We create digital solutions that work for businesses
Ads promising “a website for ₴3,000 in two days” surprise no one in 2026. Some of these sites are assembled with an AI tool in an evening: someone describes what they need, the AI generates pages and code, and a few hours later there is something that looks like a finished product. This approach is called vibe coding.
On the surface, such a site can look as good as a studio’s work. The difference is under the hood: who checked the security of forms and the database, whose name the domain is registered in, whether Google can see the site, whether enquiries actually arrive, and who will fix a bug six months from now. Below we look at what you really get with a cheap AI-built website, which documented incidents have already happened with such products, what the “savings” cost in practice, and how to vet a contractor before you pay.
If you are already choosing a contractor, also see what makes up the cost of a website in 2026 and what is included in turnkey website development.
The term was coined by Andrej Karpathy, one of the founding members of OpenAI, in February 2025. He described an approach in which you fully give in to the AI and “forget that the code even exists”: you describe what you want, accept whatever is generated and ask the AI to fix what breaks without digging into the cause. By November 2025, Collins Dictionary had named “vibe coding” its Word of the Year.
There are plenty of tools for it: Lovable, Bolt, v0, Replit, Base44, Cursor. The simplest ones let you build a site or an app in the browser for a subscription of about $25 a month. That is exactly why the market now has offers where the price of a website barely exceeds a few months of such a subscription.
Experienced developers use AI assistants too. The difference is not the tool but who reviews the result and how.
| Criterion | Vibe coding without experience | Development with an AI assistant |
|---|---|---|
| Who makes decisions | the AI model; a person accepts the output | the developer; AI speeds up routine work |
| Code review | “it works, so it’s done” | review, tests, security checks |
| Architecture and data | whatever was generated | designed for the task and the load |
| A bug in production | “I’ll ask the AI to fix it” | it is clear where to look and how to roll back |
| Responsibility | usually none | contract, warranty, support |
The website development market in Ukraine can be roughly split into four tiers. The boundaries are blurry, but the pricing logic is clear.
| Option | Typical starting price | What you get | Who is responsible |
|---|---|---|---|
| Do it yourself in an AI generator or website builder | subscription from ~$25/month + domain | a fast prototype, platform limitations | you |
| A beginner who assembles the site with AI | ₴2,000–5,000 | a nice wrapper; the rest is a gamble | usually nobody |
| An experienced freelancer | depends on scope | quality depends on one person | the freelancer, if agreed |
| A full-cycle studio | landing page from ₴9,900, company website from ₴19,900, online store from ₴29,900 | structure, design, development, SEO basics, analytics, launch | the team, under contract |
The studio prices in the table come from our pricing page. For a closer look at the difference between contractors, read “Freelancer or Web Studio”.
AI really has cut the time to the first screen: what used to take a week of layout work can now be shown to a client in an evening. What did not get cheaper is everything after the first screen: planning a structure around search queries, security review, setting up enquiries and analytics, legal requirements, testing on phones, ongoing support. A cheap contractor saves exactly there — because the client cannot see it until the first problem.
In July 2025, Veracode, a company specialising in code security, tested more than 100 large language models on 80 typical coding tasks. The results:
Developers themselves are cautious. In the 2025 Stack Overflow survey (more than 49,000 respondents), 84% said they use or plan to use AI tools, yet only 33% trust the accuracy of AI output. The most common frustration, named by 66%, is solutions that are “almost right, but not quite”. And 45% said debugging AI-generated code takes more time than expected.
“Almost right” is exactly what the owner of a cheap website gets: the form submits but the email never arrives; the page opens but is missing from Google; the admin panel works but its password is stored in plain text.
These are not horror stories but documented 2025 incidents with public write-ups.
Researcher Matt Palmer scanned 1,645 apps created on the Lovable platform and found 170 projects (303 endpoints) where anyone could read data from the database without logging in. The exposed data included names, emails, phone numbers, payment statuses and API keys. The cause was database access rules (Row Level Security) that were either missing in the generated projects or did not restrict anything. The vulnerability was assigned CVE-2025-48757. The platform later added an automated security scan, but a scan does not replace a person who understands which data should be visible to whom.
In July 2025, researchers at Wiz found a flaw in Base44, a vibe coding platform owned by Wix: knowing only an app’s public ID, an attacker could register in someone else’s private app and bypass authentication. The platform fixed the issue within 24 hours, and there was no evidence it had been exploited. But the app owners themselves had no way of spotting such a risk.
In March 2025, the founder of EnrichLead publicly boasted that his product had been built with zero hand-written code. Users then found API keys hard-coded into the page and bypassed the paywall with a couple of lines of CSS. Within days the service was shut down, and its author admitted he should not have shipped unreviewed code to production.
In July 2025, SaaStr founder Jason Lemkin was testing vibe coding on Replit. On day nine, despite an explicit instruction not to make changes, the AI agent deleted the production database holding records on 1,206 executives and more than 1,196 companies. Replit’s CEO called the incident unacceptable and promised to separate development and production databases and improve restoring from backups.
A typical company website is not a SaaS product, but the weak spots are the same: forms with personal data, the admin panel, CRM integrations, service access keys, backups.
An enquiry form, a cart, a customer account, an admin panel — each is a way into your data. Typical flaws in generated code: service keys visible in the page source, an admin login without attempt limits, no protection against spam and injections, default passwords. A leak is not only about reputation. In Ukraine, Article 188-39 of the Code of Administrative Offences sets fines for breaching personal data protection rules: for officials and entrepreneurs, up to 1,000 tax-free minimum incomes, and up to 2,000 for a repeat offence — that is, up to ₴34,000. Basic protection steps are covered in “Small Business Cybersecurity”.
Very often the domain, hosting or platform account is registered to the contractor. While they are reachable, everything is fine. Once they disappear, you cannot change even a phone number on the site, and moving it elsewhere may be impossible: the project lives in someone else’s account or is tied to a subscription platform. Check who owns the domain with a WHOIS lookup, and insist on getting all access before the final payment.
Some quickly assembled sites show their content only after JavaScript runs in the browser. Google does render such pages, but not immediately: they wait in a rendering queue, and Google itself recommends server-side rendering or pre-rendering because “not all bots can run JavaScript”. According to Vercel’s research from late 2024, the major AI crawlers — those of ChatGPT, Claude and Perplexity — did not execute JavaScript at all. So for ChatGPT search such a site may look like an empty page. Platforms are gradually fixing this, so do not judge by the name of the tool — check the specific site (the checklist below shows how).
SEO structure is a separate story. A cheap site usually has one page for all services, identical titles, no sitemap, no structured data, no proper URLs or language versions. It can look great, yet customers simply cannot find it. We explain what an SEO foundation is and why it is laid at the structure stage on our SEO services page.
This is the most expensive flaw because it is invisible. The form says “Thank you”, while the email lands in spam or is never sent. There are no Telegram notifications, no copy of the enquiry in the admin panel, no bot protection — and real enquiries drown in spam. The owner thinks the ads do not work, when in fact the website does not. See our article on the enquiry form for how a form should be built so people actually fill it in.
Google Ads explicitly names landing page experience as one of the three components of Quality Score. A slow page that does not match the search query usually means lower ad quality and a more expensive click. And without conversion tracking, automated bidding strategies do not know which clicks produced enquiries and optimise blindly. More on this in our article on Google Ads bidding strategies.
Generated projects often pull in heavy libraries and unoptimised images. On a computer with fast internet this goes unnoticed, but on a phone with a mobile connection the page takes several seconds to load — and the visitor goes back to the search results and on to a competitor. You can check the speed with our website speed audit.
A site that collects names and phone numbers needs a privacy policy and consent to data processing. If analytics and ad pixels are used, a cookie consent banner is needed too. And since 16 July 2022, Ukraine’s state language law has required websites of businesses registered in Ukraine that sell goods or services there to have a Ukrainian version that opens by default for users in Ukraine and is no smaller in content than other language versions. A cheap contractor usually does not think about this — because the client did not ask.
A website is not a one-off purchase: updates, backups, the SSL certificate, price and service changes. Code that nobody designed is hard to extend: every edit breaks something else. One of the experts interviewed by DOU described how a vibe-coded module piled up workarounds and became unmanageable — in the end it was rewritten from scratch. So six months later you pay again, and this time it is not ₴3,000.
Let’s compare two company websites receiving the same ad traffic: ₴9,000 a month, an average click of ₴50, so about 180 visitors a month. The conversion rates are illustrative — yours will differ, but the logic holds.
| Over 6 months | Website for ₴4,000 | Website from ₴19,900 |
|---|---|---|
| Ad spend | ₴54,000 | ₴54,000 |
| Visitors from ads | ~1,080 | ~1,080 |
| Enquiry conversion rate | 1% (the form loses some enquiries, the page is slow) | 3% (a clear offer, a working form) |
| Enquiries | ~11 | ~32 |
| Cost per enquiry | ~₴5,000 | ~₴1,700 |
| Rebuild | likely another ₴20,000+ | not needed |
The difference at the start is ₴15,900. The difference in results is about twenty enquiries in six months for the same ad budget. For a business where one deal brings several thousand hryvnias of profit, the “cheap” website turns out to be the most expensive option. For a detailed budget breakdown, see “How Much Does a Website Cost in Ukraine in 2026”.
| What matters to a business | Beginner with AI | Professional team |
|---|---|---|
| Contract with price and timeline | rarely | yes, before work starts |
| Domain and access | often in the contractor’s name | in your company’s name, code handed over |
| Security review | none | forms, admin panel, keys, backups |
| SEO structure | one page “about everything” | pages for search queries, meta tags, sitemap |
| Enquiries and analytics | “the form seems to work” | notifications, GA4, conversions for ads |
| Mobile version and speed | whatever was generated | tested on real devices |
| After launch | contractor unavailable | warranty and support |
To be fair, professionals make mistakes too. The difference is that they have a process that catches errors before launch and a contract under which they fix them. To compare offers on substance, start with our guide “How to Order a Website for Your Business”.
AI generators are a useful tool if you understand their limits. They fit when:
If the site has to bring customers from search and ads, accept enquiries or payments, or store data, you need a person who is responsible for the result. We explain how to launch a minimum version of a product properly in our article on a startup MVP.
You can check these items yourself, even without technical knowledge. Most of them before the final payment.
A fuller list for final acceptance is in our pre-launch website checklist. If the requirements are not written down yet, start with a technical specification.
We are not against AI — we are against businesses paying for risks they were never told about. That is why in every project:
Browse our portfolio and client reviews, choose a website type — a corporate website, an online store or a catalog website — or describe your task, and during business hours we will estimate the cost for free within 15 minutes.
Vibe coding has made the first screen cheap, but it has not made security, search visibility, working enquiries or responsibility for the result any cheaper. A ₴3,000 website can be a reasonable way to test an idea. For a business that invests in advertising and expects enquiries, the cost of a mistake is measured not in hryvnias spent on development but in lost customers, data and reputation. Choose a contractor not by the starting price but by what will happen to the website a year from now.
Web Application Development
Web development
Web development
Web development
Let’s create something amazing together 
