How to tell if a website was made with AI

If you want to know how to tell if a website was made with AI, start below the design. In 2026 a site built in an afternoon with Lovable, Bolt or v0 can look as polished as one an agency spent a month on. The look has converged: the same rounded cards, the same soft gradients, the same three-column feature grid. What still differs is the plumbing, and AI builders leave their own plumbing behind.

This guide walks through six checks in the order we would run them, from the quickest to the most technical. None of them needs special tools. Each one says how strong the evidence is, because the honest answer to "was this made with AI?" is usually a weight of evidence, not a yes or no.

1. Read the address

Most AI app builders publish new projects on a subdomain they own. If the address ends in one of these, the site was almost certainly published from that builder:

• Lovable: *.lovable.app, *.lovableproject.com, *.gptengineer.app
• Bolt: *.bolt.host, *.bolt.new
• v0: *.vusercontent.net, *.v0.app
• Base44: *.base44.app
• Replit: *.replit.app, *.replit.dev
• Others: *.manus.space (Manus), *.gamma.site (Gamma), *.figma.site (Figma Make), *.mocha.app (Mocha), *.emergent.host (Emergent)

Strength: strong. A builder's domain says where the site was published, which is about as direct as evidence gets. Replit is the exception worth noting: plenty of people write code by hand on Replit, so its domains count for less.

Generic free hosting such as *.vercel.app, *.netlify.app or *.pages.dev is a much weaker hint. Lots of AI-built projects ship there, and so do lots of hand-built ones.

2. View the page source

Press Ctrl+U on Windows, or Option+Command+U on a Mac, to open the page source. Then search it (Ctrl+F or Command+F) for these strings:

• gptengineer.js or cdn.gpteng.co: the Lovable runtime script. Lovable was called GPT Engineer before it renamed itself.
• data-lov-id: attributes Lovable's component tagger adds to every element in preview builds.
• /lovable-uploads/: images uploaded through the Lovable editor.
• bolt.new/badge.js, or the text Made with Bolt: Bolt's badge.
• <meta name="generator"> naming a builder, such as v0 or Lovable.
• app.base44.com: calls to the Base44 runtime.
• data-dyad-id: Dyad's component tagger.

Strength: strong. These strings exist because a builder put them there. A person writing their own site has no reason to load gptengineer.js.

One caution: many single-page apps send almost empty HTML and build the page with JavaScript. If the source looks bare, open the developer tools (F12) and search the Elements panel instead, which shows the page as it is now.

3. Look for scaffold leftovers

Builders start every project from a template, and people often forget to change the template's defaults. Check:

• The tab title. Titles like Vite + React + TS, Lovable App, v0 App, My Google AI Studio App or Create Next App are template defaults.
• The meta description. Lovable Generated Project and Generated by create next app both turn up on live sites.
• The share image. Paste the address into a chat app or a social post preview. A generic builder card instead of the site's own image is a giveaway.
• The favicon. The stock Vite lightning bolt, or the builder's own icon, in the browser tab.

Strength: medium to strong. A default that names the builder (Lovable App) is close to a fingerprint. A generic Vite or Next.js default only says someone started from a common template, which hand coders do too.

4. Recognise the component kit

Most AI builders generate React with Tailwind CSS and the shadcn/ui component library, often with Radix UI underneath. In the page source this shows up as class names like text-muted-foreground, bg-card text-card-foreground and ring-offset-background, and attributes like data-state="open".

The visual version: a purple-to-pink gradient behind the hero, a pill-shaped badge above the headline, three feature cards with an icon each, and toast notifications that slide in from a corner.

Strength: weak on its own. shadcn/ui is popular with human developers too; technology trackers count it on hundreds of thousands of sites. Use it to support a stronger signal, never as the main reason.

5. Check the response headers

Open the developer tools, go to the Network tab, reload, and click the first request (the page itself). Under Response Headers, look for:

• x-powered-by: Bolt.new
• x-generator: Hostinger Horizons
• x-super-powered-by naming Gamma
• replit-cluster, set by Replit hosting

Strength: strong. Headers come from the hosting, so they survive even when the page itself has been tidied up. This check matters most on custom domains, where the address tells you nothing.

6. Read the words

Language models have favourite phrases, and AI builders write a site's first draft of copy with them. Watch for clusters of elevate your, unlock the power of, seamlessly, cutting-edge, effortlessly and take your business to the next level, and for placeholders nobody replaced: John Doe, Jane Smith, Lorem ipsum, Your Company.

Strength: weak. Marketing writers used these phrases long before chatbots. What counts is density, several per paragraph across the whole page. We cover this in detail in the phrases that give away AI-written website copy.

Putting the evidence together

Treat the checks like a case file, not a quiz. A useful rule of thumb:

What you found	A fair conclusion
A builder domain, runtime script or header	Likely AI-built, and you can usually name the builder
Builder-named defaults, plus the component kit	Likely AI-built
Generic template defaults, the component kit and AI-style copy	Possibly vibe coded
Only the component kit, or only the copy	No strong AI signs

Absence of evidence is not proof of a human author. A team can export a Lovable project, delete every trace and host it on their own domain. That is why "no strong AI signs" is the honest label for a clean result, not "human-made". The builder-by-builder list of what each check looks for is in how to tell if a website was built with an AI builder.

It also helps to remember that built with AI is not the same as bad. A bakery's Lovable site is just a bakery's website. The question that matters for your safety is different: is this site pretending to be someone else? We cover that in how to spot phishing sites built with AI builders.

Why AI text detectors won't answer this

It is tempting to paste a site's text into an AI writing detector. We don't recommend it. Those tools guess at who wrote a passage, and they misfire often: a Stanford study found that popular detectors labelled more than half of essays by non-native English writers as AI-generated. Marketing copy is short and formulaic, which makes it harder still.

The checks above work better because they look at how a site was built rather than how it reads. A builder's script in the source is a fact, not a guess.

Checking every site automatically

Running six checks by hand is fine for one suspicious site. It does not scale to everything you open in a day. That is the job we built Kitsuvo, our no-AI web browser, to do. It runs on Mac and Windows, checks every page as it loads, adds the signs up into a score from 0 to 100, names the builder when it can, and lists the evidence so you can check its work. Turn on filtering and likely AI-built sites drop out of your searches. It runs on your computer and sends nothing about your browsing to us.