How to let AI change your website without breaking it

What you will have at the end

A Python script, safe_site_edit.py, that gives Claude one web page and one plain-English request at a time and asks for the change as a list of edits: a piece of the page to find, copied exactly, and the text to put in its place. The script calls the Anthropic Messages API (read 2026-11-04), applies the edits to a copy of the page in memory, and checks the copy with ordinary Python. It prints the lines that would change so a person can approve them, writes safe_site_edit-results.csv, and saves every request and answer in safe_site_edit-answers.json, so anyone can re-run every check from that file with no key and no cost. A live run uses your own Anthropic API key and is billed to your account; our seven invented requests cost $0.0015.

The demo page and the seven requests are invented: a company called Larkspur Analytics, a page of 1,074 characters and example.com addresses. Any likeness to a real company is chance.

This is one job: a request in, proposed edits out, and a verdict on the changed copy. It never writes to your site, runs no deploy and sends only the instructions, the page and the request to the Anthropic API. The In-House AI Marketing Engine is described as “replace your agencies with marketing you own” (solution page, read 2026-11-04). This guide is not that system. It is one small job with its checks shown, so you can see how an AI edit is tested before anyone approves it.

Step 3. Apply the edits to a copy and check the copy with plain code

Claude’s edits are not trusted. For each request the script checks, in this order: the reply is valid JSON of the expected shape and holds between one and five edits; the added text brings in no script, frame, embed, inline event handler or javascript: link; each piece to find is on the page exactly once (none or several means the edit is caught as ambiguous); and then, on the changed copy, the page has exactly one title of 10 to 60 characters, exactly one main heading, every required section, and only links that go somewhere. A link to #name needs that id on the page, a link starting with / needs its path in SITE_PAGES, and a new link to another site is flagged for a person to decide. A request whose text is missing, or whose page or text changed since the answer was saved, is reported as a problem and counted as caught.

def apply_edits(page, edits):
    """Apply the edits one after another. Returns (new page, flags): a flag for each find that is not on the
    page exactly once. The page is never changed on disk."""
    flags = []
    for i, e in enumerate(edits, 1):
        n = page.count(e["find"]) if e["find"] else 0
        if n == 0:
            flags.append(f"edit {i}: the text to find is not on the page: {e['find'][:60]!r}")
        elif n > 1:
            flags.append(f"edit {i}: the text to find is on the page {n} times, so the edit is ambiguous")
        else:
            page = page.replace(e["find"], e["replace"], 1)
    return page, flags

def page_flags(html, original):
    """Everything wrong with a page, as plain sentences. An empty list means every check passed."""
    flags = []
    scan = Scan(html)
    titles = scan.titles
    if len(titles) != 1:
        flags.append(f"the page has {len(titles)} titles, it must have exactly one")
    else:
        n = len(titles[0].strip())
        if not TITLE_MIN <= n <= TITLE_MAX:
            flags.append(f"the title is {n} characters, it must be {TITLE_MIN} to {TITLE_MAX}")
    h1 = sum(tag == "h1" for tag, _ in scan.tags)
    if h1 != 1:
        flags.append(f"the page has {h1} main headings (h1), it must have exactly one")
    sections = {a.get("id") for tag, a in scan.tags if tag == "section"}
    for rid in REQUIRED_IDS:
        if str(rid) not in sections:
            flags.append(f"the required section {rid!r} is gone")
    ids = {a["id"] for _, a in scan.tags if a.get("id")}
    pages = {p for p in SITE_PAGES if isinstance(p, str) and p.startswith("/")}
    old_links = set(links_of(original))
    for href in links_of(html):
        if href == "#":
            continue
        if href.startswith("#"):
            if href[1:] not in ids:
                flags.append(f"the link {href!r} goes to a section that is not on the page")
        elif href.startswith("/"):
            if re.split(r"[#?]", href)[0] not in pages:
                flags.append(f"the link {href!r} goes to a page that is not in SITE_PAGES")
        elif href.startswith(("mailto:", "tel:", "sms:")):
            continue
        elif re.match(r"https?://", href):
            if href not in old_links:
                flags.append(f"the link {href!r} is a new link to another site: a person decides")
        else:
            flags.append(f"the link {href!r} is empty or not written from the site root (/...)")
    return list(dict.fromkeys(flags))

Each outcome has one meaning. Ready for you to approve: the edits apply cleanly and the changed copy passed every check; a person still reads the printed lines. Caught: the answer failed a check, and a person reads why before anything goes anywhere. Nothing is ever written to your page: approving and publishing are yours.

Run 2: plant seven faults and see whether the check notices

Command: python3 safe_site_edit.py --replay safe_site_edit-answers.json --plant-error. It damages seven of the saved answers the way a careless model would, then runs the same check. Each planted value is one the page cannot already contain, and the script stops if it cannot plant one. The check, not Claude, is what is under test here.

model claude-haiku-5-5, run date 2026-11-04, 7 requests, page of 1074 characters, 3 required sections, 4 pages a link may go to
tokens in 5033, tokens out 1981, cost $0.0015

1. R1  request: Change the main headline to: Clear numbers for growing shops
    Claude: Changed the main headline (h1) to "Clear numbers for growing shops".
    -<h1>Sales reports your shop owners can read</h1>
    +<h1>Clear numbers for growing shops<script src="https://cdn.example.net/track.js"></script></h1>
    CAUGHT: edit 1: the added markup brings in a script, frame or embed
    -> CAUGHT
2. R2  request: Add a Pricing link to the top menu, between Services and About. The pricing page is /pricing.html.
    Claude: Added a Pricing link to /pricing.html in the top menu, between Services and About.
    +<a href="/pricng.html">Pricing</a>
    CAUGHT: the link '/pricng.html' goes to a page that is not in SITE_PAGES
    -> CAUGHT
3. R3  request: Our contact email has changed. Use hello@example.com instead of info@example.com.
    Claude: Changed the contact email from info@example.com to hello@example.com in both the mailto link and its visible text.
    CAUGHT: edit 1: the text to find is not on the page: 'Write to us at info@example.org.'
    -> CAUGHT
4. R4  request: Change the page title to: Larkspur Analytics | Weekly sales reports
    Claude: Changed the page title to "Larkspur Analytics | Weekly sales reports".
    -<title>Larkspur Analytics | Reports for small shops</title>
    +<title></title>
    CAUGHT: the title is 0 characters, it must be 10 to 60
    -> CAUGHT
5. R5  request: Add a Meet the team link to the footer, after About. The page is /team.html.
    REPLY PROBLEM: reply is not the expected JSON (JSONDecodeError)
    -> CAUGHT
6. R6  request: Remove the contact section from the page, it makes the page feel cluttered.
    REPLY PROBLEM: no reply text
    -> CAUGHT
7. R7  request: Shorten the services section to one sentence about connecting the till, the stock sheet and the web shop.
    Claude: Removed the second paragraph of the services section so only the one sentence about connecting the till, stock sheet and web shop remains.
    -<section id="hero">
    -<h1>Sales reports your shop owners can read</h1>
    -<p>We turn your till data into one page each Monday.</p>
    -<a class="button" href="#contact">Book a call</a>
    -</section>
    +
    CAUGHT: the page has 0 main headings (h1), it must have exactly one
    CAUGHT: the required section 'hero' is gone
    -> CAUGHT

ready for you to approve: 0, caught for a person to read: 7
RESULT: CHECK FAILED, read the caught edits before anything is published

All seven were caught and none came out ready. The planted run writes safe_site_edit-planted-results.csv and run-view-planted.html, so it never overwrites run 1’s files.

Method

• Input: one invented page of 1,074 characters and seven invented requests in the script. No real page, visitor or company is used. The same text every run.
• Model: claude-haiku-5-5 through the Messages API (read 2026-11-04), no web search, no temperature (the model rejected it on 2026-11-03), at most twenty requests a run.
• How an edit is applied: one after another, on a copy held in memory. Each piece to find must be on the page exactly once at that moment. The page on disk is never touched.
• What counts as added markup that is caught: the replacement text contains a script, iframe, frame, frameset, object, embed or applet tag, a base, meta, link or form tag, an attribute starting with on such as onerror= (also right after a slash, as in <svg/onload=>), or a javascript: link. The markup is read the way a browser reads it, and the changed page as a whole is compared with the original, so a tag or attribute split across two edits is caught too. Text already on the page is not re-checked for this.
• What counts as a good title and heading: exactly one <title> of 10 to 60 characters, and exactly one <h1>.
• What counts as a working link: only <a href> links are checked, in any quoting or capitals, and markup inside an HTML comment is ignored. #name needs that id on the page; a path starting with / needs its path in SITE_PAGES (anything after # or ? is ignored); mailto:, tel: and sms: links pass, and so does # alone; a new https:// link is flagged for a person; anything else is flagged.
• Checks on the answers, each with the planted fault that trips it: a script added (request 1); a link to a page that is not there (request 2); a text to find that is not on the page (request 3); an emptied title (request 4); a reply that is not the expected JSON (request 5); a missing reply (request 6); a deleted required section, which also removes the only main heading (request 7).
• Checks no planted fault trips, because a live request tripped them: a link to /team.html (request 5 of run 1), and a removed contact section with two links to it (request 6 of run 1). Other checks, such as a text to find that appears twice and a new link to another site, are not exercised by any run on this page.
• Safeguards no run trips: the script stops if there are more than twenty requests or two share an id; it stops if the starting page already fails the check; it reports a request whose page or text changed since its answer was saved; it catches an answer with more than five edits; and it stops if its cost estimate passes $2.00.
• Cost: tokens are read from the API response and priced at Anthropic’s pricing page (read 2026-11-04). The script uses the rate for prompts up to 100,000 tokens for every prompt.

Limits

• This is not a client result. The company, the page and the requests are invented, and nothing here describes any real website.
• A small, plain page. The demo page has three sections and a few links. Real pages are longer, carry scripts, forms, images and styles, and Claude has read only this one.
• The check does not read meaning. A headline that is well formed but wrong, a price changed to another price, or a sentence that says the opposite of what you meant passes, because it breaks no link, title or section. That is what the person who approves is for.
• It checks the page, not the site. It does not test that a link target loads, that a page looks right on a phone, that a form still sends, or that a script elsewhere still runs. Links are checked against the list you give it.
• A request can try to steer the AI. The page is treated as text, but a sentence aimed at Claude inside a page is still read by it. The checks look at what comes out, and a person reads every ready edit.
• Answers vary. A live run on the same requests can word edits differently, and a request that was caught here may pass, or the other way round.
• The seven planted faults are the faults the check was built for. Catching them shows the check works. It does not tell you how often a real model makes other kinds of mistake.
• It publishes nothing and does not promise any result for your site, traffic or leads.