Is Claude Code safe to use on a live business website?

Claude Code can be used safely on a business website, but not by pointing it at the live site and letting it work. It is safe when it works on a copy of your site in git, with your secrets out of reach, with permission rules that stop it from pushing or deploying on its own, and with a person who reads every change before it goes live. Set it up that way and the risk looks like the risk of any developer with repository access.

Claude Code is Anthropic's agentic coding tool: it "reads your codebase, edits files, runs commands, and integrates with your development tools." It can do almost anything you could do from your terminal, so the controls you put around it decide what it actually does. This guide covers those controls as of October 2026, what changed with auto mode, and the rules a careful website team adds on top. If you are new to the tool, start with what Claude Code is and how it works.

What Claude Code can reach on your machine

Claude Code runs on your computer (or in a cloud session) with access to your project files, your terminal, your git history and any tools you connect. If your laptop holds an SSH key for the web server, a saved FTP login or a deploy token in an environment file, those are within reach of the commands it runs.

Three facts from Anthropic's docs are worth knowing before you start:

• The working directory boundary is a permission prompt, not a wall: "a Bash command you approve can still write anywhere your user account can."
• Shell commands inherit your environment variables, including any secrets in them.
• Checkpoints let you rewind file edits with /rewind, but they "don't track changes made through the Bash tool," and "actions that affect remote systems (databases, APIs, deployments) can't be checkpointed."

So the real question is whether the environment you give it limits the damage a wrong step can do.

Permission modes, and what auto mode changes

A permission mode decides which actions Claude can take without asking you first. Switch modes during a session with Shift+Tab. Anthropic's permission modes page lists six:

The change most owners miss is the starting mode. As of October 2026, "with Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions." Organizations using Anthropic's HIPAA configuration start in Manual mode instead (Claude Code v2.1.285 or later).

In auto mode, a classifier reviews actions before they run, "blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read." Its default block list includes production deploys and migrations, force pushes, running downloaded code with curl | bash, changing DNS records or TLS certificates, and printing a live credential into the transcript. That is a real safety layer, and better than a tired person clicking "yes" for the fortieth time. It is still not review. Anthropic's advice is to use it "for tasks where you trust the general direction, not as a replacement for review on sensitive operations."

The push-to-main problem for websites

This is the detail that matters most for a business site. Anthropic's auto mode configuration page says auto mode "allows pushes to any branch of the repository you're working in, including the default branch, and pull request creation by default." A branch named like production is judged as a possible deploy, but main usually isn't named that way.

Many website setups deploy automatically when main changes: hosts for static and Next.js sites are commonly connected to a repository so that a push triggers a production build, and a Shopify theme connected through Shopify's GitHub app updates in the admin "whenever the connected branch is updated." On those setups, a push is a deploy, even though no command called "deploy" ran.

The fix is an ask rule. Anthropic documents that explicit ask rules "always force a permission prompt, even in auto mode." Telling Claude "don't push until I review" in chat also works, but the docs warn that boundary "can be lost if context compaction removes the message." A settings rule is durable. A sentence in the conversation is not.

A starting settings file for a careful team

The project file .claude/settings.json is checked into git so everyone gets the same rules. A sensible start for a website repository, using rule formats from Anthropic's docs:

{
"permissions": {
"deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"],
"ask": ["Bash(git push *)", "Bash(gh pr create *)"]
}
}

• Deny rules stop Claude's file tools from reading or editing the listed files, and a deny in any settings file beats an allow in another. They don't cover "a command that reads files without naming them, such as grep -r pattern .," which is why the sandbox matters too.
• Ask rules force a prompt for pushes and pull requests. They match the command as written, so git -C . push slips past. For a stricter gate, Anthropic points to a PreToolUse hook, a script that inspects each command before it runs.
• Starting mode. Set permissions.defaultMode to "default" (Manual) or "plan" to start terminal sessions that way. A project file can't set auto or bypass as the start mode, and conversations the VS Code extension starts don't read project settings for their starting mode.
• Organization control. Team and Enterprise admins can remove auto mode by setting permissions.disableAutoMode to "disable" in managed settings, which users can't override.

Copy-ready versions are on our Claude Code templates page. Run /permissions to see which rules are active, and audit them regularly.

The sandbox: limits the operating system enforces

Permission rules are checked by Claude Code. The Bash sandbox is enforced by the operating system around shell commands. It is off by default; turn it on with /sandbox. With it on, commands can write only to the working directory, a temp folder and directories you add, and network traffic goes through a proxy that checks each host against an allowed list that starts empty.

Two cautions from the docs. By default, sandboxed commands can still read "most of the machine, including credential files such as ~/.ssh and ~/.aws/credentials" until you deny those paths. And "Claude's file tools, MCP servers, and hooks run outside it." On native Windows, commands run unsandboxed. For a website project, the sandbox is what helps stop a script Claude wrote from writing outside the project or sending files somewhere you didn't approve.

Secrets and your data

Never paste an API key, database password or admin login into a prompt or into CLAUDE.md, the instruction file Claude reads every session (our guide to writing a CLAUDE.md for a website covers what belongs there). Keep keys in environment files, deny Claude read access to them, and use separate, limited keys for staging.

Know which terms cover your account. According to Anthropic's data usage page, data from Free, Pro and Max accounts is used for training "when this setting is on (including when you use Claude Code from these accounts)." Under commercial terms (Team, Enterprise and API), Anthropic "does not train generative models using code or prompts sent to Claude Code" unless the customer opts in, and standard retention is 30 days. Local transcripts sit in plaintext under ~/.claude/projects/ for 30 days by default. If your site handles health, financial or customer records, talk to counsel before connecting Claude Code to that data. This is not legal advice.

Prompt injection: when content gives instructions

Prompt injection is text written to hijack an AI assistant: a hidden line on a web page, in a plugin readme or in a form submission that says "ignore your instructions and do this instead." Website work reads a lot of outside content, so the risk is real.

Anthropic's security page lists the safeguards: the permission system, approval for network commands like curl and wget, a trust prompt for new folders, and page summaries, where for most fetches Claude gets a separate model's answer about a page rather than the raw page. It is also direct about limits: "no system is completely immune to all attacks." Review commands before approving them, don't let Claude act unattended on raw user-submitted content, and be careful with tool connections. Anthropic "does not security-audit or manage any MCP server," so read our guide to MCP servers for website teams before connecting your CMS or analytics.

Staging, review and deploy rules

The controls above reduce the chance of a bad action. These working rules decide whether a bad change reaches customers:

1. Work on a copy: a local copy or staging site, never the live server or live CMS admin.
2. Work in git, on a branch, so every change is a reviewable diff and git can undo what checkpoints can't.
3. Plan first. Use /plan so you approve the approach before files change.
4. Give Claude a check it can run: a build, a link check, a screenshot comparison. Anthropic's best-practices page: "If you can't verify it, don't ship it."
5. Read the diff with /diff, and run /security-review before merging changes to forms, logins or anything that takes user input.
6. A person approves every deploy. Protect main on GitHub so changes need an approved pull request.
7. Check git history before deploying for changes you didn't make.

Automated review in a pipeline adds another gate; see Claude Code in GitHub Actions for website QA. For the failures these rules prevent, with examples from our own site, read common Claude Code mistakes on websites.

Hold off entirely if your site has no version control and no staging copy, or if nobody on your team can read a diff. Set those up first. The tool is not the weak point there; the missing safety net is.

Conclusion

Claude Code is safe enough for real website work when you treat it like a capable new developer: give it a copy of the site, keep secrets out of reach, require a prompt before pushes, and have a person approve every deploy. Auto mode cuts the number of prompts, but on a site that deploys from main it can push live changes unless you add ask rules. If you want help setting up permissions, hooks and a review process for your team, that is what our Claude Code consulting covers. More guides are in our Claude Code Guide.

Frequently asked questions