AI-Built Websites Look Finished, But Are They Ready to Launch?

Share

13 min

The short version

AI website builders get a site online in hours, but launching is not the same as looking finished. This researched checklist covers the security, accessibility, SEO, analytics, and legal gaps that Lovable, Bolt.new, v0, and Replit leave behind, plus how to close them in a day or two.

Summarize with AI

ChatGPT

OpenAI

Gemini

Google

Perplexity

AI Search

Editorial Disclosure & Affiliate Notice

This content is published for informational and educational purposes only. It is not intended as a substitute for professional, legal, financial, or medical advice. AIUnpacker is funded through clearly labeled sponsored articles and reviews, relevant paid link placements, and affiliate commissions where disclosed. Commercial partnerships help fund the free editorial library. Sponsored work is labeled, and a payment does not change the verdict.

  • For educational purposes only. Nothing here should be taken as a guarantee, recommendation, or professional recommendation.
  • AI-assisted editing. Drafts are produced with AI assistance and get a human pass before they go up.
  • Opinions are our own. Also, we are not affiliated with most tools we cover unless explicitly stated.
  • Information may be outdated. Verify pricing, features, and policies directly with the vendor.
  • Last reviewed: . Published .

Read more on our About page, Terms and Editorial Policy.

No, most AI-built websites are not ready to launch the day they look finished. Lovable, Bolt.new, v0, and Replit get a working site online in an afternoon; looking finished and being launch-ready are different jobs. The gaps that bite hardest are security configuration, accessibility, SEO plumbing, analytics, and legal pages. A scan of 1,645 Lovable apps found 170, about 1 in 10, with databases anyone on the internet could read.

What AI website builders actually finish for you

AI builders finish the scaffolding: pages, components, hosting, sign-in flows, and a live URL on a subdomain. That’s genuinely a lot, and it’s why they’ve exploded.

Lovable is the current center of gravity: a $400 million Series C at a $13.3 billion valuation in August 2026, roughly double its December 2025 figure, per Reuters. Its pricing page (November 2026) shows a free tier of 5 build credits a day (capped at 30 monthly) plus 20 Cloud credits for hosting; Pro starts at $25/month for 100 credits, one balance metered across building, hosting, and in-app AI. Custom domains connect via guided DNS in Project → Settings → Domains.

The others occupy different niches. Bolt.new builds entirely in the browser: 1 million free tokens a month, Pro at $25/month for 10 million. v0, Vercel’s generator, works best as a UI component builder, not a full app builder; Premium runs $20/month with $20 of credits. Replit goes deepest: Core is $20/month with its autonomous Agent included, deployments scaling from free static hosting to always-on VMs per its deployment pricing. Recent comparisons converge on shorthand: v0 for components, Lovable for fast full-stack apps, Replit for flexibility, Bolt for speed.

The gap between “works” and “launch-ready”

Every builder above optimizes for the demo moment. A launch is a different discipline: the standard checklists run 150-plus items, from crawl settings to redirect maps, per Digital Applied’s roundup. Vibe coding is building software by describing it to an AI in plain language, and its promise is skipping the slow parts: the same slow parts (security review, accessibility testing, monitoring) that a launch demands.

Security is the gap that can sink you

The most damaging documented failure is exposed infrastructure. In March 2025, researchers Matt Palmer and Kody Low scanned 1,645 apps on Lovable’s showcase: 303 vulnerable endpoints across 170 projects (about 10.3%) with databases a stranger could query unauthenticated, per Palmer’s disclosure and Superblocks’ analysis. Exposed data included emails, phone numbers, payment status, and live Gemini and Google Maps API keys. The finding became CVE-2025-48757, published May 29, 2025 after a 45-day disclosure window Lovable largely let lapse.

The root cause is architectural. Row Level Security (RLS) is a database feature restricting which rows each user can read or write; without it, every table is open to whoever holds the public client key, which in Supabase-backed apps ships inside the browser. Tables created outside Supabase’s dashboard can silently ship with RLS off: exactly the hole the scan found.

The secrets problem is bigger than one platform: GitGuardian’s State of Secrets Sprawl 2026 counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% year over year, 1.27 million of them AI-service credentials, up 81%. A scan by security firm Escape.tech of 5,600 publicly deployed vibe-coded apps turned up more than 2,000 vulnerabilities and over 400 exposed secrets, per OX Security’s writeup.

Lovable has built guardrails since. Its security documentation describes a Quick scan that runs automatically on every publish (RLS gaps, npm vulnerabilities, exposed MCP servers) and a manual Deep scan that hunts leaked credentials, injection risks, and payment manipulation; since May 2026, Wiz scans run natively inside Lovable. Two caveats: Deep scan only runs if you trigger it, and the docs say scans “don’t replace a professional security review.” Anything touching payments deserves one anyway.

About 1 in 10 Lovable apps scanned in the CVE-2025-48757 research (170 out of 1,645) had a database anyone on the internet could read. That’s the launch gap in one number.

Accessibility: AI-built sites fail basic WCAG by default

Ask an AI builder for an accessible site and watch it fail anyway. AudioEye asked five AI coding tools to do exactly that: all 15 sites failed WCAG 2.2 Level A, the standard’s most basic tier, with 306 distinct issues appearing more than 59,000 times, 55 per page on average. VentureBeat’s coverage noted 91% of those issues could make tasks harder or impossible for disabled users.

WCAG is the Web Content Accessibility Guidelines: the benchmark courts and regulators treat as the standard. This isn’t only an AI problem: WebAIM’s 2026 Million report found 95.9% of the top million home pages have detectable WCAG failures, averaging 56.1 errors per page. But AI-generated code reproduces the classics at scale: missing form labels, empty alt text, low contrast, keyboard-unreachable buttons.

There’s a legal edge: UsableNet tracked 2,019 web and digital accessibility lawsuits in the first half of 2025, a pace about 20% ahead of 2024. Treat accessibility as launch-blocking for anything customer-facing, and get proper legal advice: this article isn’t legal counsel.

Performance: check Core Web Vitals before Google does

Core Web Vitals are Google’s field metrics for real-user experience, and the good thresholds haven’t moved: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1 at the 75th percentile, per web.dev. INP replaced FID in March 2024, so an audit still showing FID is stale. Google confirms these metrics feed into its ranking systems: an SEO issue as much as a UX one.

AI-built sites usually load fine on a fast office desktop, then fall over on a mid-range phone. Finding out costs nothing: run your URL through PageSpeed Insights and fix what it flags: usually oversized images, render-blocking scripts, and layout shifts.

SEO plumbing is the quietest failure. AI builders will write you a title tag, but they won’t verify robots.txt allows crawling, generate an XML sitemap, or register you with Google Search Console: steps launch checklists treat as mandatory. Add unique titles and meta descriptions per page, one H1 each, correct canonicals, and structured data validated in Google’s Rich Results Test.

Analytics is manual too: Lovable documents a Google Analytics 4 connector, but nothing tracks anything until you connect an account. For backups, Lovable Cloud runs on Supabase, whose backup documentation is blunt: free projects get no automated backups; daily backups with 7-day retention start on paid plans. Store user data, and backups become launch-blocking.

Legal pages split into required and recommended. A privacy policy is legally required if you collect any personal data (names, emails, cookies, IP addresses) under GDPR, CCPA/CPRA, and 20-plus US state laws; TermsFeed notes Google Analytics and Stripe contractually require one regardless. Terms of service aren’t legally required but are worth adding for anything commercial. Beyond a brochure site, have a lawyer look at both.

Launch-blocking vs nice-to-have: the triage table

Not every task carries the same weight. Here’s how to triage the week before go-live.

TaskVerdictWhy / quick check
Verify Row Level Security on every tableBlockingExposed databases are the documented #1 failure; check Supabase’s Security Advisor
Scan for leaked API keys and secretsBlockingKeys in client code are public code; run the builder’s Deep scan
Working auth, payments, and formsBlockingTest every flow with a real account and a real card
Accessibility fixes (labels, alt, contrast, keyboard)BlockingAll 15 AI-built sites in AudioEye’s study failed WCAG Level A
Core Web Vitals passBlocking for SEOLCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1 via PageSpeed Insights
Titles, metas, robots.txt, sitemap in Search ConsoleBlockingWithout crawl setup, Google may never index you
Privacy policy (+ cookie consent where required)Blocking (legal)Required if you collect any personal data
Backups of any user dataBlocking if you store dataSupabase free tier has none; paid adds daily backups
Rate limiting on auth and APIsBlocking if you have authSupabase ships auth rate limits: review them in the dashboard
Real-device testingBlockingDevTools emulation plus one real Android and one iPhone
Structured data / schema markupNice-to-haveEarns rich results; validate in the Rich Results Test
Analytics (GA4 or similar)Nice-to-have, but do itCosts nothing; without it you’re flying blind
Uptime and error monitoringNice-to-have at firstUptimeRobot’s free tier: 50 monitors at 5-minute checks

The pre-launch checklist: 14 checks and how to run each

Work top to bottom; the first six cause real damage.

  1. Run the builder’s own security scan. In Lovable’s Security view, Quick scan fires automatically on publish; trigger Deep scan manually. “Try to fix all” draws from a free pool of 10 fixes refreshing every 24 hours.
  2. Verify Row Level Security on every table. Check Supabase’s Security Advisor for “RLS disabled” warnings, then try reading a table while logged out: data coming back means that table is open.
  3. Hunt for exposed API keys. Search your deployed page source and JS bundle for key patterns (strings starting sk- or AIza), and enable GitHub secret scanning if your repo lives there. Move anything sensitive server-side.
  4. Try to break your own authentication. Create a fresh account, reset the password, hit protected pages while logged out, and confirm Supabase’s auth rate limits are set for production.
  5. Test on real devices. DevTools emulation first, then a real Android and a real iPhone. Safari and mobile keyboards break AI-generated layouts in ways emulation never shows.
  6. Run an accessibility pass. Scan with WAVE or axe DevTools, then tab through keyboard-only. Fix missing form labels, empty alt text, low contrast, and mouse-only interactions.
  7. Check Core Web Vitals. Run every important URL through PageSpeed Insights; target LCP under 2.5s, INP under 200ms, CLS under 0.1.
  8. Do the SEO plumbing. Unique title and meta description per page, one H1 each, robots.txt allowing crawls, an XML sitemap submitted to Google Search Console and Bing, canonicals set, structured data validated.
  9. Wire up analytics. Connect Google Analytics 4 through Lovable’s integration or paste the gtag snippet into index.html; add a consent banner if you have EU traffic.
  10. Publish the legal pages. A privacy policy is required the moment you collect personal data; add terms for anything commercial. Templates are fine to start: get a lawyer for payments or health data.
  11. Connect your real domain and verify HTTPS. Project → Settings → Domains in Lovable, follow the guided DNS setup, confirm the padlock loads, and redirect the old builder subdomain.
  12. Set up backups. Supabase’s free tier includes none; paid plans add daily backups with 7-day retention, or schedule your own database dumps.
  13. Add uptime and error monitoring. A free UptimeRobot account checks your URL every 5 minutes and alerts you when it drops; add an error tracker so exceptions land somewhere you’ll see.
  14. Add rate limiting where it’s missing. Supabase covers auth endpoints, but edge functions and custom APIs need their own, per-user limits stop one visitor from hammering your bill.

How much polish time should you budget?

Plan on one to two days: honest math the marketing doesn’t say. A marketing site with no user data is a one-day job; authentication, payments, or stored personal data stretches it to two or more, because items 2, 4, 12, and 14 become launch-blocking. The builder plan is the predictable cost: roughly $20-$100/month across the four tools’ paid tiers as of November 2026, while metered usage isn’t: Lovable bills extra once credits run out, and Replit users report Agent charges beyond their allowance. Treat metered costs as unbudgeted until you’ve watched a month.

What to do next

If you’re non-technical: build in Lovable, run this checklist in order, and pay for a one-time security review before you accept payments: storing other people’s data is where professional help pays for itself. If you’re a developer: generate anywhere, then export the code and own the deployment, where security and monitoring are home turf. Need only a brochure site? Wix or Squarespace handles more launch work.

Whichever path you take, launch the day the checklist is done, not the day the demo looks good.

FAQ

Are AI-built websites ready to launch as-is?

Usually not. AI builders produce a working, hosted site quickly, but documented research shows systematic gaps: a scan of 1,645 Lovable apps found 170 with fully exposed databases, and all 15 AI-built test sites in AudioEye’s study failed basic WCAG accessibility. Plan on one to two days of human work before you send real traffic.

What do AI website builders actually finish for you?

They finish the scaffolding: generated pages and components, hosting with a live subdomain URL, sign-in flows, and guided custom-domain setup. Lovable adds built-in security scans that run on publish, and its Cloud backend runs on Supabase under the hood. What they don’t finish is launch-grade work: verified database rules, accessibility fixes, sitemap and Search Console setup, analytics, legal pages, backups, monitoring.

How much does it cost to build and launch a site with an AI builder?

Per the vendors’ November 2026 pricing pages: Lovable Pro starts at $25/month for 100 credits (free tier: 5 credits daily); Bolt.new Pro is $25/month for 10 million tokens; v0 Premium is $20/month with $20 of credits; Replit Core is $20/month plus usage. Add a domain, and expect metered costs to rise with usage.

What is the biggest security risk with AI-built websites?

Exposed databases and leaked API keys. The CVE-2025-48757 research found 170 of 1,645 scanned Lovable apps (about 10.3%) had Supabase databases without Row Level Security, letting anyone query emails, phone numbers, payment status, and API keys without signing in. GitGuardian counted 1.27 million AI-service secrets leaked to public GitHub in 2025. Run your builder’s security scan and verify RLS on every table manually.

Do AI-built websites pass accessibility standards?

Rarely without human fixes. AudioEye asked five AI coding tools to build accessible websites and all 15 failed WCAG 2.2 Level A, the standard’s most basic tier, with 306 distinct issues appearing more than 59,000 times. WebAIM’s February 2026 audit found 95.9% of the top million home pages have detectable WCAG failures. Run WAVE or axe DevTools, then fix labels, alt text, contrast, and keyboard navigation.

Will an AI-built website rank in Google?

It can, but only if you do the SEO plumbing most builders skip: unique titles and meta descriptions per page, a crawlable robots.txt, an XML sitemap in Google Search Console and Bing, correct canonical tags, and clean Core Web Vitals. Google confirms those metrics feed into its ranking systems, so performance work pays off in search too.

What are the main alternatives to Lovable, Bolt, v0, and Replit?

Traditional no-code builders like Wix, Squarespace, and Webflow handle hosting, SSL, SEO settings, and compliance pages more completely, at the cost of less custom logic. For developers, AI assistants like Cursor or GitHub Copilot give full control over security and deployment. The four AI app builders sit in between: fast full-stack generation, but you own the launch-readiness work.

What should I do first after building a website with AI?

Run your builder’s security scan first (for Lovable, that’s the Security view, where Quick scan runs on publish and Deep scan is manual) then verify Row Level Security on every database table. Those two steps address the worst documented failure in AI-built apps: exposed databases. Then work down the checklist: accessibility, Core Web Vitals, SEO, analytics, legal pages, backups, monitoring.

Sources

Weekly digest

Get our weekly AI digest

The latest AI tools, prompts, and insights — short, useful, every week.

No spam. Unsubscribe anytime.

AIUnpacker Editorial

Articles are written for a specific question. Sponsored work is labeled.

About us ·More articles