Methodology
How we turn a URL into a score, and why we'd rather be honest about a signal's limits than pretend a single number tells the whole story.
How a scan works
When you submit a URL, our server fetches that page directly — the same way any browser would, following redirects and respecting a short timeout — and analyzes the raw HTML it gets back. We never execute the page's JavaScript or take a screenshot; every signal is found by inspecting the response your server actually sent, before any client-side rendering happens. That keeps the check fast, but it also means heavily client-rendered content that only appears after JavaScript runs can be invisible to us, the same way it would be to a search engine crawler that doesn't execute scripts.
The six signal categories
1. Builder fingerprints
Design-first AI website builders generate every page from shared templates, which means they tend to serve fonts, scripts, and images from their own CDN even after a custom domain is connected, and often reuse a distinctive short class-name prefix across the whole page. We match on both, plus any meta name="generator" tag the platform leaves behind. This is our strongest category — a real asset CDN reference is hard to fake and expensive to remove, unlike a badge that can be toggled off in a settings panel.
2. AI coding-tool traces
Full-stack app generators (Bolt.new, Lovable, v0, Replit) hand you real source code rather than a locked design, so their traces are rarer and more specific: a session URL pattern unique to the platform's live-editing environment, a code-generation tagging attribute, or an explicit sentence crediting the tool by name. We intentionally do not score a page just because it mentions or links to one of these platforms — a review, a comparison, or a recommendation is not evidence the page itself was generated there. Only an actual attribution claim counts.
3. LLM API references
If a page's own client-side scripts call an LLM provider's API domain directly, that's strong evidence the site's functionality — not necessarily its construction — is powered by AI. We look for the actual API subdomains providers use for inference traffic, not their general marketing domain, since plenty of pages link to a provider's homepage without calling its API.
4. Hosting / DNS signals
Some response headers and hosting providers correlate loosely with AI deployment platforms. We weight this category the lightest of all six, deliberately — hand-built, human-run sites deploy on the exact same general-purpose infrastructure every day, so hosting alone is weak evidence on its own.
5. Human / CMS counter-signals
This is the only category that actively lowers the score. Markers from traditional CMS platforms and classic server-rendered stacks are a strong sign of a human-run site, and we treat them that way — subtracting confidence rather than just failing to add it.
6. Boilerplate heuristics
Leftover placeholder copy, a handful of generic AI-marketing phrases we've seen repeated across one-shot generated pages, default component-library structure with no customization, and single-file inline-styled pages with no external stylesheet — the kind of unedited output typical of a page nobody went back and finished by hand.
Scoring and verdicts
Every fired signal contributes a fixed weight, and the raw total is capped at 100. We map that score to four verdicts: 80–100 is Definitely AI-built, usually meaning multiple independent signals corroborate each other; 50–79 is Likely AI-built; 20–49 is Some AI signals; and below 20 is Likely human-built. Every signal that fires is shown on the results page with its exact matched evidence, and every category we checked but found nothing for is listed too — nothing is hidden behind the number.
Where this approach breaks down
All six categories work by inspecting the shipped HTML — we have no way to observe how a page was actually produced. A site built with a local AI coding agent, then hand-edited and deployed normally, typically leaves nothing to find at all, since there was never a hosted build pipeline stamping the output. A determined site owner can also strip any of the fingerprints above on purpose. We optimize for accuracy on typical, unmodified builder or tool output, and we'd rather return a lower score on a hidden case than inflate confidence on weak or coincidental evidence — including evidence that's just a mention of a tool's name rather than proof of its use.
See the tools we check for on the homepage, track every fix we've made on the accuracy log, read more in the blog, or run a scan.