Is it safe to let Claude Code change my website in production?

Yes, if production is never its first stop. In Manual mode Claude Code starts read-only and asks before editing files or running commands. Add a git branch, a pull request you review, a preview deploy and a check of the live URL after merging, and a bad change becomes a rejected pull request instead of a broken site.

Facts

In Manual mode, Claude Code starts with read-only permissions and asks before it edits files, runs tests or executes commands. (Claude Code docs: Security)
Claude Code has six permission modes; in plan mode it reads files and explores but does not edit your source files. (Claude Code docs: Configure permissions)
Claude Code evaluates permission rules in the order deny, then ask, then allow, so a deny rule always wins. (Claude Code docs: Configure permissions)
Claude Code checkpoints, opened with /rewind or Esc twice, do not track files changed by Bash commands and are not a replacement for git. (Claude Code docs: Checkpointing)
Claude Code keeps file snapshots for the 100 most recent checkpoints of a session and deletes them about 30 days after the session last saved one. (Claude Code docs: Checkpointing)
GitHub branch protection can require a set number of approving reviews before a pull request is merged. (GitHub Docs: About protected branches)

What does Claude Code do without asking?

In Manual mode it only reads: file reads and a built-in set of read-only commands such as ls, cat and git status. Edits and other commands wait for your approval. Other modes ask less:

Mode	What it does	On a live site
Manual (default)	Asks before edits and commands	Safe start
Plan	Reads and proposes, edits no source files	Best for the first look
acceptEdits	Accepts file edits in the working folder	Fine on a branch
bypassPermissions	Skips permission prompts	Never on the production branch

How do I stop it from deploying or reading secrets?

Put deny rules in the repository's .claude/settings.json; deny is checked before any allow. A Bash rule matches the command as written, so keep deploy keys out of the machine too, and let the deploy happen only from a merged pull request.

// .claude/settings.json in the site's repository
{
  "permissions": {
    "deny": [
      "Bash(git push *)",
      "Bash(vercel --prod *)",
      "Read(./.env)",
      "Read(./.env.*)"
    ]
  }
}

Can I undo what Claude Code changed?

Partly. /rewind restores file edits made by its edit tools in the session, but not files changed by shell commands, and nothing already deployed. Git is the real undo: revert the merge commit and redeploy.

Why check the live URL instead of trusting “done”?

The agent reports what it meant to do. A failed build, a cache, or content rendered only in the browser can leave the live page different. Open the published URL, view the source, and confirm the new text and links are there.

Step by step

Start on a branch. Ask Claude Code to create a branch before any edit; never work on the production branch.
Scope the task. Name the files or pages it may change and tell it not to touch anything else.
Review the pull request. Read the diff; reject changes outside the task, such as edits to the home page.
Check the preview deploy. Open the preview URL your host builds for the branch before merging.
Merge and check live. After the production deploy, open the live URL and confirm the change; revert the merge if it is wrong.

Common mistakes

Running in a mode that skips permission prompts on the production branch.
Letting it fix “one more thing” outside the task, such as the home page or navigation.
Trusting the agent's “done” without opening the live page.
Relying on /rewind as a backup instead of git.

How easyIndex solves it

easyIndex applies this to AI search: your coding agent only adds new content pages and never changes the home page or a page that already works, the owner approves each batch before it is published, and each page is audited when submitted and checked on the live site after publishing. easyIndex never touches your repository. US$ 30 per website a month after a 7-day free trial.

Frequently asked questions

Does Claude Code deploy by itself?

Only if you let it run a deploy command or push to a branch that deploys. Deny those commands and deploy from a reviewed pull request.

Is plan mode enough to stay safe?

Plan mode does not edit source files, so it is safe for exploring. To make changes you leave it, so the branch and review still matter.

Can it see my .env file?

File reads inside the working folder need no approval in Manual mode. Add deny rules for .env files to block them.

What if a bad change reaches production?

Revert the merge commit in git and redeploy; the session's /rewind cannot undo a deploy.

Continue reading

Last verified on October 13, 2026.