Website audits · SEO · AI-built sites

Vibe-Coded Website Audits: How to Check an AI-Built Site Before It Costs You

By LinkinGrow · November 11, 2026 · AI-assisted editorial analysis

Laptop showing a website audit checklist beside a code editor and magnifying glass — AI-generated editorial illustration; the screen is not a real audit report.

An AI tool can build a convincing website in an afternoon. Whether it is crawlable, secure, and truthful is a separate question—and that is what an audit answers.

The short answer

A vibe-coded website audit is a structured review of a site that was generated largely by prompting an AI coding tool, rather than written line by line by a developer. The goal is to confirm that what looks finished in the preview is actually crawlable, secure, accessible, fast, and accurate once real visitors, search engines, and AI answer systems arrive.

"Vibe coding" is a phrase popularized by Andrej Karpathy in February 2025 to describe building software by describing intent in natural language and accepting the generated code with little manual review. The approach is genuinely useful: it lets founders and marketers ship working pages in hours. But speed moves risk rather than removing it. An audit is where that risk gets found.

This guide is our editorial checklist. It is not a certification, and passing it does not guarantee rankings or AI recommendations.

Why AI-generated sites need a different kind of audit

Traditional audits assume a developer understood every file. With generated sites, nobody may have read the code at all. That produces a recognisable pattern of problems:

Plausible but wrong defaults. Placeholder titles, sample phone numbers, invented testimonials, or "Lorem ipsum" metadata that survived into production.
Client-only rendering. Content that appears in a browser but arrives as an empty shell to crawlers that do not execute JavaScript.
Silent security gaps. Database tables readable by anyone, API keys in browser code, or forms that write directly to storage without validation.
Drift between prompts. Each new request changes some files and not others, leaving dead links, duplicate pages, and inconsistent business facts.
Visual polish masking structure. Pages look professional while headings, labels, and alt text are missing.

None of these are unique to AI tools. They are simply more likely when generation is fast and review is optional.

The audit at a glance

Area	What to check	Typical failure in generated sites
Rendering and crawlability	Server-rendered HTML, robots.txt, sitemap, status codes	Empty HTML shell; 200 status on missing pages
Metadata	Unique titles, descriptions, canonicals, social tags per page	Same title on every route; template defaults
Content accuracy	Business facts, prices, claims, people, reviews	Invented addresses, testimonials, statistics
Security	Data access rules, secrets, form handling, dependencies	Public tables; keys in client code
Accessibility	Headings, contrast, labels, keyboard use, alt text	Divs as buttons; decorative text in images
Performance	Image sizes, script weight, interaction responsiveness	Uncompressed hero images; heavy libraries
Structured data	Valid schema that matches visible content	Schema claiming reviews or ratings that do not exist
Analytics and forms	Events fire; submissions arrive somewhere real	Contact forms that go nowhere

1. Rendering and crawlability

Start with what a crawler actually receives. Fetch each important URL without a browser (for example with curl) and confirm that the main heading, body text, and links are present in the raw HTML. Google can render JavaScript, but its own documentation describes rendering as a separate, deferred step, and many AI crawlers do not run scripts at all.

Then check:

Status codes. A missing page should return 404 or 410, not a 200 "page not found" screen. Soft 404s waste crawling and confuse indexing.
robots.txt. Make sure it does not block the whole site—a common leftover from staging—and that it reflects a deliberate decision about crawlers such as Googlebot, OAI-SearchBot, and GPTBot. OpenAI documents its crawlers separately, so access can be set per purpose.
Sitemap. It should list only canonical, indexable URLs and update when pages are added.
Internal links. Navigation should use real links, not click handlers on non-link elements.

2. Metadata and page identity

Generated projects often ship one title and description for the entire site. Every shareable page needs its own title, meta description, canonical URL, and Open Graph tags. Look specifically for framework or tool defaults left in place, duplicate titles across routes, and canonicals pointing to the wrong host (for example a preview domain instead of the live domain).

3. Content accuracy: the most important check

This is where generated sites carry the highest reputational risk. Language models fill gaps with plausible inventions: a phone number, an "established 2015", a client logo wall, a five-star testimonial from a person who does not exist.

Review every page against a written fact sheet:

Company name, address, phone, email, and founding details
Prices, plans, guarantees, and refund terms
Names, roles, and credentials of people shown
Statistics and research claims, each traced to a source
Testimonials and reviews, each traced to a real customer with permission

Invented reviews are not a style problem. The FTC's rule on consumer reviews and testimonials, effective October 2024, prohibits fake reviews and testimonials, including those generated by AI. Remove anything you cannot substantiate.

Accuracy also matters for AI discovery. AI answer systems summarise what they find; if your site states the wrong service area, that error can be repeated back to buyers.

4. Security and data handling

Generated apps frequently connect to a database or backend in minutes, and the access rules are where mistakes hide. Check:

Data access rules. Every table should allow only the reads and writes a visitor legitimately needs. Try reading data while signed out.
Secrets. Private API keys must live on the server, never in browser code. Search the built JavaScript for key-like strings.
Forms. Submissions should be validated on the server, rate-limited, and protected against spam.
Authentication. Admin areas must check roles on the server, not just hide a button.
Dependencies. Run a dependency scan and patch known critical vulnerabilities.

The OWASP Top 10 remains a sensible baseline; broken access control sits at the top of its 2021 list.

5. Accessibility

Visual polish says little about whether a site works with a keyboard or screen reader. Check heading order (one H1, logical H2s), colour contrast, form labels, focus states, descriptive link text, and alt text on meaningful images. The WCAG 2.2 guidelines are the reference standard. Automated tools catch only part of the problem, so test key flows manually with a keyboard.

6. Performance

Generated sites tend to include large images and libraries added for one small effect. Measure with field data where possible. Google's Core Web Vitals—including Interaction to Next Paint, which replaced First Input Delay in March 2024—are a practical target. Compress and size images, lazy-load below-the-fold media, and remove unused packages.

7. Structured data

Schema markup should describe what is visibly on the page, nothing more. Generated sites sometimes include Review or AggregateRating markup with invented numbers, or Organization data that contradicts the contact page. Validate with Google's Rich Results Test and compare every property against visible content. Google's structured data guidelines treat misleading markup as a policy violation.

8. Analytics, forms, and conversion paths

Finally, confirm that the business actually receives what the site promises. Submit every form and confirm delivery. Click every call to action. Check that analytics records page views and key events once, not twice, and that consent requirements are respected.

A worked example (fictional)

Pinecrest Mobile Detailing is an invented business used for illustration. The owner built a site in an afternoon with an AI tool. It looked excellent. An audit found:

Every page shared the title "Premium Car Care".
Three testimonials and a "4.9 from 300 reviews" badge had been generated, not collected.
The booking form wrote to a database table that any visitor could read, exposing customer phone numbers.
The service-area page listed two towns the business does not serve.
The robots.txt still disallowed everything from an early test.

Fixing these took roughly a day. None required redesigning the site. The most serious issue—the exposed table—was invisible in the preview.

How often to audit

Audit once before launch, then again after any significant batch of prompted changes. Because each generation can touch many files, a light monthly check (status codes, metadata, forms, data access, fact sheet) catches drift early. Keep a short log of what was checked and what changed; that log is more useful than a one-off report.

Common mistakes

Treating the preview as proof the live site works.
Asking the same AI tool "is my site secure?" and accepting a yes without testing.
Fixing visual issues while ignoring the raw HTML.
Leaving invented content in place "for now".
Adding schema to claim ratings you have not earned.

Frequently asked questions

Are vibe-coded websites bad for SEO?

Not inherently. Search engines evaluate the output, not how it was produced. Problems come from unreviewed defaults, client-only rendering, and inaccurate content—all fixable.

Does Google penalise AI-generated websites?

Google's guidance on generative AI content says using AI is not against its guidelines; using it primarily to manipulate rankings or mass-produce low-value pages is.

Can an AI tool audit its own site?

It can help—running scans, listing pages, flagging missing metadata. But a human should verify facts, test security as a signed-out visitor, and make final decisions.

What is the single most important check?

Content accuracy, followed closely by data access rules. One damages trust publicly; the other can expose customers.