— was it —vibe coded?

"Vibe coded" means a website was built mostly by prompting an AI tool — like Lovable, v0, Bolt, Cursor or Replit — instead of hand-writing every line of code. The term was coined in early 2024 and named Collins Word of the Year 2025.

We fetch the public HTML, robots.txt, sitemap and DNS records of a site and look for fingerprints left by AI builders — generator meta tags, script paths, CDN URLs, DNS TXT verification strings and known CNAMEs. We also scan for visual design patterns (purple gradients, glassmorphism, Lucide icons) and component libraries like shadcn/ui that almost every AI scaffold uses. All signals combine into a confidence score.

When a site blocks the normal HTTP fetch — Cloudflare challenges, bot protection, or pages that require JavaScript to render — we fall back to a real Chromium browser running on Fly.io. It visits the page exactly like a human user: executing JavaScript, waiting for the DOM to hydrate, then capturing the full rendered HTML. This lets us detect fingerprints that are invisible in a raw fetch (React component trees, dynamically injected data attributes, client-rendered generator tags). Results that used this path are marked with a ⚡ banner.

Lovable, v0 by Vercel, Bolt.new, Cursor, Replit Agent, Base44, Same.new, Framer AI, Webflow AI, Wix Studio AI, Durable, Wegic, Windsurf, Claude Artifacts, Firebase Studio and more — plus traditional builders like WordPress, Shopify, Squarespace and Webflow.

Common signs include: purple-to-blue gradient color schemes, heavy use of shadcn/ui components, Lucide icons throughout, glassmorphism cards with backdrop blur, gradient hero text, sparkle or rocket emojis in headings, generic AI-generated marketing copy, and a recently registered domain. Our tool checks all of these automatically.

Detection is best-effort, not forensic. Developers can customize or remove fingerprints. When Cloudflare or bot protection blocks the page fetch, we fall back to DNS records, HTTP headers and Wayback Machine snapshots. The confidence score shows how strong the evidence is — a 90% score means multiple independent signals agree.

Yes, with effort. Developers can rename asset paths, remove generator tags and use custom domains. However, DNS TXT records (like vc-domain-verify for Vercel), visual design patterns in Tailwind classes, and component library signatures are much harder to scrub. Our Wayback Machine fallback also helps detect sites that have been recently cleaned up.

Every check returns a 0–100% confidence that the site was vibe coded. Each detected signal contributes points: a direct builder fingerprint adds +40, shadcn/ui adds +20, visual design patterns add +15 each, a brand-new domain adds +15. Traditional builders subtract points. The 'Why this score?' breakdown shows exactly what contributed.

It depends heavily on how much review the developer applies. AI-generated code frequently lacks proper error handling, exposes secrets in environment variables, and produces SQL injection or XSS vulnerabilities. Security firms like Checkmarx and Databricks have published detailed analyses of vibe coding security risks. Our detector can help identify which sites may warrant a closer security look.

Yes, completely free with no signup required. You can check any public website immediately.

Traditional development involves writing code line by line with explicit knowledge of what each piece does. Vibe coding means describing what you want in natural language and letting an AI tool (Lovable, v0, Bolt, etc.) generate the implementation. The result is often a React + Tailwind + shadcn/ui stack that shares visual patterns across thousands of sites — which is what makes detection possible.