You automate that shit, you never give them direct access to the source code, and you obfuscate the code that changes the opacity so that it’s really hard to find even if they manage to wrest control away from you. I did this once after the client failed to pay as agreed. They narrowly escaped their site being replaced with a message saying they did not pay their bill, by paying eventually, but I couldn’t let them get away with that shit if they decided to change passwords and tried to screw me completely.