— was it —vibe coded?

"Vibe coded" means a website was built mostly by prompting an AI tool — like Lovable, v0, Bolt, Cursor or Replit — instead of hand-writing every line of code. The term was coined in early 2024 and named Collins Word of the Year 2025.

We fetch the public HTML, robots.txt, sitemap and DNS records of a site and look for fingerprints left by AI builders — generator meta tags, script paths, CDN URLs, DNS TXT verification strings and known CNAMEs. We also scan for visual design patterns (purple gradients, glassmorphism, Lucide icons) and component libraries like shadcn/ui that almost every AI scaffold uses. All signals combine into a confidence score.

Most AI-generated sites are client-rendered, so a plain HTTP fetch returns an almost empty page and the real signals only appear once JavaScript runs. For every scan we also load the page in a real Chromium browser on Fly.io, let it execute JavaScript and finish rendering, then read the resulting page — the same thing your own browser would see when you visit. This surfaces fingerprints that simply don't exist in the raw response, like component library markers and dynamically added attributes. Results that relied on this path are marked with a ⚡ banner.

Lovable, v0 by Vercel, Bolt.new, Cursor, Replit Agent, Base44, Same.new, Framer AI, Webflow AI, Wix Studio AI, Durable, Wegic, Windsurf, Claude Artifacts, Firebase Studio and more — plus traditional builders like WordPress, Shopify, Squarespace and Webflow.

"Vibe coded" means a platform like Lovable or Bolt generated the whole app from a prompt — that's what drives our confidence score. "AI-assisted" is different and much broader: it just means a developer used an AI coding assistant like Claude Code, Cursor or GitHub Copilot at some point while building the site by hand. When we find evidence of assistant use — a leftover CLAUDE.md file, a .cursorrules file, a commit trailer inlined into the site's JavaScript, or (rarely) the same trailer in an exposed source map — we show it in its own "Signs of AI-assisted development" section, clearly separate from the verdict above. It never adds or subtracts points from the confidence score, because a developer who reviews every line an assistant suggests produces work indistinguishable from writing it by hand — that's not what "vibe coded" means.

Common signs include: purple-to-blue gradient color schemes, heavy use of shadcn/ui components, Lucide icons throughout, glassmorphism cards with backdrop blur, gradient hero text, sparkle or rocket emojis in headings, generic AI-generated marketing copy, and a recently registered domain. Our tool checks all of these automatically.

Detection is best-effort, not forensic. Developers can customize or remove fingerprints. When Cloudflare or bot protection blocks the page fetch, we fall back to DNS records, HTTP headers and Wayback Machine snapshots. The confidence score shows how strong the evidence is — a 90% score means multiple independent signals agree.

Yes, with effort. Developers can rename asset paths, remove generator tags and use custom domains. However, DNS TXT records (like vc-domain-verify for Vercel), visual design patterns in Tailwind classes, and component library signatures are much harder to scrub. Our Wayback Machine fallback also helps detect sites that have been recently cleaned up.

Every check returns a 0–100% confidence that the site was vibe coded. A direct builder fingerprint (a real build artifact, like a Lovable script tag) is weighted far above everything else — it alone puts a site in 'likely vibe coded' territory. Design patterns, shadcn/ui, and domain age only corroborate; they can't drive the score without a stronger anchor signal already present, which is why professional sites using similar-looking modern tooling don't get flagged. Traditional builders and established or enterprise-tooled domains subtract points. The 'Why this score?' breakdown shows exactly what contributed.

Yes — we run an MCP (Model Context Protocol) server at isthatvibecoded.com/mcp exposing a single tool, check_site(url), which returns the same confidence score, detected builders and tech stack as the web form, as structured JSON. Any MCP-compatible client (Claude, Cursor, etc.) can add it as a tool. See isthatvibecoded.com/llms.txt for the full machine-readable index.

It depends heavily on how much review the developer applies. AI-generated code frequently lacks proper error handling, exposes secrets in environment variables, and produces SQL injection or XSS vulnerabilities. Security firms like Checkmarx and Databricks have published detailed analyses of vibe coding security risks. Our detector can help identify which sites may warrant a closer security look.

Yes, completely free with no signup required. You can check any public website immediately.

No. Scans aren't logged or stored — we don't record your IP address, browser, or the URLs you check. Your IP is held in memory only for a few seconds to enforce rate limits, and is never written anywhere. The only thing we ever store is feedback you explicitly submit after ticking the acknowledgement box, and that's just the URL, whether the verdict was right, and your optional comment.

Traditional development involves writing code line by line with explicit knowledge of what each piece does. Vibe coding means describing what you want in natural language and letting an AI tool (Lovable, v0, Bolt, etc.) generate the implementation. The result is often a React + Tailwind + shadcn/ui stack that shares visual patterns across thousands of sites — which is what makes detection possible.