What the platform handles
- Server and platform updates.
- HTTPS certificates.
- Protection against large traffic floods.
- Backups of the platform itself.
What’s still your job
- Your account login. Two-step sign-in, and each editor with their own login.
- Your domain, especially if it’s registered somewhere else.
- Your email records: SPF, DKIM and DMARC.
- Your forms: what they collect and where entries go.
- Third-party apps and code you add, which the platform doesn’t vet the way it does its own.
- Your content: an old page, a leftover test page, someone else’s name in the settings.
Limits worth knowing
On hosted builders you usually can’t set your own security headers, add a strict Content-Security-Policy, or control exactly how pages are served. That’s why our free website check often shows missing headers on Wix and Squarespace sites. It isn’t a crisis, but it’s a limit you can’t fix without leaving the platform.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.