I write code with AI every day and I am not about to tell you it is bad. That is exactly why I can see the line clearly: where a model saves you weeks, and where it creates a problem that surfaces six months later and costs more than building properly would have. Over the past year several clients have come to me with "a website the AI made in an evening", and the pattern repeats.
Here is what breaks, what it looks like from the business side, and when generation is actually the right call.
Why the site looks fine
That is the trap. A generated site looks respectable: neat grid, modern type, animations, responsive layout. The owner opens it on a phone, things move, buttons click, so it must be done.
The catch is that the visible part is 20% of the work. The other 80% - the part you pay a developer for - does not show up on any screen: how the page is served to a crawler, what happens to form data, who can reach your database, how heavy the page is on 4G in Kraków, what happens when the catalogue grows from 5 products to 500.
What breaks on security
The most expensive category. A model writes code that works; it does not write code that is protected, unless explicitly asked - and a business owner does not know what to ask for.
What I have actually found in real projects:
- Access keys in client-side code. A database or payment token sitting in JavaScript that every visitor downloads. Ten seconds to find in a browser.
- Row-level security switched off. The "let's disable it for now so it works" line stays forever. Result: anyone can read the table with your leads and customer phone numbers.
- Forms with no validation or rate limits. A week after launch the CRM fills with spam and email arrives spoofed from someone else's address.
- File uploads with no type checks. The classic route for getting anything at all onto your server.
- No protection on the admin area. The management screen is reachable by direct URL because "we'll add a password later".
The uncomfortable part is that nobody learns about this from an audit - they learn from the consequences: leaked customer contacts, spam sent from your domain, an email from the hosting provider. Under GDPR, a personal-data leak means notifying a supervisory authority, which I covered in website security and GDPR.
What breaks on SEO
Second most common, first for quiet damage: the site simply never appears in search and nobody understands why.
Headings written to read well, not to signal. The H1 says "We build the future", while the service name and city appear nowhere. To a crawler the page is about nothing.
Metadata empty or identical everywhere. A Home | My App title across ten pages in a row.
No structured data. No Organization, no LocalBusiness, no FAQ, no Product. Which means no rich results and no clean machine understanding of who you are - and that now directly affects whether you appear in AI answers, as I covered in the piece on GEO.
Everything rendered in the browser. Many generators ship an empty HTML shell filled in by script. Search engines cope with that some of the time; AI crawlers frequently do not cope at all.
No sitemap, robots.txt written by guesswork, and sometimes a leftover noindex from the preview build. I have seen that twice.
Multiple languages via a switcher with no hreflang. Language versions compete with each other instead of reinforcing each other. How it should work is in multilingual website for business.
What breaks on speed and budget
A generator pulls in everything: a heavy animation library for one effect, six font weights, images at original phone-camera resolution. On home wifi you notice nothing; on mobile data the page takes four seconds and half your visitors leave before they see the offer. What to do about it is in why your website loads slowly.
There is a separate line item: advertising. If you push Google Ads traffic to a slow page with no proper analytics, you pay for clicks that never become enquiries and you cannot even see it in reports, because nobody configured conversion events.
What breaks in maintenance
The most frustrating part shows up months later, when something needs to change.
The code was generated in chunks, there is no single architecture, and the same logic is duplicated in five places. Dependencies are pinned to whatever versions existed the day the site was built, and six months on an update breaks half the pages. There is no documentation. The first question from any developer handed this project is "can I rewrite it?" - and that is an honest answer, because untangling someone else's generated code is often more expensive than building it again.
In money terms: you saved €2,000 on the build, then eight months later paid €3,500 for a rebuild and lost the ranking you had been accumulating the whole time.
When generation is the right choice
It is not all one-sided, and I use these tools constantly. A generated site works well when:
- You need to validate an idea and see whether demand exists before spending real money.
- You need an internal tool for the team that is not indexed and holds nothing sensitive.
- You need a one-page placeholder for a specific event, live for two weeks.
- You are a developer and know exactly what you are fixing after generation.
In all of those, speed beats durability and the trade is sound.
The bad trade is when a generated site becomes your main sales channel. Then you are building a business on a foundation nobody ever checked.
What to do if your site is already like this
You do not have to throw it away. The order I work in:
- A one-day audit. Leaked keys, database permissions, forms, indexing, speed, structured data. Output: a prioritised list of problems with clear pricing.
- Close the holes. Security and leaks get fixed first, always. Usually 1-2 days.
- Repair the SEO base. Headings, metadata, schema, sitemap, server rendering for the key pages. Effect visible in 3-6 weeks.
- Decide on architecture. If the site is small and the logic is thin, rewriting on a solid stack is cheaper. If the project has grown, extract it piece by piece.
Sometimes the right answer is to leave it running and build a proper version in parallel, without rushing. That is a legitimate option too; I have done it.
How I build sites
I use AI as an accelerator, but architecture, security, structured data and performance go in by hand, because that is what people are actually paying for. I build websites on Next.js: server rendering, schema markup, hreflang across four languages, sub-second loads, forms with validation and protection, analytics with conversions properly configured. Online stores come with clean product data, Poland-ready payments and a catalogue structure both search engines and AI assistants can read.
Timeline is 2-3 weeks for a marketing site. Pricing sits in the development cost guide. If you already have a generated site and want to know what is wrong with it, get in touch and I will tell you honestly whether it is worth repairing or cheaper to rebuild.
FAQ
Can you actually build a decent website with AI? You can build a working prototype and a good starting point, but not a production-ready commercial site. Models handle layout and standard components well, yet systematically skip everything invisible on screen: form and data protection, server rendering, structured data, image optimisation, correct indexing. With a developer alongside filling those gaps, the result is solid and arrives faster. Without that person, you get an attractive shopfront with no foundation.
How do I tell my site is badly built if it looks fine?
A quick self-check takes twenty minutes. View page source and see whether there is text in it or just an empty shell. Compare title and description across pages - they should differ. Run the site through PageSpeed Insights on mobile. Search site:yourdomain in Google to see what is indexed. Check robots.txt for a stray noindex. If two or more of those come back badly, it is worth looking deeper.
What does it cost to rebuild a generated site? Depends what you are salvaging. Emergency security and SEO repair is usually €400-900, which is 1-3 days of work. A full rebuild of a small site on a proper stack starts at €1,200. A store starts at €3,000. The second option is often better value: generated code is hard to maintain, and every subsequent change costs more than it would on a clean codebase.
Is it true that Google demotes AI-built websites? Google does not penalise the use of AI as such; it penalises unhelpful content and technical problems. The issue is that generated sites tend to have exactly those: empty generic copy, duplicated metadata, missing schema, browser-only rendering. Formally the cause is not AI, practically the outcome is the same - the pages do not rank. Fix the technical side and write substantive copy, and the origin of the code stops mattering.
Which is safer: a builder like Wix or AI generation? A builder is safer technically, since the platform handles updates, hosting and protection. In exchange you hit a ceiling on speed, customisation and finer SEO control, and you pay monthly. Generation gives more freedom but hands you full responsibility for security and optimisation. I compared builders against custom development separately in this article.
