5 common gaps in freshly launched AI-built sites

On 16 October 2026 we ran quick passive checks on 9 sites that founders had just announced on X as built with AI tools. The five most common gaps were: no working robots.txt or sitemap.xml (6 of 9), no social preview tags (5 of 9), no basic security headers (4 of 9), a generic page title or missing meta description (4 of 9), and still living on a platform subdomain (3 of 9). None had a secret key in its public JavaScript. Every gap here takes minutes to an hour to fix.

How these sites were checked

Each check was passive and used only what anyone can see: the homepage HTML and response headers, /robots.txt, /sitemap.xml, the meta and Open Graph tags, and the site's public JavaScript searched for key patterns. We didn't log in, submit forms, load-test or probe anything. PageSpeed and Lighthouse weren't run, so this post says nothing about speed. The sites are anonymised. The numbers are small (9 sites, one afternoon), so read them as "things worth checking on yours", not as statistics about every AI-built site.

We also checked a tenth launch that its maker said was built without AI. It had the same title, preview and sitemap gaps, which suggests these come from shipping fast, not from AI tools specifically.

1. No working robots.txt or sitemap.xml (6 of 9)

Four sites returned a 404 for both files. Two more were single-page apps that answered /robots.txt and /sitemap.xml with their homepage HTML and a 200 status, which is arguably worse: a crawler asks for a sitemap and gets a web page. One site's 404 page also carried a noindex tag. A seventh site had a valid sitemap that listed only the homepage, though it had other pages worth ranking.

Fix: serve a real robots.txt that points to a real sitemap.xml listing every public page, check that both return the right content type, and submit the sitemap in Google Search Console and Bing Webmaster Tools.

2. No social preview tags (5 of 9)

Five sites had no og:image or twitter:card. On launch day, when the link is shared on X, LinkedIn or in chat apps, it shows as a bare URL or a generic card instead of a picture of the product.

Fix: add og:title, og:description, a 1200×630 og:image and twitter:card set to summary_large_image, then test the link in a post preview before you announce.

3. No basic security headers (4 of 9)

Four homepages sent none of the main security headers: no HSTS, Content-Security-Policy, X-Frame-Options or X-Content-Type-Options. One was on a host that doesn't let you set custom headers at all. Two other sites had these set well, so it's clearly doable on the same stacks.

Fix: add the headers at your host or CDN (a _headers file on Cloudflare or Netlify, headers() in next.config, or your platform's settings), then confirm with curl -I.

4. Generic title or missing meta description (4 of 9)

Several titles were just the product name, with no hint of what the product does or who it's for, and some pages had no meta description. One site's whole HTML was about 3 KB: a bare title, no description, the wrong lang attribute for an English launch, and all content rendered by JavaScript, so search engines and link previews saw almost nothing.

Fix: write a title that says what it is and who it's for (under about 60 characters), a one-sentence description, and make sure the main text is in the HTML the server sends, not only added by JavaScript.

5. Still on a platform subdomain (3 of 9)

Two sites were still on *.vercel.app and one on a raw cloud-functions URL. That's fine for testing, but authority and backlinks earned on launch day stay with a URL you may abandon later.

Fix: put the site on its own domain before you announce it, and redirect the platform URL to it.

One more worth checking: does "Get started" do anything?

One site had every call-to-action button scrolling to a section with no form, email or signup, and its security policy blocked form submissions entirely. Interested visitors had no way to say yes. Click every button on your own launch page once, logged out, on a phone.

What was fine

No site had a secret key in its public JavaScript. One security-scanner site matched patterns like sk_live and service_role, but those were its own detection rules and demo placeholders, not real keys. Two sites had excellent meta, Open Graph and structured data. The gaps above are common, not universal.

Check your own site

You can do every check in this post yourself in about 15 minutes with a browser and curl. If you'd rather have it done for you, the $49 AI Site Audit covers all of the above plus speed and deeper security checks, delivered in 24 hours. For security specifically, start with the free vibe-coded app security checklist.