The AI Generated Website That Nobody Could Edit Six Weeks Later

This one repeats often enough that I will describe it as a type rather than a case. A garden centre outside Carlow gets a new website in early spring. Somebody in the family feeds a description of the business into an AI tool, and about three hours later there is a site. Proper typography. Photographs in sensible places. A contact form that actually delivers. It looks like the job an agency would have charged three or four grand for, and it cost the price of an evening.

Then the wholesale price of bagged compost moves, as it does every season, and the figures on the website are wrong.

Nobody in that business can change them. Not because they are stupid, and not because the site is broken. The site is fine. It is just that what the AI handed over was a set of files, and changing a number in a set of files is a different job from changing a number on a website. So the wrong price sits there through the busiest selling weeks of the year while customers arrive quoting it at the till.

Two different things are being sold under one headline

I spent part of this morning reading through the marketing pages of the current crop of AI build tools, and the language is almost identical across all of them. Describe your business. Get a website. The tools underneath are not remotely the same thing.

The first kind generates code. You prompt it, and it writes the actual source files that make up a website, then deploys them somewhere. Lovable, Bolt and Replit are the names most business owners will have heard, and plenty of people now do the same thing directly through a general chatbot. The practice picked up the name vibe coding, which is a fair description: you describe the vibe, the machine writes the code, and you do not read much of what comes back.

The second kind generates a site inside a content management system. The AI still does the design work, still writes the copy, still picks the layout. The difference is where it puts the result. It goes into a system built for people who are not developers to edit, which means the output has an admin login, a page list and a text cursor.

Day one, these feel the same. That is the whole problem. The demo is where they are most alike and least distinguishable.

The demo is the easy part now

Let me be straight about this, because I have no interest in pretending the code generation tools are bad. They are extraordinary. The syntax quality alone is remarkable: Veracode's testing across more than 150 models has functional correctness sitting north of 95%, meaning the code these things write almost always runs. Five years ago that would have read as science fiction.

Generating a website is solved. Genuinely, properly solved.

What has not been solved is the forty years of ordinary work that comes after generation. Somebody has to change the opening hours in December. Somebody has to add the new service you started offering. Somebody has to patch the thing when a vulnerability turns up in a library you have never heard of. None of that is glamorous, none of it gets demoed, and all of it is where a business website actually lives.

What "you own the code" actually means

Code ownership sounds like the strong position. In a lot of pitches it is presented as the premium option, the grown-up choice, the thing that puts you in control rather than locked into somebody's platform.

Owning code means you own a maintenance obligation.

Back at the garden centre, the compost price is a single number sitting in a file. Changing it means opening a source file, finding the right line among several hundred, editing it without breaking the punctuation that surrounds it, and then deploying the result to production. A developer does that in ninety seconds. Somebody who runs a garden centre does not do it at all, and should not have to. The practical consequence is that every trivial edit becomes a request to somebody else, which means it either costs money or waits.

I made this mistake myself years ago. I signed off on a hand-built custom site for a client because it benchmarked faster than the WordPress alternative and I liked the numbers. Two years later the developer had emigrated and nobody could change the phone number in the footer. Speed is worth very little if the business cannot operate the thing.

The security bill nobody quotes for

This is the part I care most about, because it is the part that lands on my desk.

Veracode's Spring 2026 update to its GenAI code security research tested 80 coding tasks across four languages and found that roughly 55% of generated samples passed its security checks, a figure that has barely moved in two years. The interesting detail is where the failures cluster. Pattern-matching problems like SQL injection came in around 82%. The tasks that need the model to follow data through an application did far worse, with cross-site scripting passing at about 15% and log injection at about 13%. That is laboratory testing against deliberate prompts rather than a survey of live business websites, and it is a security vendor publishing research about a problem it sells a product for, so weigh it accordingly. As a signal about where AI-written code tends to be thin, it holds up.

The field evidence points the same way. Researchers at Georgia Tech's School of Cybersecurity and Privacy scanned more than 43,000 security advisories and confirmed 74 vulnerabilities they could trace back to AI coding tools, including command injection and authentication bypass. Eighteen of those appeared across seven months of 2025. Fifty-six appeared in the first three months of 2026, with 35 in March alone.

There is a documented case in the vibe coding space too. CVE-2025-48757, published in May 2025 and scored 9.3 critical, describes insufficient database row-level security in Lovable-generated sites, which in plain terms meant unauthenticated strangers could potentially read or write to the database behind generated applications. Lovable disputes the finding and argues that application data security sits with the customer. Both of those things are worth knowing, and the dispute itself makes the point: when the code is yours, the security is yours, whatever the tool's marketing implied.

Street level, that means the enquiry form on your site. Every name, phone number and message a customer has ever sent you sits in a database somewhere. If that spills, you are making a GDPR notification and ringing people to tell them their details are loose.

Can you take it with you?

Portability is the question business owners ask last and regret asking last.

Code generation platforms generally run on credits and subscriptions. Lovable's own pricing page describes a free tier granting five build credits a day capped at roughly thirty a month, with paid plans above that, and credits fund both the building and the hosting of what you built. Prompt your way through a redesign and you burn through them quickly. More to the point, the hosting, the database and often the login system are wired into that platform, so "export the code" and "have a working website somewhere else" are not the same achievement.

A standard WordPress site sits at the opposite end. W3Techs put WordPress at 41.2% of all websites as of 28 July 2026, and 59.1% of all sites whose content management system is known. That share is not a bandwagon argument. It is a portability argument. Roughly six in ten managed sites running on one platform means every host on earth supports it, every developer has worked with it, and moving is a migration rather than a rebuild.

The job	AI-generated codebase	AI-built WordPress site
Change a price or opening hours	Edit source, redeploy, hope	Log in, click, type, save
Security patching	Yours to track and apply	Handled at platform level
Move to another provider	Export code, rebuild services	Standard migration, any host
Ongoing cost	Subscription plus credits	Flat annual fee

Where generating code is genuinely the right call

Here is the honest limit of my argument, and it is a real one.

If what you need is a one-off internal tool, generation wins outright. A quote calculator for your own staff. A stock-checking screen that lives on an iPad in the back room. A rough prototype to put in front of a bank or an investor next month. These have no ongoing content, no non-technical editor, and no requirement to still work unchanged in three years. For that work, the code generation tools are faster and cheaper than anything else available, and I would use them myself without hesitating.

The mismatch only appears when the output is a public business website that ordinary staff need to change, indefinitely, without help.

What the second kind of AI does differently

Set the brand names aside and describe what a business owner actually needs from an AI-built website. Four things, roughly.

It should produce a real site in a system designed for non-technical editing, so a price change takes seconds rather than a support ticket. It should sit on infrastructure where somebody else is responsible for patching the stack, because you did not go into business to track security advisories. It should be portable, running on a platform other providers support, so leaving is possible. And it should have one predictable price, not a meter that runs every time you ask for a change.

That combination is what we built Web60's AI builder to deliver in under a minute: you describe the business, the AI designs and writes a full WordPress site, and what lands in your hands is a site with a login rather than a folder of files. Everything sits on Irish infrastructure with nightly backups, SSL and server-level hardening included, at €60 a year flat. Nobody bills you €75 an hour to change a compost price.

If you want the wider picture of how AI and WordPress fit together, our guide to AI-powered WordPress for business owners covers the ground properly, and the argument that owners lack the skills to run this themselves is one we took apart separately.

One honest caveat, because I do not want to oversell the alternative. A WordPress site has more moving parts than a single generated page. Plugins update, and occasionally an update conflicts with a theme, which is exactly why staging environments and one-click rollback exist and why you should verify a change on staging before pushing to production. More moving parts is the price of being editable. It is a price worth paying, but it is not zero.

Conclusion

The question worth asking is not whether AI can build your website. It can, better than most of what was being sold for four thousand euro a few years ago, and anyone still arguing otherwise has not looked recently.

The question is what the AI hands you at the end of the afternoon.

If the answer is a codebase, you have acquired an asset and a job. If the answer is a site you can log into, you have acquired an asset. Before you commit either way, run one small test: ask the tool to change a single price on a page you have already built, and watch what happens next. Whatever that takes, that is what every future change will take.

Somebody in your business needs to be able to fix a wrong number in a season. Pick the tool that lets that person be you.

Frequently Asked Questions

Can AI really build a business website on its own?

Yes, and the output is genuinely good. The question that matters is what the AI hands you at the end. Code generation tools hand you a codebase, which needs a developer to change. AI website builders that produce a WordPress site hand you a site with an editor, which you can change yourself. Both are AI. Only one of them leaves you able to update your own prices.

What is vibe coding?

Vibe coding is the practice of describing what you want in plain English and letting an AI write the underlying code, without reading or reviewing much of it yourself. Tools like Lovable, Bolt and Replit popularised the approach. It works well for prototypes and internal tools. It creates a maintenance problem when the result is a public business website that non-technical staff need to update.

Is AI generated code less secure than hand-written code?

Independent testing suggests it is weaker in specific areas rather than uniformly worse. Veracode's Spring 2026 GenAI Code Security update found roughly 55% of AI-generated samples passed its security tests, with cross-site scripting and log injection tasks passing at around 15% and 13%. That is lab testing rather than a survey of live sites, so treat it as a signal about where to look, not a verdict on any one tool.

How do I update an AI generated website if I am not technical?

If it was generated as raw code, you go back to the tool, prompt it again, and redeploy, hoping nothing else moves. If it was generated as a WordPress site, you log in, click the text, type the new figure and save. Before you commit to any AI tool, ask it to change something small and watch how that goes.

Can I move an AI generated website to a different hosting provider?

It depends entirely on what was generated. Code generation platforms usually let you export a repository, though the result often depends on services wired into that platform. A standard WordPress site is portable by design, because roughly six in ten sites running a known CMS use WordPress and every host supports it. Portability is worth checking before you build, not after.

Sources

W3Techs, usage statistics and market share of WordPress

Veracode, Spring 2026 GenAI Code Security Update

Georgia Tech Research News, Bad Vibes: AI-Generated Code is Vulnerable, Researchers Warn

NIST National Vulnerability Database, CVE-2025-48757