Last month an Auckland convenience store spent two hours watching strangers add products to its own website. A "pair of crusty socks". A "Princess Diana Commemorative Plate". National parks, apparently, to the highest bidder. Discount codes appeared too, one of which read pleasegodmakeitstop. By the time the site came down, some of what had been posted was a lot worse than silly.
Nobody broke in. There was no password cracked and no clever attack. The site had simply been left so that anybody who visited it could edit it. Someone noticed, and then everybody noticed.
We are not going to name the shop. Stuff did not, and the owner has had a bad enough week. What matters is that this is an ordinary mistake, it is easy to make right now, and it takes about ten minutes to check whether you have made it too.
Why this is happening more often
The site was built on a no-code AI platform — you describe what you want and it builds the app. These tools are genuinely good, and we use AI in our own work every day. That is not the problem.
The problem is that these platforms hand you a working, live application in minutes, and the permission settings are a separate thing you have to go and think about. A traditional web build has an obvious moment where somebody sets up logins and decides who can change what. When the site appears fully formed in an afternoon, that moment never arrives. The default is often open, and open is invisible — your site looks perfect to you, because you are the one who is allowed to edit it.
You only find out when somebody else tries.
The ten-minute check
Do this today, whoever built your site.
- Open your own site in a private window. Not your normal browser — a private or incognito window, so you are signed out. This is the single most useful thing on this list. Click around as a stranger would. If you can edit, add, delete or see anything you would not want a customer touching, stop and fix that now.
- Try your admin address while signed out. Visit /admin, /login, /dashboard or whatever yours is. You should be asked to log in. If a control panel loads without asking who you are, that is the same fault as the store's.
- Check who actually has an account. Look at the user list. Old staff, a previous web person, an agency you stopped using two years ago — remove anyone who should not be there. People rarely think to revoke access when a relationship ends.
- Turn on two-factor authentication. On the website, on the hosting, and on the email address that can reset both. Email is the master key to everything else, and it is usually the weakest link.
- Find out where your backups are, and when one was last taken. Not whether backups are "on" — actually look at the most recent one and check the date. The store's real problem was not the rude socks, it was having to take the whole site offline during business hours.
- Know who to call. Write down, now, who fixes it at 7pm on a Saturday. If the answer is "the guy who built it, if he answers", that is worth sorting before you need it.
If it has already happened to you
Order matters here.
- Close the hole before you clean up. Turn off public editing or take the site offline. Deleting the mess while the door is still open just gives someone an audience.
- Change the passwords, then the email password. Website, hosting, domain, and the email account that can reset all three.
- Restore from a backup from before it started, rather than deleting entries one by one. Faster, and you will not miss anything.
- Check what customers could see. If orders, names or addresses were exposed, that is a privacy matter, not just an embarrassing one. Under the Privacy Act you must notify the Office of the Privacy Commissioner and the people affected if a breach is likely to cause serious harm.
- Say something short and plain. One honest line on your social accounts beats silence. People are far more forgiving of a mistake owned early than one they discover themselves.
Should you avoid AI website builders?
No. We build with AI tools and they are not going away. But understand what you are buying: a platform like that gives you an application, not a configured, secured, maintained website. Those are different things, and the gap between them is where this story happened.
If you use one, treat the permissions, the logins, the backups and the updates as your job — or as somebody's job, explicitly. The failure mode is not that the tool is bad. It is that nobody was ever assigned the part the tool does not do.
If you would rather it was somebody's job, that is a large part of what we do. We will happily run the ten-minute check over your site and tell you what we find, whether or not you ever become a client. It is a fast look and it tends to be reassuring.
Related reading: what AI actually does well for a NZ small business, and what a website should cost in Auckland.
Frequently asked questions
How did the Auckland store's website get edited by the public?
No one hacked it. The site was built on a no-code AI platform and its editing permissions had been left open, so any visitor could add or change products and discount codes. It stayed that way for at least two hours before the site was taken offline. The fault was a configuration setting, not a break-in.
How do I check if my own website can be edited by the public?
Open your site in a private or incognito window so you are signed out, then try to change something. Also try visiting /admin, /login or /dashboard while signed out — you should always be asked to log in. If anything is editable or any control panel opens without asking who you are, fix that before you do anything else.
Are AI and no-code website builders safe for a business?
They can be, but they hand you a live application in minutes and leave the permissions, logins, backups and updates as a separate job that is easy to never do. The tools are not the risk; the unassigned work around them is. If you use one, make sure someone is explicitly responsible for access control and backups.
What should I do first if my website has been defaced or edited by strangers?
Close the hole before you clean up — disable public editing or take the site offline, otherwise you are deleting entries while someone keeps adding them. Then change the website, hosting and domain passwords plus the email account that can reset them, restore from a backup taken before it started, and check whether any customer data was exposed.
Do I have to tell anyone if customer data was exposed?
In New Zealand, yes, if the breach is likely to cause serious harm. The Privacy Act 2020 requires you to notify the Office of the Privacy Commissioner and the affected people as soon as practicable. If you are unsure whether it meets that bar, the Privacy Commissioner's office has an online tool to help you decide, and it is better to ask than to assume.
How often should a small business website be checked?
The signed-out check is worth doing any time something changes — a new plugin, a new staff member, a new person working on the site. Beyond that, a quarterly look at who has accounts, whether two-factor is on, and when the last backup actually ran covers most of the risk for a small business.
Source: Ridiculous deals as store leaves website open for the public to edit — Stuff, 16 September 2026.