Methodology
How we turn a URL into a score, and why we'd rather be honest about a signal's limits than pretend a single number tells the whole story.
How a scan works
When you submit a URL, our server fetches that page directly — the same way any browser would, following redirects and respecting a short timeout — and analyzes the raw HTML it gets back. We never execute the page's JavaScript or take a screenshot; every signal is found by inspecting the response your server actually sent, before any client-side rendering happens. That keeps the check fast, but it also means heavily client-rendered content that only appears after JavaScript runs can be invisible to us, the same way it would be to a search engine crawler that doesn't execute scripts.
The six signal categories
1. Builder fingerprints
Design-first AI website builders generate every page from shared templates, which means they tend to serve fonts, scripts, and images from their own CDN even after a custom domain is connected, and often reuse a distinctive short class-name prefix across the whole page. We match on both, plus any meta name="generator" tag the platform leaves behind. This is our strongest category — a real asset CDN reference is hard to fake and expensive to remove, unlike a badge that can be toggled off in a settings panel.
2. AI coding-tool traces
Full-stack app generators (Bolt.new, Lovable, v0, Replit) hand you real source code rather than a locked design, so their traces are rarer and more specific: a session URL pattern unique to the platform's live-editing environment, a code-generation tagging attribute, or an explicit sentence crediting the tool by name. We intentionally do not score a page just because it mentions or links to one of these platforms — a review, a comparison, or a recommendation is not evidence the page itself was generated there. Only an actual attribution claim counts.
3. LLM API references
If a page's own client-side scripts call an LLM provider's API domain directly, that's strong evidence the site's functionality — not necessarily its construction — is powered by AI. We look for the actual API subdomains providers use for inference traffic, not their general marketing domain, since plenty of pages link to a provider's homepage without calling its API.
4. Hosting / DNS signals
Some response headers and hosting providers correlate loosely with AI deployment platforms. We weight this category the lightest of all six, deliberately — hand-built, human-run sites deploy on the exact same general-purpose infrastructure every day, so hosting alone is weak evidence on its own.
5. Human / CMS counter-signals
This is the only category that actively lowers the score. Markers from traditional CMS platforms and classic server-rendered stacks are a strong sign of a human-run site, and we treat them that way — subtracting confidence rather than just failing to add it.
6. Boilerplate heuristics
Leftover placeholder copy, a handful of generic AI-marketing phrases we've seen repeated across one-shot generated pages, default component-library structure with no customization, and single-file inline-styled pages with no external stylesheet — the kind of unedited output typical of a page nobody went back and finished by hand.
Scoring and verdicts
Every fired signal contributes a fixed weight, and the raw total is capped at 100. We map that score to four verdicts: 80–100 is Definitely AI-built, usually meaning multiple independent signals corroborate each other; 50–79 is Likely AI-built; 20–49 is Some AI signals; and below 20 is Likely human-built. Every signal that fires is shown on the results page with its exact matched evidence, and every category we checked but found nothing for is listed too — nothing is hidden behind the number.
Where this approach breaks down
All six categories work by inspecting the shipped HTML — we have no way to observe how a page was actually produced. A site built with a local AI coding agent, then hand-edited and deployed normally, typically leaves nothing to find at all, since there was never a hosted build pipeline stamping the output. A determined site owner can also strip any of the fingerprints above on purpose. We optimize for accuracy on typical, unmodified builder or tool output, and we'd rather return a lower score on a hidden case than inflate confidence on weak or coincidental evidence — including evidence that's just a mention of a tool's name rather than proof of its use.
See the tools we check for on the homepage, read more in the blog, or run a scan.