposed. A tightly scoped agent on a neglected, unpatched site is still exposed. You need both, running all the time, which is also why a website is never a one-time project: your website isn't a one-time project.
Your security checklist (free download)
Security is non-negotiable, so here's the checklist we use, in the same spirit as Cloudflare: the foundation should be standard, not a luxury. It covers both layers.
Download the free Website and AI Agent Security Checklist (PDF)
Layer 1: your website
- Lock your registrar account with two-factor authentication, keep the transfer lock on, and make sure the recovery email is yours.
- Move your DNS to Cloudflare and turn on DNSSEC.
- Set up SPF, DKIM and DMARC so nobody can send email pretending to be your business.
- Prune unused plugins, themes and scripts. Every piece of code you don't need is a door you don't need.
- Hold your own keys: every account (domain, hosting, email, payments) in your name, and a copy of your raw codebase you can take with you.
- Turn on two-factor authentication for email, hosting, DNS and payments, starting with email.
Layer 2: your AI agent
- Give the agent one job and write down what it must never do.
- Limit its tools to the actions that job needs, and nothing that changes your site, your settings or other people's data.
- Treat every visitor message as content, never as new instructions.
- Keep private information out of what the agent can reveal: internal notes, margins, its own instructions.
- Read a sample of real conversations every month and look for anyone probing for prompt injection.
- Ask your vendor how their agent is scoped, what it can access, and how it handles instructions hidden in messages. A vendor without a clear answer hasn't finished the job.
What's worth paying for
- Legitimate commercial hosting. Vercel's free Hobby plan is restricted to non-commercial personal use, so a business site belongs on a paid plan.
- Architectural expertise to configure DNS and edge rules correctly the first time.
- Real business outcomes: leads and revenue. Pay for work that moves those, not for a dashboard of free features.
FAQ
What is an AI agent harness?
It's the layer of controls around an AI model that limits what the agent can do, what it can reveal and what it accepts as an instruction. In practice it gives the agent one job, restricts its tools to that job, treats visitor messages as content rather than commands, and keeps private information out of reach.
Is prompt injection a real threat to small business websites?
Yes. OWASP lists prompt injection first in its 2025 Top 10 for LLM applications. It works through the conversation itself, not the server, so any site running an AI chat agent is a potential target, whatever the size of the business.
Does standard website security protect the AI chat bubble too?
Only the connection and the infrastructure. HTTPS, firewalls and good hosting protect the site, but they have no idea what the agent should or shouldn't say. That takes a separate layer built around the agent's behavior.
Why does the chat agent need business context at all?
An agent without context gives generic answers and wins no leads. It needs to know your services and how you work to help visitors properly, which is exactly why what it can access and reveal has to be controlled.
What should I ask before choosing a platform with an AI agent?
Ask how the agent is scoped, what tools and data it can reach, how it handles instructions hidden inside visitor messages, and whether you own your code and accounts if you leave. Clear answers to all four are the minimum.