Launch checklist for AI-built sites (Lovable, Bolt, v0, Cursor, Replit)

Why AI-built sites need a pass

Tools like Lovable, Bolt, v0, Replit, and Cursor get an app working in hours. They optimize for what you can see in the preview. The things you cannot see, such as meta tags, what crawlers receive, keyboard access, and response headers, are easy to skip, and they decide whether the launch link looks good, ranks, and works for everyone.

Titles, descriptions, and previews

• Same title on every page. Single-page apps often keep the template's title on every route. Give each page a unique title of about 50 to 60 characters.
• Missing meta description. Write one per page, about 150 characters, that says what the page offers.
• Broken or default share image. Set og:image to an absolute https URL of a 1200×630 image, and twitter:card to summary_large_image. Test with the meta tag checker.
• Default favicon. Replace the framework or builder icon with your own.

Client-only rendering

Many builders output a Vite + React single-page app. The server sends an almost empty HTML file and JavaScript builds the page in the browser. Social preview bots and most AI crawlers do not run JavaScript, so they see no content and often no page-specific tags.

• Check view-source: for your real text.
• For public marketing pages, use prerendering, static generation, or a framework with server rendering such as Next.js, Astro, or Remix.
• Make sure robots.txt lets AI search crawlers in. See robots.txt for AI crawlers.

Placeholder content and links

• Search for lorem ipsum, "Acme", "Your Company", sample testimonials, and stock prices.
• Find links that point to # or to pages that were never built. Run the broken link checker.
• Check that footer links (privacy, terms, contact) go to real pages.
• Make sure forms actually send somewhere and show a success message.

Accessibility

• Icon-only buttons without labels. Menu, close, and social icons need an aria-label.
• Low-contrast gray text. Light gray on white often fails the 4.5:1 minimum. Test with the contrast checker.
• Clickable divs. Use real <button> and <a> elements so keyboard users can reach them.
• Missing alt text and form labels. See the WCAG 2.2 checklist.

Security and secrets

• Search the built JavaScript for secret API keys. Only public, restricted keys belong in the browser.
• If you use Supabase or Firebase, enable Row Level Security or security rules on every table.
• Add security headers (HSTS, a Content Security Policy, X-Content-Type-Options). Grade them with the security headers checker.
• Redirect http to https and remove any public preview or debug routes.

404, sitemap, and analytics

• Real 404s. Single-page app hosting often returns status 200 with the app shell for every URL. Search engines treat these as soft 404s. Configure your host to return 404 for unknown paths.
• robots.txt and sitemap. Publish both at the root and submit the sitemap in Google Search Console and Bing Webmaster Tools. Make sure no noindex is left over from a preview environment.
• Analytics and legal. Add analytics, a privacy policy, and cookie consent if your analytics needs it.

For the full list, see the website launch checklist.