Cyberstrike - AI-Powered Penetration Testing Agent

Threat Actors Have Gone Agentic: Inside the FortiBleed Campaign

contact@cyberstrike.io (Cyberstrike Team) — Tue, 23 Jun 2026 00:00:00 GMT

On June 18, 2026, a security researcher stumbled onto an open directory sitting unprotected on the public internet. It belonged to no security vendor and no research lab. It belonged to the attackers. Inside were the working files of FortiBleed — what researchers now describe as the first publicly documented, global-scale agentic AI cyberattack: target lists, connection strings, GPU cracking jobs, harvested credentials, and the operators’ own scripts.

For once, the curtain was pulled back. And what sat behind it wasn’t the familiar picture of a few operators grinding through machines by hand. It was a machine that ran with far less human hands-on-keyboard than a campaign this size normally needs.

> Disclosure. One of the open-source tools referenced in this operator’s infrastructure was CyberStrike — our own project. We’re not going to pretend otherwise; we address it directly in the final section, _Where We Stand_.

The operators had built an isolated offensive lab — virtual machines on a private subnet, hardened routing, shared sessions so multiple people could watch the console at once. But the center of gravity wasn’t the humans. It was an autonomous agent, automatically provisioned across every machine in the fleet. The recovered artifacts pointed beyond static scripting — including AI-generated “harvest summaries” — consistent with a workflow built on a reasoning model rather than a fixed sequence.

According to SOCRadar’s _Dismantling FortiBleed_ report, the campaign scanned a target universe of more than 430,000 FortiGate firewalls and surfaced over 110 million credentials. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf) Its real significance, though, isn’t the scale. It’s what researchers describe as a threshold crossed: threat actors operating in the agentic era.

> What is an agentic AI cyberattack? An intrusion campaign driven by an autonomous AI agent that reasons over targets, writes its own tooling, and chains reconnaissance into exploitation with minimal human input.

---

Anatomy of an Agentic AI Cyberattack: The Five-Stage Attack Chain

Strip away the AI for a moment and, per SOCRadar’s reporting, FortiBleed looks like a textbook Initial Access Broker operation: financially motivated, opportunistic, relentlessly automated. SOCRadar reports it has been running since at least February 2026, and at the time of its report was still actively sniffing more than 19,000 devices out of 80,553 identified targets. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf) What makes it remarkable is not any single zero-day. There isn’t one. It’s the assembly line.

SOCRadar describes a methodical five-stage attack chain — a self-feeding loop: [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf)

FortiBleed five-stage agentic AI cyberattack kill chain diagram

Stage 1 — Credential Sourcing & Reconnaissance

The actors begin with vast lists of previously collected credentials and scan the internet — SOCRadar cites tools such as Masscan and Shodan — for exposed FortiGate firewalls. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf)

Stage 2 — Pairing & Initial Access

Collected credentials are paired to the discovered devices through credential stuffing and brute-forcing, then used to gain access. Weak, reused, and never-rotated admin accounts do most of the work — no exploit required. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf)

Stage 3 — FortigateSniffer Deployment & Credential Harvesting

This is the engine. SOCRadar reports that on each compromised firewall the actors deploy a custom Golang tool (“FortigateSniffer”). To deploy it, the operators load a list of FortiGate SSH credentials — in one batch SOCRadar observed, 6,127 devices were loaded, with a 90% SSH validation success rate. The tool then abuses the FortiOS built-in diagnose sniffer packet command to passively capture authentication traffic across 24 protocols from every network behind the device, extracting both cleartext and hashed credentials from traffic that was never meant to leave the perimeter. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf)

Stage 4 — GPU Hash Cracking & Active Directory Reuse

Captured hashes are written into hashcat-ready files and cracked at scale. SOCRadar reports the operators rented decentralized GPU capacity (vast.ai) to work through the volume; recovered credentials are then validated and reused against Active Directory domains and other exposed services. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf)

Stage 5 — Collection & Exfiltration

Fresh credentials feed straight back into Stage 1, widening the blast radius with every cycle. SOCRadar reports more than 659 harvesting pipelines were launched this way. Among the victims it attributes to the campaign is a company it describes as a NATO-aligned defense contractor. [[1]](https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf)

The result is a machine that gets bigger as it runs. Each compromised edge device becomes a listening post; each listening post produces credentials that compromise the next wave. No exotic exploit chain — just hygiene failures harvested at industrial scale and at machine speed.

---

When Automation Starts to Think: Why Agentic Attacks Change the Economics

Attackers have automated for decades. Worms, botnets, mass scanners, credential-stuffing frameworks — none of that is new. So it would be easy to file FortiBleed under “more of the same, but bigger.” That would be a mistake. The difference between a script and an agent is the difference between a player piano and a musician.

Diagram contrasting a fixed script with a goal-driven AI agent

Traditional automation does exactly what it was told, in the order it was told, and breaks the moment reality diverges from the script. An agentic system is built on top of a reasoning model. It takes a goal — _get credentials, move deeper, exfiltrate_ — and figures out the steps itself. It reads error messages and adapts. It writes its own tooling when the off-the-shelf option doesn’t fit. The human sets intent; the machine handles the path.

This is what collapses the economics. For most of cyber history, sophisticated intrusion was gated by scarce, expensive human expertise — a skilled operator could only be in one place at a time. Agentic systems dissolve that ceiling: a standard, off-the-shelf LLM subscription becomes tireless red-team labor that runs in parallel across an entire fleet, at a rounding-error cost compared to a human team.

> The barrier to a global-scale operation just dropped from a team of experts to a few operators and an API key.

And that turns time into the weapon. Defenders have always relied, implicitly, on time — time to patch, to rotate credentials, to notice. Agentic operations compress that window toward zero. The hygiene gaps FortiBleed exploited were survivable for years largely because exploiting them at scale was slow and labor-intensive. Remove the labor, and every unpatched edge device becomes reachable in the time it takes a model to reason through it.

Researchers describe FortiBleed as among the first global-scale campaigns where agentic tooling sat at the core of the operation — but the conditions that produced it are not unique to one group. The same models, the same frameworks, the same economics are available to everyone. What was demonstrated here will be repeated, refined, and specialized. The relevant question for defenders is no longer _whether_ attackers will run agentic operations. It’s whether defense will move at the same speed.

---

On CyberStrike Appearing in the FortiBleed Toolkit — and Where Defense Goes Next

There is one more detail in the FortiBleed reporting we won’t step around, because it concerns us directly. SOCRadar reports that the campaign’s harvest summaries carried the name of our own open-source, agentic penetration-testing framework — CyberStrike. We’d rather state that plainly than have anyone find it for us.

Dual-use is the nature of serious security tooling. Every meaningful offensive capability the industry has ever produced — port scanners, exploitation frameworks, credential crackers — has been used by both the people defending networks and the people attacking them. Nmap and Metasploit were built to make defenders stronger, and both have at times been turned against the systems they were meant to protect. That a tool appears in an attacker’s kit is not evidence the tool is illegitimate; it is evidence the tool is _capable_ — and capability has never chosen a side. But the people who build it still make choices, so here are ours.

Our stance

So here is where we stand, plainly.

We have no connection to this campaign or its operators, we were not involved in it in any way, and we condemn the criminal misuse of security tooling. That our own project was part of it is not something we shrug off — the harm here was real, and it is unwelcome.

CyberStrike is, and will remain, fully open source under AGPL-3.0. That is a deliberate choice. The same code an adversary could pick up is the code every defender can read, audit, run, and learn from. We won’t pretend openness has no cost — a campaign like this is part of that cost. We still believe the alternative — capability that exists, but only the well-resourced can see — leaves defenders worse off. That is the trade we’ve weighed, with eyes open.

Our terms say what we mean: CyberStrike is for authorized security testing only — _“only test systems you own or have explicit written authorization to test,”_ and never for unauthorized access. That line sits in our code of conduct, and every contributor builds on it.

We can’t choose who downloads an open-source project; no one can. What we can do is be honest about what the tool is, who it’s for, where we draw the line, and that its misuse here was real — and then keep building it in the open.

What this means for defenders

The reason an agentic framework is dangerous in an attacker’s hands is the same reason it matters in a defender’s: it operates at the speed and scale this new threat landscape demands. You cannot meet agentic offense with manual defense. When attackers can reason over an entire attack surface at machine speed, organizations still testing their environments by hand — once a quarter, one finding at a time — are running a different race entirely.

The lesson of FortiBleed is not that this technology should not exist. It already exists, on both sides, and it is not going back in the box. The lesson is that the hygiene failures it turned into stolen credentials — old hashes, missing MFA, exposed management interfaces — were all findable. Every one of them. The only question any organization should be asking is who finds them first — and whether defense moves at the same speed.

> CyberStrike is open source — read it, audit it, run it: github.com/CyberStrikeus/CyberStrike

---

FAQ

What is FortiBleed? FortiBleed is a large-scale credential-harvesting campaign targeting internet-facing FortiGate firewalls, which SOCRadar attributes to a financially motivated Initial Access Broker active since at least February 2026. Researchers describe it as the first publicly documented global campaign with agentic AI tooling at its core.

How many credentials did FortiBleed expose? Per SOCRadar’s reporting, the campaign launched 659 harvesting pipelines and surfaced more than 110 million credentials across a target universe of roughly 430,000 FortiGate firewalls.

What makes an attack “agentic”? An agentic attack is driven by an autonomous AI agent that reasons toward a goal, writes its own tooling, and chains attack stages together — rather than replaying a fixed script.

How can defenders respond to agentic attacks? Close the hygiene gaps agentic attackers harvest at scale — rotate credentials, enforce MFA, remove exposed management interfaces — and adopt autonomous, agentic testing that runs at the same speed as the threat.

---

References

All campaign facts in this article are attributed to the following public reports. Inline [1] markers link to SOCRadar’s _Dismantling FortiBleed_ report, the source for every statistic (430,000 firewalls, 110M credentials, 6,127 devices / 90%, 24 protocols, 659 pipelines, 19,000 / 80,553, the NATO-aligned defense contractor).

SOCRadar Threat Research Unit — _Dismantling FortiBleed_ (report PDF): https://socradar.io/wp-content/uploads/2026/06/Dismantling-FortiBleed.pdf
SOCRadar — _FortiBleed 2026: Fortinet Firewalls Compromised_ (blog): https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/
SpyCloud — _What SpyCloud Found Inside the FortiBleed Threat Actor Infrastructure_: https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/
BleepingComputer — _FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices_: https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/
CSO Online — _FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide_: https://www.csoonline.com/article/4186790/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide.html
Arctic Wolf — _Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries_: https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/

How to Use TSConfig Path Aliases to Improve Your Code

me@webreaper.dev (Web Reaper) — Mon, 14 Aug 2023 00:00:00 GMT

TSConfig path aliases are a powerful tool that can help you to improve the readability, maintainability, and error-proofing of your TypeScript code. This allows for easier to read clean code, and enables us to move files around without having to update import paths in every file.

_This is a huge time saver._

What Are Path Aliases?

The goal is to replace the following import statements:

// relative import path

with these import statements:

// alias import path

We can do this with a tsconfig.json or jsconfig.json file. We will be using TypeScript in this post.

How To Setup Path Aliases

Adding Path Aliases To Your TSConfig File

We need to update our tsconfig.json file to enable aliases. We will add a paths and baseUrl property to the compilerOptions object. Each path is relative to the baseUrl.

This will tell TypeScript to replace the alias with the actual path when compiling the code.

{
  "compilerOptions": {
    "baseUrl": ".", // root of your "paths" below. Required if "paths" is defined
    "paths": {
      "@components/*": ["src/components/*"] // enables us to use @components/MyComponent
    }
  }
}

Using Path Aliases In Your Code

Now in all of your source files, you can import components like this:

// Without path aliases

// With path aliases

Why Should I Do This?

Let's say we have the following file structure:

.
└── src/
    ├── components/
    │   ├── Hero.tsx
    │   └── Footer.tsx
    └── pages/
        ├── index.tsx
        └── solutions.tsx

Annoying Relative Imports

If we want to import Hero.tsx and Footer.tsx into index.tsx and solutions.tsx, we would need the following import statements:

Refactoring Relative Imports

Now lets say we want to refactor. We now have multiple "solutions" and want to have each on their own page, and have them under a solutions directory. The file structure now looks like:

.
└── src/
    ├── components/
    │   ├── Hero.tsx
    │   └── Footer.tsx
    └── pages/
        ├── index.tsx
        └── solutions/
            ├── solution.tsx
            └── solution2.tsx

Now we have to update the import paths of solution.tsx:

You can see how this makes refactoring more of a chore. We have to update the import paths in every file that imports these components. This is a huge time sink and can lead to bugs if you forget to update the import paths.

Alias Imports Version

Alternatively, if from the start we were using aliases, we would not have to update any files using the components. This is far better for maintainability:

Additional Paths

This can be extended to any number of path aliases. Some other potential ones you might use:

{
  "compilerOptions": {
    "baseUrl": ".",
    "paths": {
      "@config/*": ["src/data/*"],
      "@js/*": ["src/js/*"],
      "@layouts/*": ["src/layouts/*"],
      "@components/*": ["src/components/*"],
      "@assets/*": ["src/assets/*"]
    }
  }
}

Make Awesome Blog Posts People Will Love

me@webreaper.dev (Web Reaper) — Mon, 07 Aug 2023 00:00:00 GMT

Writing a blog post can be a great way to share your ideas and expertise with the world. However, it's important to make sure that your post is effective and engaging. Here are some tips for writing an effective blog post:

Choose a Topic

Choose a topic that you are passionate about and that your audience will find interesting.

Research

Do your research and gather information on your topic. This will help you to write a well-informed and accurate post.

Create an Outline

Create an outline for your post. This will help you to organize your thoughts and ensure that your post flows well.

Write a Catchy Headline

Write a headline that is catchy and attention-grabbing. This will help to draw readers in and encourage them to read your post.

Write an Introduction

Write an introduction that hooks your readers and gives them a reason to keep reading.

Use Subheadings

Use subheadings to break up your post into sections. This will make it easier for readers to scan and find the information they are looking for.

Use Images

Use images to break up your text and make your post more visually appealing.

Write in a Conversational Tone

Write in a conversational tone that is easy to read and understand.

Edit and Proofread

Edit and proofread your post to ensure that it is free of errors and flows well.

Conclusion

By following these tips, you can write an effective blog post that engages your readers and helps you to share your ideas and expertise with the world.

15 Best VSCode Extensions for Front-End Developers in 2023

me@webreaper.dev (Web Reaper) — Sat, 05 Aug 2023 00:00:00 GMT

Don't be a code monkey. Use these VSCode extensions to become a code _ninja_.

I know what you're thinking: "I'm a real front-end developer, I don't need any extensions. I'll just bit-bang everything like a real man." I aplaud you, but VSCode extensions can make your life so much easier. They'll help you write better code, find bugs faster, and save time on repetitive tasks.

The Best VSCode Extensions

[Prettier - Code Formatter](#prettier---code-formatter)

[ESLint](#eslint)

[GitHub Copilot](#github-copilot)

[GitLens — Git supercharged](#gitlens--git-supercharged)

[Tailwind CSS IntelliSense](#tailwind-css-intellisense)

[Auto Rename Tag](#auto-rename-tag)

[Color Highlight](#color-highlight)

[Auto Close Tag](#auto-close-tag)

[CSS Peek](#css-peek)

[Live Server](#live-server)

[ES7+ React/Redux/React-Native snippets](#es7-reactreduxreact-native-snippets)

[Better Comments](#better-comments)

[Material Icon Theme](#material-icon-theme)

[Dracula Official](#dracula-official)

[Pretty TypeScript Errors](#pretty-typescript-errors)

Prettier - Code Formatter

Prettier is an opinionated code formatter that will automatically format your code to a consistent style. This extension is great for teams that want to enforce consistency, or just to keep you from having to worry about formatting your code.

With over 34 million installations, you could say it is popular.

!prettier gif

ESLint

ESLint is a configurable linter to help you find and fix problems in your JavaScript code. It can be used for both frontend and backend development, and is a great way to catch bugs before they happen. It can check for mistakes like unused variables, missing semicolons, and more.

!ESLint VSCode Extension

GitHub Copilot

GitHub Copilot is an AI-powered pair programmer that helps you write better code, faster. While this is a paid tool (currently $10/month), it can be a huge time saver for developers.

!github copilot gif

GitLens — Git supercharged

GitLens is a VSCode extension that, well, supercharges your git features. It allows you to see who last edited a line of code, when it was last edited, and more.

!GitLens VSCode Extension

Tailwind CSS IntelliSense

Tailwind CSS IntelliSense is an extension that provides intelligent autocomplete, syntax highlighting, and linting for Tailwind CSS.

If you are using Tailwind CSS, you will 100% want this extension.

!Tailwind CSS IntelliSense VSCode Extension

Auto Rename Tag

Auto Rename Tag is a fairly simple extension, but a big time saver. If you change the opening of an HTML tag, it will automatically update the closing tag. This ensures your tags always match.

!Auto Rename Tag VSCode Extension

Color Highlight

Color Highlight is a simple extension that will highlight colors in your code. This is great for quickly seeing what color a variable is set to, or if you are using the correct color in your CSS.

!Color Highlight VSCode Extension

Auto Close Tag

Auto Close Tag is another simple extension that can save you time. It will automatically close HTML tags for you. So when you type

, it will automatically add the

to match.

!Auto Close Tag VSCode Extension

CSS Peek

CSS Peek is a great extension for frontend developers. It allows you to quickly see the CSS for a given HTML element. This is great for when you are trying to figure out why a certain element is styled a certain way.

!CSS Peek VSCode Extension

Live Server

Live Server is a VSCode extension that allows you to run a local server with live reload. This is great when initially learning web development with basic HTML, CSS, and JS files, as it will update your preview in real time!

!Live Server VSCode Extension

ES7+ React/Redux/React-Native snippets

ES7+ React/Redux/React-Native snippets is a collection of snippets for React, Redux, and React Native. If you write React code, you will want this extension.

!ES7+ Snippets VSCode Extension

Better Comments

Better Comments improves the comments for your code. It provides syntax highlighting for different types of comments, like the below picture shows.

!Better Comments VSCode Extension

Material Icon Theme

Material Icon Theme provides icons for files and folders in VSCode. This makes it easier to find what you are looking for, and makes your code window look nicer.

!Material Icon Theme VSCode Extension

Dracula Official

Dracula Official is a dark theme for VSCode. It is one of the most popular themes on the marketplace, and my personal favorite theme.

If you don't like this particular theme, you should pick a different theme to install in VSCode, as they can provide additional syntax highlighting support.

!Dracula VSCode Extension

Pretty TypeScript Errors

Pretty TypeScript Errors provides a more readable error message, and provides a link to the documentation for the error. I have fallen in love with this extension for TypeScript development.

!Pretty TypeScript Errors VSCode Extension

Bonus Extensions

These are a few other extensions I find useful, but didn't quite make the top tier list.

Astro

Astro is an obvious extension if you are developing using Astro. It provides syntax highlighting, code snippets, and more.

!Astro VSCode Extension

Creating a Gradient Underline with Tailwind CSS

me@webreaper.dev (Web Reaper) — Mon, 10 Jul 2023 00:00:00 GMT

This is a short post on how to create a gradient underline with Tailwind CSS to separate sections of your page, or just to make your links look cool! I'll explain the code below, but if you just want to see the code, you can skip to the end.

How to create a gradient underline

We create this as an absolute positioned element, which requires the parent element to be relative. This allows us to position the element relative to the parent (surpise). In this case we are going to have it underline the parent element, although you could adjust this positioning.

Gradient underline color

We're going to use the bg-gradient-to-r utility to create a gradient from left to right. Direction really doesn't matter, the point is that it's a gradient. For the starting color we're going to make it transparent, go to your desired color, and go back to transparent. We can do this with the utilities bg-gradient-to-r from-sky-500/0 via-sky-500/70 to-sky-500/0. This will create a gradient from transparent to sky-500 to transparent. You can adjust the opacity of the middle color to whatever you want. I chose 70 because it looked good to me.

Gradient underline height

Let's set the height of the underline to h-px. This will make it 1px tall. You can adjust this to whatever you want.

Positioning the gradient underline

We want the gradient underline to span the bottom edge of the parent element. So the first utility we want to use is inset-x-0 to have it go from the left edge to the right edge, then bottom-0 to put it at the bottom. You can find more info about these utilities in the Tailwind Docs.

If you need to adjust the vertical location of the underline, you can do so using the bottom utility. For instance, if you want to move it down slightly to overlap a bottom border, you can use -bottom-px to move it down 1px.

Final code

Generic gradient underline

Here I use the color sky-500 from the Tailwind color palette. You can use whatever color you want.

Link underline on hover

This is very similar to the above, but I've added a hover effect to the underline. There's also a transition because who doesn't like transitions?

![](../tailwind-gradient-underline/spongebob-transitions.jpeg)

How to Write SEO Friendly Blog Posts

me@webreaper.dev (Web Reaper) — Wed, 21 Jun 2023 00:00:00 GMT

If you want your blog to rank high on search engines like Google, you need to write SEO-friendly blog posts. Here are some tips to help you optimize your blog posts for search engines.

Do Keyword Research

Use keyword research tools like Semrush’s Keyword Magic Tool to find topics people are searching for. Choose a primary keyword and related keywords to include in your post.

Write Quality Content

Write high-quality content that is informative, engaging, and relevant to your audience. Use headings and subheadings to organize your content and make it easy to read.

Optimize Your Headers

Use headers to break up your content and make it easy for search engines to crawl your page. Use H1 for your main title and H2, H3, and H4 for subheadings.

Use Keywords Strategically

Use your primary keyword in your title, URL, meta description, and throughout your post. But don't overuse it, as this can be seen as spammy.

Include Images and Videos

Use images and videos to make your post more engaging and visually appealing. Optimize your images by compressing them and adding alt text.

Link to Related Posts

Link to related posts on your blog to keep readers on your site longer and improve your bounce rate.

Optimize Your Meta Description

Write a compelling meta description that includes your primary keyword and entices readers to click through to your post.

Monitor Technical SEO Issues

Monitor your site for technical SEO issues like broken links, slow page speed, and mobile responsiveness. Fix any issues that arise to improve your site's SEO.

By following these tips, you can write SEO-friendly blog posts that rank high on search engines and drive traffic to your site. Remember to focus on writing high-quality content that provides value to your readers, and use keywords and other SEO tactics strategically to improve your chances of ranking.

Tips for Freelance Website Development

me@webreaper.dev (Web Reaper) — Mon, 05 Jun 2023 00:00:00 GMT

Freelance website development can be a rewarding career or side income, but it can also be challenging. Here are some tips to help you succeed as a freelance website developer.

Have Your Own Website

Just like with any other freelance business, you need to have your own website. This is where you can showcase your work, outline your services, and direct potential clients to learn more about you.

Identify Your Niche

Specializing in a particular niche can help you stand out from the competition. Consider focusing on a specific industry or type of website, such as e-commerce or portfolio sites.

Learn Required Skills

As a website developer, you need to have a strong foundation in coding. Start with HTML, CSS, and JavaScript, and consider taking online courses or attending bootcamps to improve your skills.

Treat It Like a Business

Freelance website development is a business, and you need to treat it as such. This means setting your own prices, marketing your services, and managing your finances.

Contracts

You will need a way to have contracts for your clients to limit any potential issues later. One way to do this is to use a service like Hello Bonsai or With Moxie to create contracts for your clients.

Build Your Portfolio

Your portfolio is a marketing tool. Make sure it showcases your best work and highlights your skills and expertise.

Network and Market Yourself

Networking and marketing are essential for finding new clients. Join online communities and forums, attend industry events, and use social media to promote your services.

Provide Excellent Customer Service

Providing excellent customer service is key to building a successful freelance business. Be responsive, communicate clearly, and deliver high-quality work on time.

By following these tips, you can build a successful freelance website development business. Remember to focus on providing value to your clients, and always be willing to learn and improve your skills.