We measured AI-built websites.

The short version

• Their first HTML is often empty: on 45 per cent of the sites we measured, the page holds fewer than 50 words before JavaScript runs. A browser or AI bot that does not run JavaScript sees these pages as almost blank.
• They load slowly: the median PageSpeed Insights mobile score is 76; the largest content takes a median 5.8 seconds to appear (LCP), and only 25 per cent stay below Google’s "good" threshold of 2.5 seconds.
• Accessibility errors are common: the automated accessibility check found no violations on only 23 per cent; 68 per cent have insufficient color contrast.
• They connect to other servers: 95 per cent send a request to a server on another domain on first load. 8 of the 40 sites set analytics or advertising cookies before the visitor touches anything.
• Security headers come out in a single color: HSTS is present on all of them, a content security policy (CSP) on none. The result is the same on every site of each tool, so it is the platform’s server setting, not the site’s.

How the sample was built

Tools such as Lovable, Base44, Bolt, Create and Mocha can publish a site on a subdomain of their own domain (like project-name.lovable.app). These addresses are public and appear in Common Crawl’s regular crawls. In the URL index of the September and October 2026 crawls we found 11,770 sites on the subdomains of these five tools: Lovable 9,986, Base44 1,696, Create 60, Bolt 28. Mocha’s subdomain had no successfully crawled records.

The index’s own language field is a weak signal for these sites: because single-page applications carry little text in their first HTML, it marks only 19 of the 11,770 sites as Turkish. So we detected the language in a browser: we opened the homepage of 488 sites once and looked at the share of Turkish letters and common Turkish words in the visible text. 12 Turkish sites with real content came up; one was removed because it was a software company’s demo application.

The sample consists of these 11 Turkish sites and 29 sites drawn at random, with a fixed seed, from the non-Turkish candidates with real content. The draw kept each tool’s share close to its share of the index; at least two sites were taken from small tools such as Bolt and Create. The result is 40 sites: Lovable 31, Base44 5, Bolt 2, Create 2.

What we measured, and how

We opened only the homepage of each site, in a real Chrome browser, first with JavaScript off and then on:

1. Visible word count with JavaScript off, and with it on.
2. Title, meta description, canonical address and the page’s language declaration.
3. robots.txt and XML sitemap.
4. Structured data (JSON-LD).
5. Automated accessibility check (axe-core 4.13.0, WCAG 2.2 AA rules).
6. Mobile speed: PageSpeed Insights, the median of three runs per site.
7. Third-party requests and cookies set on first load, without the visitor clicking anything.
8. A link to a privacy notice or cookie policy.
9. Security headers: HSTS and CSP.

While measuring we respected robots.txt, waited at least two seconds between sites, submitted no forms and clicked nothing.

What does a machine see in the first HTML?

On 45 per cent of the sites we measured, the page held fewer than 50 words with JavaScript off; on 13 of them there was not a single visible word. With JavaScript on, the median visible text across the whole sample is 699 words. On these sites the text is produced not by the server but in the browser, once JavaScript runs. A browser or bot that does not run JavaScript sees these pages as blank; to read the page it has to run the JavaScript. We explain what this means for AI search in our guide to AI SEO.

There is a clear split between the tools. Of the 31 Lovable sites, 14 were almost empty in their first HTML; another 14 carried the same text in their first HTML as with JavaScript on, meaning the page had been pre-rendered. None of the Base44 sites was empty in its first HTML; what is more, on 3 of the 5 the text in the first HTML was clearly longer than what stayed on screen after JavaScript ran. The page the bot reads and the page a person sees are not the same. All four sites measured from Bolt and Create were empty in their first HTML.

Title, description, canonical, language

The basic tags are mostly in place: all sites have a page title and a language declaration, and 98 per cent have a meta description. A canonical address is defined on 68 per cent. Having a language declaration does not mean it is right: 2 of the 11 Turkish sites declare the page as English. If the declaration is wrong, search engines and screen readers learn the wrong language for the page; a screen reader reads Turkish text with English pronunciation.

robots.txt, sitemap, structured data

robots.txt is present on 83 per cent of the sites and an XML sitemap on 73 per cent. Structured data (JSON-LD) appears on 65 per cent. We explain what these three files do in our guides to AI crawlers and robots.txt and sitemaps.

Accessibility

The automated check found no violations on only 23 per cent of the sites; the median number of violated rules per site is 1. The most common problem is insufficient color contrast (68 per cent), followed by buttons or links without a name (30 per cent) and targets too small to tap with a finger (23 per cent). Automated checks catch only part of all accessibility problems; what we found here is a lower bound of what could be found. We show how contrast is calculated in our contrast ratio guide.

Speed

The median PageSpeed Insights mobile score is 76; 18 per cent of the sites score 90 or above. The problem lies less in the weight of JavaScript than in the largest content arriving late: the total time the main thread is blocked (TBT) is low at a median 44 milliseconds, but LCP has a median of 5.8 seconds and only 25 per cent stay below 2.5 seconds. Layout shift (CLS) is within the "good" limit on 85 per cent of the sites. Only one of the sites has real-user (field) data; the others do not get enough visits for Google to report, so the results are lab measurements. We explain why LCP comes out high and how to bring it down in our LCP guide.

Privacy and security

95 per cent of the sites connect to at least one server on another domain on first load; the median is three different domains per site. The most common are Google’s googleapis.com and gstatic.com servers (78 per cent). Every connection passes the visitor’s IP address to that server.

Cookies tell two separate stories. On 25 of the 31 Lovable sites a single technical cookie with the same name is set; because the name is always the same regardless of the content, it is the platform’s cookie, not the site’s. Analytics or advertising cookies, on the other hand, are set on 8 of the 40 sites before the visitor touches anything; 3 of those also have no link to a privacy notice or cookie policy. Across the whole sample, a privacy link appears on 53 per cent of the sites. We explain what a site in Türkiye needs to publish in our guides to the cookie policy and the privacy notice.

The security headers reflect the platform’s setting: HSTS (the header that forces the browser onto an encrypted connection only) is present on all sites, a content security policy (CSP) on none. Both results are the same on every site of each tool, so they are the server setting of the platform that provides the subdomain, not of the site.

The Turkish sites on their own

The 11 Turkish sites are a small subset of the sample; one site moves the percentages by 9 points, so they should be read as a direction, not as detail. In accessibility they do better than the whole: the automated check found no violations on 55 per cent. In search infrastructure they lag behind: robots.txt is present on 64 per cent, an XML sitemap on 45 per cent. The share that is empty in the first HTML is the same as overall, 45 per cent.

What do these results mean?

AI website builders can publish a working, decent-looking site in very little time, and the sites we measured are mostly pages with a title, a description and a language declaration. The gaps gather where the tool’s default settings leave them: whether the text is in the first HTML, color contrast, when the largest image arrives, the template’s language setting and cookies set without asking the visitor. All of these can be fixed; but to fix them, you first have to measure.

The limits of this measurement

• The sample covers only sites published on the tools' own subdomains. Sites moved to their own domain, probably with more work put into them, were left out.
• Common Crawl does not crawl every site; sites missing from the index could not enter the sample. The scan order followed page count, which favored larger sites.
• We infer that a site was built with a tool from its subdomain; the site may have been edited by hand afterwards.
• Only the homepage was measured, on a single day. The speed results are PageSpeed Insights lab measurements; real users' experience may differ.
• The Turkish subset is 11 sites; too small to generalize from.

The measurement was taken on 31 October 2026. We apply the same method to our own sites; a similar measurement we made of the websites of Türkiye’s largest exporters is in our exporter websites article.