AI built your site in a weekend and it looked great on launch day. Six months later the contact form goes nowhere, the plugins are five versions behind, there is no backup anyone can restore, and no one is watching the server. Building a website and running one are two different jobs.
What problems show up on an AI-built website?
The site itself is rarely the problem. What fails is everything the build process never created: backups, update testing, monitoring, deliverability checks, and someone accountable when the checkout throws an error. AI generates a launch. It does not generate an operations plan, and most owners do not know one is missing until revenue drops.
I have looked at a lot of these sites in the last year. Small business owners who used ChatGPT to write the theme functions, or a builder that spun up pages from a prompt, or a freelancer who used AI to move fast on a fixed-price build. The work is usually competent: pages load, the design holds up, the copy is fine. Month one passes without incident. Month three is when the support email arrives.
According to the Stack Overflow Developer Survey, only 43% of developers said they trust the accuracy of AI coding tools, while 31% were openly skeptical (2024). Professional developers treat AI output as a draft that needs review. An owner who prompted their way to a working site has no reason to think that way, because the site worked.
Why does month three break things that month one did not?
Three things change between launch and month three: plugins update, credentials expire, and traffic patterns shift. A site that was internally consistent on launch day drifts, and nothing announces the drift. The contact form still shows a green success message after the email stops delivering.
Here is the sequence we see over and over. WordPress core auto-updates a minor version, and two plugins update with it. One of those plugins changed a hook name, and the custom code in functions.php that AI wrote against the old hook stops firing. That code was handling the form redirect, or the shipping rule, or the conditional pricing. No error appears on the front end because PHP notices are suppressed on production, so the feature is just gone.
Meanwhile, the SMTP API key from the free tier of a transactional email service hit its limit or expired. Form submissions now fail at the mail layer, which is one of the most common problems we find on sites nobody maintains. We wrote up the whole diagnosis path in our guide to fixing WordPress email deliverability with proper SMTP setup, and the fix is usually 20 minutes. The expensive part is the eight weeks before anyone looked.
The five failures we find most on AI-built sites
- Forms that send to nowhere. This is the most expensive and the most common: no SPF or DKIM records, an expired API key, or a hook that stopped firing. Every inquiry that comes in is a lead your competitor eventually gets.
- No backup you can restore. A plugin writing nightly archives to the same server is not a backup. When the server is compromised or the disk fills, the backups go with it. Our WordPress backup strategy breakdown covers what off-site and tested mean in practice.
- Plugins four to eight versions behind. Auto-updates get disabled during the build to avoid breaking things, then never re-enabled. That is how a site ends up running a plugin with a published CVE for months.
- Checkout that stops taking payments. A gateway credential rotates, a shipping method throws a fatal, or a tax plugin update breaks the cart total. Orders stop. Store owners who assume a slow week is just a slow week lose whole months. This is the core argument for managed hosting on a WooCommerce store instead of shared.
- Hosting nobody is monitoring. An uptime pinger tells you the homepage returns a 200. It tells you nothing about a form, a cron job, or a payment failure, which is exactly the gap we described in what uptime monitors miss on a WordPress site.
What does a broken form or checkout cost?
Run the math on your own numbers before you decide maintenance is expensive. A home services company getting 18 form inquiries a month, closing one in five, at a $2,400 average job, is producing about $8,600 a month in booked work from that form. If the form fails for six weeks, that is roughly $13,000 in inquiries that went to a competitor, and you will never see them in a report because they never arrived.
E-commerce is worse because the damage is measurable and immediate. Our own analysis of what website downtime costs a business puts the range at $137 to $427 per minute for mid-sized operations. A checkout error is functionally downtime for the only page that makes money.
| Failure | Typical time to discovery | Revenue exposure |
|---|---|---|
| Contact form not delivering | 3-8 weeks | Every lead in that window |
| Checkout fatal error on one shipping zone | 2-6 weeks | Orders from that region |
| Plugin vulnerability exploited | 1-4 weeks | Cleanup plus SEO damage |
| No restorable backup during an incident | Discovered at the worst moment | Full rebuild cost |
| Expired SSL or DNS misconfiguration | Hours to days | Traffic drop plus trust loss |
None of these require bad code. They require an unmaintained site, and every site becomes unmaintained by default.
Building a site vs running a site: who covers what
AI is useful for the build. We use Claude every day to ship products, and we documented how we built our AI website audit tool with Claude, including where the model's judgment stops and human review starts. The limitation is ongoing: a model has no relationship with your server, your plugin versions, or your payment gateway.
| What the site needs after launch | Does an AI builder handle it? | Your time if you do it | Covered by managed hosting |
|---|---|---|---|
| Core, plugin, and theme updates tested on staging | No | 1-2 hrs/month | Yes |
| Off-site backups with verified restores | No | 30-60 min/month | Yes |
| Malware scanning and cleanup | No | Unpredictable | Yes, via TopSyde Sentinel |
| Uptime, cron, and checkout monitoring | No | Constant attention | 24/7 monitoring |
| Form and email deliverability checks | No | 15 min/month | Yes |
| PHP version upgrades and compatibility | No | 1-3 hrs/year | Yes |
| Someone to answer when it breaks | No | You are the someone | Support under 2 hours during business hours |
Add the middle column up and you are at 3-5 hours a month of work you did not budget for, plus the incident you cannot schedule. For most owners that time is worth more than $89/mo, which is where TopSyde pricing starts per site. The full list of what is included lives on our spec sheet.
How do I check my AI-built site this week?
Work through these in order. Every one is something you can verify yourself in under an hour, with no developer.
- Submit your own contact form from a personal email address and confirm the message arrives in the inbox that is supposed to receive it. Then check the spam folder. Then check whether the notification goes to an employee who left.
- Place a real test order if you sell anything, using a live card and a real shipping address, on each shipping zone you serve. Refund it after. This catches gateway and tax failures nothing else will.
- Download a backup and open it. Not check that backups exist. Download the most recent file and confirm it contains both the database and
wp-content. If you cannot find it, you do not have one. - Open your plugins page and count how many say "There is a new version available." Anything more than two versions behind on a security-relevant plugin is a live risk. Our WordPress update strategy for core, plugins, and themes explains how to sequence the catch-up without breaking the site.
- Check your PHP version under Tools, Site Health. Sites built in a hurry often sit on a version that stopped getting security patches.
- Search Google for
site:yourdomain.comand look for pages you did not create. Injected spam pages are the most common evidence of a plugin exploit that happened weeks ago.
If that list makes you uncomfortable, run our free homepage audit first. It reads public signals from your site, runs them through Claude, and gives you a prioritized report with clear limits on what it can and cannot see from the outside.
What managed hosting covers that an AI builder does not
Managed hosting is the operations layer. Updates get tested on staging before production, backups go off-site and get restore-tested, and monitoring watches more than an HTTP 200. Malware detection runs server-side through TopSyde Sentinel rather than waiting for a browser warning. When something breaks, a person responds under 2 hours during business hours.
If you want the full scope of what the category includes before you compare vendors, we laid it out in what managed WordPress hosting covers in 2026. And if you are a freelancer or agency who has been absorbing this maintenance work into fixed-price builds, the numbers in what DIY WordPress hosting costs an agency every month will be familiar.
For owners running one or two sites, our plans for individuals and small businesses are the right starting point. Migration is handled on our side, and there is a 30-day money-back guarantee, so the decision is reversible. The sites we see in the worst shape are never the ones built badly. They are the ones built well and then left alone for six months.
Frequently asked questions
Is an AI-built website less secure than one a developer built?
Not inherently. The security gap comes from maintenance rather than authorship. A site built by a developer and abandoned for six months is in the same position as an AI-built one: unpatched plugins, no monitoring, no tested backups. Patchstack found 97% of disclosed WordPress vulnerabilities in 2023 came from plugins, and plugins need patching regardless of who installed them.
Can I just turn on auto-updates and stop worrying?
Auto-updates reduce the vulnerability window, which is worth doing. They also break sites, especially sites with custom code written against specific plugin hooks. The safer pattern is auto-updates for security releases plus staged testing for major versions, which is what a managed host handles on your behalf.
How do I know if my checkout is broken right now?
Place a live test order on every shipping zone and payment method you offer, then refund it. Analytics will not tell you, because a failed checkout often still fires the add-to-cart event and never fires the purchase event, which reads as normal abandonment. Order volume dropping without a traffic drop is the signal to test immediately.
What does the free audit check?
It collects public signals from your homepage: performance, basic accessibility markers, SEO structure, and visible security indicators. Claude prioritizes the findings into a ranked report. It cannot see inside your database, your backup configuration, or your plugin versions, and we say so in the report rather than guessing.
Senior WordPress Engineer
8+ years WordPress & WooCommerce development
Rachel is a senior WordPress engineer at TopSyde specializing in WooCommerce performance and plugin architecture. She has built and maintained high-traffic e-commerce sites processing millions in annual revenue.
