How to tell if a website was built with an AI builder

Can you tell if a website was built with an AI builder? Yes, usually, when the builder left a trace. AI builders such as Lovable, Bolt, v0 and Base44 put their name in at least one place a visitor can check: the hosting address, a script the page loads, a badge link, a response header or a default tag. One match is a yes. No match is not a no: it means no strong AI signs, because an owner can move a site to their own domain and delete the traces.

This page is the hub for the per-builder guides. Its fingerprint lists come from the rules in Kitsuvo's detector, so they are the checks our browser runs, not a general impression of how AI sites look. We make Kitsuvo, so weigh that in mind; every item can be checked by hand with the steps below.

What each kind of evidence is worth

What you find	Answer	Why
The address ends in a builder's domain, such as lovable.app or bolt.host	Yes: hosted by that builder	The builder owns the domain, and a published project is served from it
A builder script, attribute or badge link in the page, such as data-lov-id or bolt.new/badge.js	Yes, even on a custom domain	These are artifacts only that builder's output carries
A response header that names the builder, such as x-powered-by: Bolt.new	Yes	The builder's hosting adds it
A generator tag that names a builder or a coding agent	Yes, by the publisher's own claim	It is a declaration, not a signature, so it is unverified
An untouched scaffold title, description or favicon	Possibly	Many starter projects share them, so it is weak on its own
A replit.app address	Possibly	Replit also hosts code people wrote by hand
shadcn/ui classes, purple gradients, Lucide icons, Vercel or Netlify hosting	Cannot tell	People use the same kits and hosts
WordPress, Hugo or another conventional generator tag	Counts against	Points to a conventional build
Nothing at all	Cannot tell	Traces can be removed or never existed

The fingerprints, builder by builder

These are the builders Kitsuvo's rules name, with the traces each rule tests for. Hosting domains match the address and any file the page loads from them. Text badges such as Made with Bolt count only when the text is a link to the builder's own site, so a page that merely quotes a badge does not match. Entries marked weaker evidence carry 35 points or fewer in the rules, against 40 to 55 for most builder hosting.

Builder	Hosting domains	Source and script traces	Headers and generator tag
Lovable	lovable.app, lovableproject.com, gptengineer.app, lovable.run, lovable.sh	data-lov-id attributes, lovable-tagger, cdn.gpteng.co and gptengineer.js scripts, /lovable-uploads/ images, /~flock.js, the LOV_SELECTOR_SCRIPT_VERSION global, an Edit with Lovable link, the default Lovable Generated Project description, default author and twitter:site tags, a social image on lovable.dev or gptengineer.app	Generator tag naming Lovable or GPT Engineer
Bolt	bolt.host, bolt.new	A Made with Bolt, Built with Bolt or Made in Bolt link, a bolt.new/?rid referral link, the bolt.new/badge.js script	x-powered-by header containing bolt.new; generator tag naming Bolt
v0	vusercontent.net, v0.app, v0.build	A Built with v0 link, the untouched v0 App title, a Created with v0 or Generated by v0 description	Generator tag naming v0
Base44	base44.app, base44-sandbox.com	Requests to app.base44.com, a default apple-mobile-web-app-title of Base44	None tested
Replit	replit.app, replit.dev, repl.co (weaker evidence)	The replit-dev-banner script, a replit-badge element	replit-cluster header; expect-ct header naming .repl.it; generator Replit Agent
Manus	manus.space	A Made with Manus link	None tested
Emergent	emergentagent.com, emergent.host, emergent.cloud	A Made with Emergent link, an emergent-badge element, assets.emergent.sh	None tested
Gamma	gamma.site	assets.gammahosted.com, a gamma-badge element, the gammasiteanimationsinitialized global	x-super-powered-by header containing gamma
Mocha	mocha.app, mochausercontent.com, mocha-sandbox.dev	Hosting only	None tested
Rocket	builtwithrocket.new, rocketpreview.app	Hosting only	None tested
Leap	lp.dev	Hosting only	None tested
Macaly	macaly.app, macaly-app.com	A Made with AI in Macaly link, cdn.macaly.app	None tested
Magic Patterns	magicpatterns.app, magicpatternsapp.com	Hosting only	None tested
Create (Anything)	created.app	Hosting only	None tested
Figma Make	figma.site (weaker evidence)	Hosting only	None tested
Durable	durable.co	cdn.durable.co	Generator tag naming Durable
Same	None tested	same-assets.com	None tested
B12	None tested	cdn.b12.io (weaker evidence)	None tested
Dyad	Self-hosted, so none tested	data-dyad-id and data-dyad-name attributes, a Made with Dyad link, the dyad-generated-app title	None tested
Google AI Studio	None tested	An aistudiocdn.com import map, the My Google AI Studio App title	None tested
Hostinger Horizons	None tested	None tested	x-generator header or generator tag naming Hostinger Horizons
10Web AI	None tested	None tested	Generator tag naming 10Web (weaker evidence)

Coding agents are handled separately. A generator tag whose whole value is Claude Code, OpenAI Codex, Cursor Agent, Replit Agent, Cline, Roo Code or Aider, or a <meta name="ai-built" content="true"> tag, is read as the publisher's own declaration. It is unverified, and it sets a floor on the score instead of proving anything.

Header rules apply where the browser's web engine hands the response headers over, which in Kitsuvo is on Windows. Everything else in the table is read from the page and what it loads.

Check it yourself in a minute

1. Read the address and the tab title. A builder domain from the first column of the table is the strongest single check.
2. View the source with Ctrl+U on Windows or Option+Command+U on a Mac, and search for a few strings: data-lov-id, gptengineer.js, badge.js, base44, generator.
3. Open the Network tab in developer tools (F12), reload, and look at the first request's response headers and at which domains the page calls.
4. Write down what you found, not what it looks like. A match from the table is evidence. A gradient is not.

The per-builder guides give the exact trail for each one: Lovable, Bolt, v0, Base44 and Replit, with Manus, Gamma and Figma Make in one guide. The quick reference is which AI builder made this website, and the side-by-side is Lovable vs Bolt vs v0.

What is not a fingerprint

Several things show up on AI-built sites and on hand-built ones. Kitsuvo's rules give them small weights, and a page cannot reach Likely AI-built on them alone: with no builder fingerprint, scaffold leftover or placeholder content, the score is capped at 69.

• Component kits: shadcn/ui classes, Radix, Lucide icons and Sonner toasts. Four or more together count a little as a starter kit. See is shadcn/ui a sign of AI?
• Design habits: purple or indigo gradients, glass cards, emoji headings. See why AI-generated websites look the same.
• Generic hosts: vercel.app, netlify.app, pages.dev, onrender.com and up.railway.app score 6 points against 55 for lovable.app, because many people deploy there.
• Copy: marketing phrases and placeholder names add a little, and cannot name a builder. See signs of AI-written website copy.

Tools that do this for you

If you would rather not read source, a detector does the same matching. Kitsuvo does it for every page you open and names the builder in the address bar. Web checkers do it for a pasted link; seven detectors are compared, and the differences between kinds of tool are in AI website detector tools compared. The general method, with the six checks, is in how to tell if a website was made with AI.

None of this tells you whether a site is safe. Built with an AI builder is context, and impersonation is the danger; see how to spot phishing sites built with AI.