Secrets stay private
AI keys and SMTP credentials belong in private server configuration outside public_html, never in generated client-side JavaScript.
Security through controlled generation
Reduce avoidable risk by controlling what the generator emits.
Integrated Omega Web Pro pipeline component: This engine operates within the Omega Web Pro website-generation and quality workflow. It is not one of the separately sold or separately installed Pure HTML Pro or WordPress products offered by OmegaWebApps.com.
Omega favors static-first output, private server configuration, strict path handling and validated generated files instead of placing secrets or unrestricted AI-generated code in the browser.
Omega Web Pro pipeline distinction: This engine is an integrated component of the Omega Web Pro website-generation workflow. It works inside the generation pipeline when Omega Web Pro builds website output; it is not one of the separately purchased or installed Pure HTML Pro or WordPress plugin products sold by OmegaWebApps.com.
Security architecture
Security principles in the architecture
The safest code is often the code a website does not need.
AI cannot bypass code generation
External planning data is schema-constrained and validated before the Omega engines use it.
Path validation
Preview, export and project-storage paths are constrained to prevent generated requests from escaping their project workspace.
Static-first output
Ordinary static pages reduce the server-side attack surface when a project does not require a backend.
Optional form backend
Server-side contact handling can be generated only when required and should use authenticated SMTP/private credentials.
Fail closed
Known generation or preview failures can block export instead of being ignored.
Deployment responsibility
Security continues after export.
The generated site can provide good defaults, but the final hosting environment still matters.
Protect private files
Keep secrets, backups and private data outside the public document root.
Maintain the server
Use supported PHP/server versions and current hosting security updates where backend functionality is enabled.
Review custom integrations
Analytics, third-party scripts, forms, embeds and future edits can introduce new risks after generation.
Build • Rank • Own Your Code
Generate with safe boundaries.
Let AI assist the strategy while Omega retains control of the production output and validation rules.
Dual-platform responsibility
Shared requirements, platform-aware implementation.
WordPress introduces PHP, CMS and update responsibilities that do not exist in a static site. Omega therefore keeps WordPress generation uniquely namespaced and validates that output separately while private credentials remain outside public_html.
Controlled generation boundary
Omega-native AI knowledge is not given authority to execute or directly ship production code.
Omega constrains native planning to structured project data. The verified sixteen-stage production pipeline then controls the build from AI Orchestrator and Entity Architecture through Deployment and Final Validation; planning output cannot bypass those production gates.
Same-origin API controls
The Builder API applies session and origin protections designed to reject inappropriate cross-site build requests.
Private project workspace
Active generation data is stored outside the publicly served website directory rather than placing raw project workspaces directly under public_html.
Tokenized preview
Generated previews use high-entropy project/token addressing, path restrictions and noindex controls rather than publishing the temporary build as an ordinary public website.
Preview CSP
The preview route applies restrictive content-security rules to limit arbitrary network requests, external scripts, form submission and embedded objects during inspection.
OMEGA WEB PRO HOSTING
Security boundaries in Omega Web Pro Hosting
Generated-site security checks are complemented by operational isolation, authenticated dashboard access and private server-side configuration in the hosted workflow.
Customer control plane
Customers receive Omega Web Pro Hosting controls rather than infrastructure-administration access. Private credentials, service secrets and internal hosting-management functions remain outside the public website and generated source.
Managed hosting plans
Monthly US$9.99 · Annual US$99 · Two Years US$179. Managed Omega Web Pro Hosting remains available while the recurring plan is active.
Lifetime software licence
US$999 one time for permanent supported build, edit and export rights for one licensed website domain. Production hosting is separate and can be added when required.
Current production customer architecture
Build, purchase, billing, hosting and editing continue through one authenticated Omega customer relationship.
For a first-time Omega Hosting checkout, Omega saves the selected plan and pending website to one restricted checkout-bound customer account before payment, sends a secure one-time account-setup email, and requires the customer to set a password and sign in before continuing to the required purchase acknowledgements and secure Stripe Checkout. Paid Hosting and Editor entitlement remain locked until Stripe confirms payment. For a first-time Lifetime Licence purchase, an existing account is reused where available, or the customer account is created after Stripe confirms the purchase. My Account is the commercial identity, website, licence and billing centre; recurring hosting customers can use the Full Hosting Dashboard while entitled; lifetime customers retain their separate same-domain software rights.
My Account
Purchased websites, subscription/renewal state, lifetime licences, Pending Checkout, Purchase History, profile/security, Builder and Website Editor entry points.
Billing Centre
Secure Stripe customer-portal access for the account's usable canonical production billing customer, including supported payment-recovery and subscription billing actions.
Omega Hosting Dashboard
Entitled operational hosting controls for project workspaces, provisioning, deployment, backups, databases, SFTP and usage, with customer-facing DNS/SSL state surfaced through Omega interfaces.