Most vibe coded websites tell on themselves, through the badge in the corner, the domain they sit on and the scripts the builder injects into every page. We know because we built a free checker that fingerprints them, and to build it we had to work out exactly what Lovable, Bolt, v0 and Replit leave behind. What follows is the manual version, seven signs you can run yourself, ordered easiest first, and most of them take under a minute.

It is worth defining the term before we start. Vibe coding is building software by describing it to an AI and accepting what comes back, which produces real code on real hosting, and that is what separates it from Wix or Squarespace. I come back to that difference lower down, because plenty of people conflate the two.

The badge in the corner

The free tiers of most AI builders stamp their work, so you get an "Edit with Lovable" tab floating in the bottom right corner, a "Made in Bolt" mark pinned to an edge, or a "Built with v0" line in the footer. If the badge is there you are done, because that is the builder naming itself.

It comes with two caveats, since paid plans usually let owners remove the badge, so its absence proves nothing, and a badge is only page content that anyone could paste onto a hand-built site as a joke. Nobody actually does that, but it still keeps a badge one rung below the technical markers on the evidence ladder.

The domain gives it away

Every builder gives new apps a subdomain on its own infrastructure, so Lovable apps live on lovable.app addresses, Bolt deploys to bolt.host, Replit to replit.app or repl.co, and Base44 to base44.app. A business running its actual site on one of these has shipped the preview link, which itself says something about how the project went.

Once a custom domain is connected the sign disappears, and that is when you move to the page source.

Builder scripts left in the source

Right click the page, choose View Page Source, and search for the builder's plumbing. This is the strongest evidence you can get from the outside, because it is injected by the platform rather than typed by a person, and it survives the move to a custom domain.

These are the markers our own ruleset matches on. Lovable apps load a runtime script from cdn.gpteng.co, and newer ones carry platform scripts at /__l5e/ and ~flock.js on the site's own domain, while Base44 apps ship a reference to the @base44/sdk package wired to their backend. Find any of these and the builder is identified, whatever domain the site sits on.

Leftover paths and meta tags

Stay in that same page source view for three more searches. Lovable stores every uploaded image under /lovable-uploads/, and in practice that path is the most durable of Lovable's markers, because owners strip badges and scripts but never rehost their images. Lovable also writes a meta tag named lovable-tagger into the head, and some builders fill the standard generator meta tag with their own name, which is the site politely telling you who made it.

A nearly empty page source

Hand-built business sites usually render their content on the server, so the page source is full of readable text. The default output of Bolt, Lovable and v0 is a client-rendered app, and its page source is close to empty. What you find is a single div with id="root", a script loading /assets/index-[something].js and not much else, because all the real content arrives after JavaScript runs.

An empty shell plus that /assets/ bundle path is the signature of a Vite single page app, which is what these builders generate. It is not proof on its own, because hand-built SPAs exist, but it is the point where the next sign starts to count.

The default look

You have probably seen this website before, because it has a dark background, a headline with a purple to blue gradient sliding through it, pill-shaped buttons, rounded corners on everything, Inter or Geist for the font, and the same icon set, Lucide, on every card. AI builders lean on the same component library, shadcn/ui, and the same visual defaults, so their output converges on one look.

Be careful with this one, because half the hand-built web uses the same kit, including sites by teams who simply like shadcn. Our checker only counts aesthetic cues after the page has already shown itself to be a client-rendered shell, and even then it never names a builder from looks alone, so treat the default look as a reason to check the source rather than a verdict.

Comments the AI left behind

The last sign surprised us when we ran the ruleset against a control set of hand-built sites, because the cleanest separator turned out to be HTML comments that build tooling strips on the way to production, which is why those sites served zero. AI-written static pages that someone deployed by hand keep the comments, and they are unmistakable once you know the shape of them. You get section labels, a comment reading Hero or Testimonials sitting above each block, decorative divider comments, and emoji scattered through the markup. An AI writes those for its own navigation, and a person who does not read code never knows they shipped.

What proves nothing

Two false positives are worth naming, because both get thrown around as gotchas.

The tech stack. React, Vite and Supabase power an enormous amount of carefully hand-built software, so a Supabase key in the page source is Tuesday, not evidence. Our checker records stack as a footnote and gives it zero weight in the verdict, and anyone who tells you "it uses React so it is vibe coded" is guessing.

Website builders. Shopify, Wix, Squarespace, Webflow and WordPress sites are built from templates in an editor, which is no-code, a different thing entirely that long predates AI, so calling a Squarespace site vibe coded is just wrong.

The catch

A site with none of these markers can still be AI-built, because anything made with Cursor, Claude Code or Windsurf leaves no fingerprint at all, since those tools write code into a normal repository that deploys like any hand-built project, and owners can strip every marker above with a single prompt. So the signs only run in one direction, where their presence identifies a builder but their absence tells you nothing. We wrote that rule into our checker, and it applies just as hard to manual checking.

Check it in ten seconds

If you would rather not read page source, the checker does all of the above in one pass and shows its evidence, tiered from builder-owned markers down to weak aesthetic cues, so you can see why it reached its verdict rather than taking our word for it.

And if the site you are checking is your own, the interesting question is not which tool built it but what the tool left unsecured. Veracode's testing puts security flaws in roughly 45% of AI-generated code, and we keep finding the same three in Australian apps, exposed keys, missing rate limits, over-privileged database roles. A free security check will tell you where yours stands, and if it turns up problems, the audit is how we fix them properly.