AI-generated website problems run on a schedule, not a lottery. Most AI-built websites break in three waves: launch week, when you find the features that never actually worked; around month three, when an update or an expired API key takes something down; and inside year one, when dependency rot, PHP upgrades, and missed renewals all catch up at once. Fixes range from a $20 domain renewal to a four-figure untangle when nobody can read the code. The cheapest option is 30 boring minutes of maintenance a month, and we’ll show you exactly what goes in them.
We build vibe-coded sites for a living, and we fix a lot of other people’s. What follows isn’t theory. It’s the pattern we keep seeing in rescue work, sorted by when each failure likes to show up.
What makes AI-generated website problems different?
Traditional sites break too. The difference is that when an agency build breaks, somebody exists who once held the whole thing in their head. When an AI build breaks, the “developer” was a chat session, and that session is closed. No mental model of your code exists anywhere on Earth. The first person to actually read it, start to finish, is whoever you hire after it goes down.
Professional developers know this about AI output, which is why they double-check it. In the 2025 Stack Overflow developer survey, 84 percent of developers said they use or plan to use AI tools, yet 46 percent actively distrust the accuracy of what those tools produce. Only about 3 percent highly trust it. So the pros generate code, then verify it. A first-time builder can only do the first half, and the second half is where reliability lives.
The code itself carries more risk than it appears to. Veracode’s 2025 GenAI code security report ran security-focused coding tasks against more than 100 models and found that roughly 45 percent of the generated samples introduced OWASP Top 10 vulnerabilities. Beyond security, AI code has a signature style: it nails the happy path and skips the boring parts. Error handling, fallbacks, the little message that tells you something failed. Gone.
AI-built sites don’t fail loudly. They fail politely, in the background, while the homepage keeps loading just fine.
The failure timeline: when AI-generated website problems actually hit
Three waves, three causes, three price brackets. Here’s the calendar.
Day 1: the form that never sent anything
The classic launch-week failure is a contact form that looks perfect and does nothing. The AI built the frontend beautifully, then wired the submit button to a placeholder endpoint, a mail function your host blocks, or an API key that was never actually created. You tested “does the page load,” and it does. You didn’t test “did the email arrive,” because who tests that twice?
Nothing on screen admits it’s broken. A polite “Thanks, we’ll be in touch” renders either way, because the error state is exactly the kind of boring detail AI skips unless you force it to. Week three, a friend mentions she filled out your form twice and never heard back. Every lead between launch and that conversation went into the void.
Other day-one classics: the mobile menu that works in the AI’s preview and dies on an actual iPhone, hero images that ship at 9 MB, the embedded Google Map wearing its “for development purposes only” watermark. They all share a trait: the site looks right. Looking right is the one thing AI code is reliably great at.
This failure class is the reason the free prompts at /vibe-coding-prompts/ spend an embarrassing share of their 12,000 characters on form handling and error states. You have to write “show a visible error if the send fails” out loud, or you won’t get it.
Month 3: the update that broke everything
Around month three, the outside world starts moving and your frozen-in-time codebase doesn’t. On WordPress, plugins update, sometimes automatically. They have to: Patchstack logged roughly 6,700 new WordPress vulnerabilities in the first half of 2025 alone, almost all of them in plugins rather than core. Skipping updates is how sites get hacked.
Applying them blind, though, is how AI-built sites white-screen. A plugin update assumes your theme follows standard conventions. The AI-written functions file did something creative instead, and the combination throws a fatal error at 2 a.m. So you’re stuck in the classic bind: update and risk a conflict, or don’t and collect security holes. Either path needs a human paying attention, and on most AI builds there isn’t one.
Month three is also when the keys start dying. The form service’s free tier ran out. The maps key hit a billing change. The SMTP trial ended. The AI wired everything to credentials with expiration dates, and the warning emails went to spam, or to a placeholder address that was never real. When someone tells us their site stopped working after an update, or that it broke without anyone touching it, an expired key or a plugin conflict is usually the actual diagnosis.
Year 1: dependency rot and the renewals nobody tracked
Year one is when the ground itself moves. PHP versions age out of security support on a fixed calendar: 8.1 fell out at the end of 2025, and hosts respond by bumping everyone’s default version whether the code is ready or not. Code the AI wrote against last year’s PHP starts throwing deprecation warnings, and deprecation warnings eventually graduate into fatal errors.
Static builds rot differently. The live site keeps serving, but the day you want to change anything, the build won’t run: a JavaScript package that sat untouched for a year now conflicts with three others, and the framework shipped a major version in the meantime. Your site becomes a photograph. Nice to look at, impossible to edit.
Then come the renewals. Domain, hosting plan, the one paid plugin license that quietly stopped shipping security updates when the card on file expired. A company keeps a spreadsheet for this. A solo AI build has vibes. Nobody tracked the dates because there was never a team, and the first notice anyone actually reads is the one saying the domain is already in its grace period.
What each failure costs to fix
Numbers first, caveats after. Market rates below come from WebFX’s 2026 maintenance pricing guide, updated in December 2025, which puts small-business maintenance at $3,600 to $12,000 a year and emergency hacked-site work at $250 an hour. Our flat-fee numbers are current as of April 2026.
| Failure | When it usually hits | Typical cost to fix | What it costs you meanwhile |
|---|---|---|---|
| Form never wired up | Launch week, found weeks later | $150 to $500 at hourly rates; flat-fee rescue from $950 | Every lead since launch |
| Update conflict, white screen | Month 2 to 4 | $250/hour emergency rates at big shops; flat fixes from $950 | Hours to days fully down |
| Expired API key or free tier | Month 1 to 6 | Often under $300; the diagnosis is the cost, not the fix | Forms, maps, search quietly dead |
| Dependency rot, PHP bump | Month 8 to 18 | From $950, climbing with how tangled the code is | Site degrades, then drops |
| Missed domain or license renewal | Month 12 to 13 | $20 to $60 caught early; $100+ in redemption fees after | The whole site, sometimes email too |
One pattern hides inside every row: the repair is rarely the expensive part. The most expensive part of fixing an AI-built site is finding out what the code was supposed to do in the first place. A human-built site comes with a human you can ask. An AI-built site comes with 4,000 lines and a shrug. That’s why we price diagnosis separately on our rescue service: a $450 diagnostic, credited toward the work if we do the fix, repairs from $950, and a ballpark inside 24 hours.
Your AI website broke this morning. Now what?
First, breathe, and don’t let anyone, chatbot included, start rewriting files on the live server. Screenshot the exact error. Then check the dumb stuff before the deep stuff: is the domain paid, is the SSL current, did the hosting card go through? A surprising share of “my site is down” turns out to be a $14 renewal.
If it’s WordPress and the timing lines up with an update, your host’s dashboard almost certainly shows what changed in the last 48 hours. Roll the plugin back or disable it from the file manager and you’re often live again in ten minutes. We wrote the full walkthrough, with the exact clicks, in our guide to fixing a broken vibe-coded website.
Know your stopping point, though. Our rule from rescue work: if the second AI-assisted fix attempt fails, stop. Attempt three is where people turn a broken form into a broken database, and cleanup of stacked chatbot patches costs more than the original problem ever would have. Back up whatever still works, then hand it over.
The boring 30 minutes a month that prevent most of this
Prevention here isn’t clever. It’s a short checklist a teenager could run; it just has to actually get run, every month, forever. Ours looks like this:
- Submit every form on the site and confirm the email lands in your inbox (5 minutes)
- Update plugins one at a time, backup first (10 minutes)
- Open the five pages that make you money, on a real phone (5 minutes)
- Skim the hosting dashboard and browser console for anything red (5 minutes)
- Check the renewal calendar: domain, hosting, licenses, API billing (5 minutes)
Add two one-time moves that pay off forever: put the code on GitHub so your host isn’t the only copy, and point a free uptime monitor at the homepage so a customer’s email isn’t your alerting system. The long version of this routine, tools and all, lives in our vibe-coded website maintenance guide.
And if you’d rather never think about any of this again, that’s the exact gap our care plans cover: from $290 a month for vibe-coded and AI-built sites, up to a $900-a-month Priority plan that includes four hours of work and a monthly performance check. One prevented white-screen pays for months of it. We won’t pretend a care plan is exciting. Neither is an oil change.
Questions we keep getting about broken AI sites
Why is my vibe coded site not working when I didn’t change anything?
Because something else changed. Your host bumped its PHP version, a plugin auto-updated, an SSL certificate or API key expired, or a third-party service your site leans on retired an endpoint. Websites sit on a stack of moving parts owned by other people, so “I didn’t touch it” and “nothing changed” are almost never the same sentence. Work backward from the timing: whatever broke usually maps to a renewal date, an update log entry, or a billing email that went to spam.
How much does it cost to fix a broken AI-generated website?
Market hourly rates for this work run roughly $150 to $250, with the high end reserved for emergencies like hacked-site cleanup. Simple failures such as expired keys or one bad plugin often land under a few hundred dollars; tangled ones, like dependency rot or files mangled by repeated chatbot patches, climb from there. We price it flat instead: a $450 diagnostic that gets credited if we do the repair, fixes from $950, and a ballpark inside 24 hours so you’re never committing blind.
Can I just ask ChatGPT to fix the site it built?
For small, specific problems, yes: paste the exact error message, ask for the smallest possible change, and back up the file before applying anything. The failure mode is scope creep, where the model rewrites half the file to fix one line and quietly breaks two other things. Our rule is two attempts. If the second fix doesn’t hold, every further attempt tends to add damage faster than it removes it, and the eventual cleanup costs more than stopping early would have.
Do static AI-built sites break too, or is this mostly a WordPress problem?
Static sites break less, which is a genuine argument for them: no database, no PHP, no plugin updates, and hosts like Vercel and Netlify serve them free. Less is not never, though. Forms still depend on third-party services with expiring keys, domains still lapse, and build tooling still rots, so a year-old static project can be unbuildable the day you finally want to edit it. The failure surface is smaller; the renewal calendar is identical.
Why is my website not working after an update?
Nine times out of ten it is a plugin conflict or a PHP update the site was not ready for. Roll back if your host keeps snapshots, then work through our triage guide before touching anything else — the order of operations matters more than the fix.