The code it wrote you is real. It just isn't a website yet.

It can write the code for one, and the code is usually good. Ask for a five-page site for a landscaping company and you will get clean markup, a responsive layout, a nav that works, a contact form, and styling that looks current. Nothing about that is fake. What it cannot do is everything between a folder of files and a working website that a customer can find, load, and submit a form on. It does not buy a domain, choose a host, upload the files, configure DNS, install a TLS certificate, set up the mail path so form submissions arrive instead of landing in spam, test on a real phone, register the site with Google, or notice that the form it wrote will accept anything a bot pastes into it. Those steps are not hard individually. There are just a lot of them, they are all unfamiliar the first time, and the model will not tell you they exist unless you know to ask. The honest summary is that ChatGPT does the part of website work that was already the fastest part, and none of the part that was slow.

It is usually better than what an untrained person would write and worse than what a careful developer would ship, and the gap is concentrated in a few predictable places. Generated contact forms are the big one. The common pattern is a form that takes a name, an email, and a message and hands them to the server's mail function with the visitor's email dropped into a header. Done without stripping line breaks out of that value, that is a header-injection hole, and it lets someone use your website to send mail as you. Other regulars: no request-forgery protection on the form, no rate limit so one bot can send ten thousand submissions, user input echoed back into the page without escaping, uploads accepted without checking type or size, and error output left switched on so a stack trace tells an attacker your file paths. None of these are exotic. All of them are things you have to know to look for, because the code will run correctly and give you no indication anything is wrong. Code that works and code that is safe look identical from the browser.

They fail in opposite directions, which is why the choice between them is genuinely interesting. An AI website builder hands you a finished, hosted, working website and never hands you the code — you rent it, you cannot export it, and it switches off when you stop paying. ChatGPT hands you real code you own outright, that runs on any host, that no company can revoke, and hands you none of the infrastructure, none of the operations, and none of the assurance that it is correct. Builder: convenience without ownership. Code generator: ownership without support. Which failure you would rather have depends on what you can supply yourself. If you cannot configure DNS and would not know how to tell whether a contact form is safe, the builder's tradeoff is the better one for you and the generated code is a liability. If you are technical enough to deploy and review, the generated code is the better starting point by a wide margin, because it is portable and nobody can take it away.

Less than most people expect, which is the genuinely attractive part. A static site — plain markup and styling with no server-side code — hosts free on several platforms with a TLS certificate included, so the only unavoidable cost is a domain at roughly $15 to $25 a year. Add a server-side contact form and you need real hosting, which runs about $6 to $18 a month on a decent shared plan, or $5 to $12 on a small cloud server if you are comfortable administering it. Call it $100 to $250 a year all in. Compared with an AI website builder at $300 to $800 a year that number is excellent, and compared with ArdinGate managed hosting at $60 to $180 a month it is a fraction. What the cheap number does not include is anyone doing the work: patching the server, renewing certificates when the automation fails, taking backups you have tested restoring from, watching for the site going down, and dealing with it when the host has an incident. Self-hosting is cheap in money and not free in attention. Whether that is a good trade depends entirely on how much attention you have.

No. Google ranks pages on what they are and how they perform, not on which text editor or model produced the markup, and there is no signal that identifies AI-authored code as such. Generated code is frequently clean, semantic markup, which if anything helps. The ranking problems that show up on these sites come from omissions rather than authorship. Generated output routinely arrives with no canonical tags, no sitemap, no robots file, no structured data, one page title reused across every page, no social preview tags, missing alt text on images, headings used for size rather than hierarchy, and no analytics. None of those get flagged as violations. They just quietly mean the site is harder to index, presents badly in results, and gives you no way to tell what is working. Every one is fixable in an afternoon by someone who knows the list exists. The trap is that the site looks completely finished in a browser while missing all of it, so nobody goes looking.

Yes, and it is often a sensible way to spend less than a full build. What it costs depends almost entirely on how much you built before stopping. A single generated page with a clean structure is a good starting point, and finishing it — security review, form handling, responsive fixes, SEO foundations, accessibility pass, deploy — is usually a few hours. A twelve-page site assembled over three weekends by pasting from twenty separate chats, where the styling was rewritten four times and no two pages share a header, frequently costs more to untangle than to rebuild, and any honest developer will tell you so rather than quietly billing the hours. The practical guidance is to stop and ask early rather than late. Bring what you have while it is one or two pages and coherent. If you are already fighting the code, take the layout you liked as a reference and let the rebuild be a rebuild.

The contact form, and it usually breaks silently, which is the worst version. The page says thank you, so everything looks fine, and the mail never arrives — because it was sent from a server with no sender authentication configured and every recipient's spam filter dropped it, or because it went to a mailbox nobody watches. Businesses have lost months of enquiries to this without noticing, and the only reason they eventually find out is a customer mentioning they never heard back. Second most common is the certificate expiring because the automatic renewal was never verified, which puts a browser warning in front of every visitor. Third is a layout that works on the phone the owner tested and breaks on a different screen size, most often a table or a wide image forcing horizontal scroll. Fourth is a PHP version upgrade at the host turning a deprecation warning into a fatal error on a page nobody visits often. All four are routine. All four are invisible from your own browser until somebody tells you.

Yes, as a tool, and pretending otherwise would be both dishonest and easy to disprove. AI assistance speeds up scaffolding, boilerplate, refactoring, and first drafts, the same way a compiler and a linter and a framework each sped up the job before it. What it does not do is decide anything or ship anything unreviewed. Every line that goes onto a client's site is read, tested in a browser and on real devices, checked against the security list, run through accessibility and performance checks, and owned by a person whose name is on the invoice. That is the whole distinction, and it is the same one that applies to your own use of these tools: generated code is a fast first draft, and the value a developer adds is the review, the judgment, the operational work around it, and being answerable for the result. The problem was never that the code came from a model. The problem is a site going live with nobody having checked it.

For someone who has done it before: an afternoon. For someone who has not: usually two to six weekends, and the frustrating part is that almost none of that time is spent on the website. It is spent on a registrar's DNS panel, working out which record points where. On a hosting control panel, finding out the free plan does not run server-side code and the form therefore cannot work. On a certificate that will not issue because DNS has not finished propagating. On a form that returns a 500 error with no message because error display is off. On sender authentication records so the notification email stops going to spam. On the layout breaking at one screen width. On finding out the model wrote code for a library version that no longer exists. None of it is intellectually hard. All of it is unfamiliar, and unfamiliar plus no one to ask is what turns an afternoon into a month. If your time has a value, price the month before deciding the build was free.

Better at the parts they automate, and identical on everything that actually decides the outcome. These tools close the gap that hurt most in a plain chat window: they keep the whole project in view instead of one file at a time, they show you a live preview, they wire up a deploy so the site is reachable at a URL in minutes, and several of them provision a database and authentication for you. That is a real improvement and worth using. What they do not change is that the code is still generated, still unverified, still yours to secure, and still yours to operate. The deploy they give you is on their platform, which quietly reintroduces the subscription and lock-in question the raw-code route avoided. And the same review list applies unchanged: form handling, input escaping, rate limiting, mail authentication, accessibility, structured data, performance, backups. Faster to something that runs. Same distance from something that is finished.

When you can supply the part the model cannot, or when the stakes are low enough that the missing part does not matter. Concretely: you write software or administer systems for a living and deploying a static site is a Saturday morning rather than a project; the site is a single page with no form, no payments, and no personal data, so the entire security surface is a hosting account; it is a prototype, an internal tool, or a landing page for a test campaign with a two-month life; or you are pre-revenue with far more time than money and building it yourself is the point. In all of those, paying $1,200 or more would be the wrong allocation and generated code is the right tool. It stops being the right tool at a specific and recognizable moment: when the site starts collecting information from strangers, taking payment, or producing the leads the business runs on. At that point somebody has to be accountable for it being correct, and a chat window cannot be.