Built your site with AI?Check these three things today.
Sites built with AI tools like Lovable, Bolt, v0, Replit and Wix AI usually look finished but often ship with three specific faults: a contact form that reports success without sending email, payment keys left in test mode, and configuration files left publicly readable. SiteHealth checks for all three every hour, plus email deliverability, certificate expiry and search visibility, and explains each fix in plain words.
Why AI-built sites fail quietly
AI site builders are very good at producing a page that looks finished. The parts that are hard to see — sending an email, taking a payment, hiding a config file — are the parts that are usually left half-done. Nothing on screen tells you, because the page still looks perfect.
The three faults we see most
- 1
The contact form is a picture of a contact form
It shows a thank-you message, but no email is ever sent. Sometimes there is no mail code at all; sometimes it sends from an address the server is not allowed to use, so the mail is silently dropped. We test it by actually using it.
- 2
Payment keys are still in test mode
The checkout works perfectly for you and fails for every real customer, because the site is running on test keys. Worse, a secret key is sometimes left in the page source where anyone can read it. We check for both.
- 3
Configuration files are publicly readable
Files like
.envandconfig.phphold your database password and API keys. On many AI-built deployments they can simply be downloaded. We try the common paths ourselves and tell you which ones answered.
Works with whatever you built it in
We check the finished website from the outside, the way a visitor sees it. That means it does not matter whether you used Lovable, Bolt, v0, Replit, Wix AI, WordPress, Squarespace, Webflow or hand-written code. There is nothing to install.
People also ask
How do I know if my contact form is working?
Send yourself a message through it from your phone, using mobile data rather than your office wifi, and check the spam folder too. A form that shows a thank-you page has only proved the page loaded, not that the email was delivered. Automated hourly testing catches the day it silently stops.
Why do my emails go to spam?
Almost always because your domain is missing SPF, DKIM or DMARC records, which are the three DNS entries that prove your mail is really from you. Mail sent by a website form is the most common casualty, because the site often sends using an address it is not authorised to use.
How often should a small business website be checked?
Hourly is the practical standard. Most silent failures — an expired certificate, a form that stops delivering, a hacked page — do their damage in the hours before anyone notices. A daily check can still miss most of a working day.
What is a good website health score?
Above 90 means nothing is broken and only small improvements remain. Between 70 and 90 means the site works but something is costing you visitors. Below 50 usually means at least one thing is actively broken, such as a failing form or an expired certificate.