How to Fix a Vibe-Coded Website Before It Costs You Clients

This is problem number one on almost every vibe-coded site we audit. AI tools like Lovable and Bolt generate single-page React applications. Because the content is rendered by JavaScript in the browser rather than on the server, meta tags — title, description, og:image — are often either missing entirely or identical across every page.

Google reads duplicate titles as a signal that your pages don't have distinct, meaningful content. Your blog post, your homepage, and your contact page all showing the same <title>My App</title> will actively suppress all of them in rankings.

The fix: migrate to Next.js and use generateMetadata() on every dynamic route. If you can't migrate yet, add react-helmet and manually set unique meta tags per page as a stop-gap. Check your current state by viewing page source (Ctrl+U) and searching for <title> — if every page shows the same value, you have this problem.

This one can destroy a business overnight. AI tools often generate code that hardcodes API keys, database connection strings, or Stripe secret keys directly in the frontend JavaScript — visible to anyone who opens DevTools and looks at the Network tab or source files.

Before anything else, open your browser DevTools, go to the Sources tab, and search for common key patterns: sk_live, AIza, AKIA (AWS), xoxb (Slack). If you find any of these in client-side code, rotate those keys immediately — treat them as compromised.

The correct pattern: all secret keys live in .env.local on the server, are accessed only in Server Components or API routes, and are never prefixed with NEXT_PUBLIC_ (which explicitly exposes them to the browser). Audit every environment variable in your project right now.

AI builders almost universally generate <img> tags with no width, height, or lazy loading attributes. On a site with even a modest number of images, this causes two critical problems: layout shift (CLS) as images load in and push content around, and slow LCP as the browser downloads full-resolution images that could be served at a fraction of the size.

Run your site through Google PageSpeed Insights right now. If your LCP is above 2.5 seconds or your CLS score is above 0.1, images are almost certainly the culprit. The fix in Next.js is straightforward: replace every <img> with <Image> from next/image, set explicit width and height props, and add the priority prop to your hero image. Expect a 20–40 point PageSpeed improvement from this change alone.

Form handling is where AI-generated code fails most quietly. The form renders correctly in the browser, the submit button fires, but the data never arrives anywhere. AI tools frequently generate form logic that posts to a non-existent endpoint, fails silently on error, or has no CSRF protection whatsoever.

Audit every form on your site: test submission with real data and check your server logs or email inbox for the expected result. If nothing arrives, open the Network tab in DevTools and watch the request when you submit — look for 404s, 500s, or requests to localhost URLs that were never updated for production.

For contact forms in 2026, the most reliable stack is Next.js Server Actions (for type-safe, no-API-route form handling) combined with Resend or Postmark for transactional email delivery.

If you've inherited a vibe-coded site — or built one yourself and are now worried — run through this list before you do anything else.

Meta tags: View source on 3 different pages. Are the titles and descriptions unique? SEO: Run through Google Search Console's URL Inspection tool on your 5 most important pages. Are they indexed?

Security: Search your frontend source for API keys. Check every environment variable — nothing secret should be prefixed NEXT_PUBLIC_. Performance: Run PageSpeed Insights. Target 90+ on mobile. Forms: Submit every form with test data and verify delivery. Mobile: Test on a real device, not just browser DevTools resize.

Most vibe-coded sites have at least three of these six issues. Finding them takes an afternoon. Not finding them costs clients.