Using AI to Build Websites: Our Process, Stage by Stage

Near the end of most first meetings now, someone asks the question a little carefully, as if it might be rude: "Do you use AI?"

Yes. We use it every day. Using AI to build websites is now normal practice for any serious agency, and pretending otherwise would be odd. The honest answer is more useful than the yes, though. AI drafts, suggests and checks quickly. People decide what gets built, review every line that ships, and own the result when something breaks. Below is exactly where the tools sit in our process and where they don't.

The short version, in one table

Stage	What AI does	What a person does
Discovery and research	Summarizes competitor sites, pulls out common questions customers ask	Talks to you, decides what matters for your business
Sitemap and content structure	Proposes page lists and heading outlines	Cuts, merges and orders pages around how your customers buy
Copy first drafts	Writes rough drafts from your notes	Rewrites for your voice, checks every claim with you
Design exploration	Generates layout ideas and variations quickly	Picks a direction, designs the real thing
Coding	Drafts functions, templates and repetitive markup	Reviews every line, rewrites anything touching security or payments
Testing	Writes test cases, flags obvious errors	Tests on real phones, real forms, real payment flows
SEO and schema	Drafts meta descriptions and structured data	Checks accuracy against what the business actually does
Launch and after	Helps read logs and error reports	Runs the launch checklist, owns fixes

Stage by stage: what AI does and what we do

Discovery and research

Before a first draft of anything, we need to understand your market. AI is good at the grunt work here: reading ten competitor sites and listing what services they push, which questions keep appearing in reviews, how pricing is presented.

What it can't do is sit in the meeting. It doesn't know that your best clients come from referrals, or that the product line on page one of your brochure is the one you're quietly phasing out. That comes from talking to you, and it changes the whole site.

Sitemap and content structure

Ask an AI tool for a sitemap for a logistics company and you'll get Home, About, Services, Blog, Contact. Every time.

We use the suggestion as a checklist of things not to forget, then build the structure around how your customers decide. A B2B buyer comparing three suppliers needs different pages from a homeowner who wants a quote by Friday. Clear page topics and question-shaped headings are also what Google and AI search tools lift answers from.

Copy first drafts

AI writes a decent first draft from rough notes. It also writes the same first draft for your competitor. You've read this copy a hundred times: "We are passionate about delivering innovative solutions tailored to your unique needs." Nobody has ever called a company because of that sentence.

So drafts get rewritten by a person, with your real details in them: the areas you cover, the turnaround you can actually promise, the question customers ask on every call. Any fact the AI added gets checked with you or deleted. Language models are fluent guessers, and a guessed claim about your business (a certification you don't hold, a guarantee you don't offer) is a liability once it's live. Google's own guidance on AI-generated content is clear that it's fine to use these tools, and that pages with little originality or added value can fall foul of its spam policies. Generic AI copy is a ranking problem as well as a sales one.

Design exploration

AI lets us try ten layout ideas for a services page instead of two. Most are bland; one or two spark something. Then a designer takes over, because AI always drifts back toward the template, and your site's job is to look like you.

Coding

This is where AI saves the most time and where it needs the closest watching. We build mostly in hand-written HTML, CSS, JavaScript and PHP, and an AI assistant is very good at the repetitive parts: a pricing table, a form handler skeleton, forty product cards with the same markup.

That reading is the job. Anything that touches logins, payments, file uploads or customer data gets written or rewritten by a developer who understands exactly what it does. Server configuration never goes live on an AI's say-so; that goes through Franro and our in-house server team, who've been running Unix servers for more than a decade.

Testing

AI writes test cases quickly. It won't notice that the contact form looks fine on a desktop but the submit button sits under the chat widget on a Samsung A-series phone. We test on actual devices, submit every form, and put real transactions through the payment gateway before launch.

SEO and schema

AI drafts meta descriptions and structured data (the behind-the-scenes code that tells search engines what a page is about) quickly and usually in valid syntax. It also invents details with the same confidence: opening hours you don't keep, a street address that's slightly off, a service area twice the size of yours. Every line gets checked against reality.

Launch and after

At launch the checklist is human: payment gateway switched from sandbox to live, contact forms delivering to the right inbox, tracking firing, redirects from the old site in place. We once stopped a store going live with its gateway still in test mode. It would have accepted orders without taking a cent. No tool flagged that; a person going down a list did.

After launch, AI helps us read error logs faster. Fixing what's wrong stays with the team.

The mistakes AI makes that we catch

None of these are rare.

Code that's almost right

In the 2025 Stack Overflow Developer Survey, 84% of developers said they use or plan to use AI tools, and the top frustration, named by 66%, was AI answers that are almost right but not quite. That matches what we see. The code runs, and it's wrong in a way that only shows up with real money or real data.

A store we took over had exactly this kind of bug, though we don't know who or what wrote it. Customers paid successfully through the payment gateway, but orders never marked as paid, because the code checking the gateway's payment notification was stripping out empty fields before verifying the signature. Every check failed. Money arrived; the system had no idea. The code looked tidy and reasonable. AI produces this kind of mistake at speed, which is why "it works on screen" is never the test.

Insecure by default

Veracode tested code from more than 100 language models and found that 45% of samples introduced a known class of security flaw (from the OWASP Top 10). Their spring 2026 update found security pass rates still sitting around 55%, barely moved in two years, even as the code itself got better at compiling. We cover what to check on your own site in our website security checklist.

Packages that don't exist

This one surprises clients. AI assistants regularly recommend software libraries that were never published. A study presented at USENIX Security 2025 analyzed 576,000 code samples from 16 models and found commercial models suggested non-existent packages at least 5.2% of the time, and open-source models 21.7% of the time. Attackers have noticed. They register those invented names and fill them with malicious code, a trick now called slopsquatting. The Cloud Security Alliance documented one invented package picking up more than 30,000 downloads in three months. Our rule is simple: nothing gets installed because an AI suggested it. A person checks that it exists, who maintains it, and whether we need it at all.

Outdated code

Models learn from years of old tutorials, so they happily suggest functions the language has since retired. A typical example in PHP is utf8_encode(), which was deprecated in PHP 8.2. It works today and breaks on a future server upgrade, usually at the least convenient moment.

Accessibility gaps

The WebAIM Million 2026 report found detectable accessibility failures on 95.9% of the top million home pages, up from the year before, and pointed to AI-assisted coding as one reason pages are getting heavier and more complex. AI-generated markup regularly skips the dull basics: text contrast, alt text, form labels. We check them by hand, because a form a screen reader can't read is a form some of your customers can't fill in.

What this means for you as a client

You get the site sooner. Typing time has dropped, so our usual three to six weeks from receiving your content is spent more on the parts that affect inquiries: structure, copy, testing on real phones.

You don't get a cheaper-looking site. The time AI saves goes into detail, not into doing more sites with fewer people. Our website design packages still include speed optimization, conversion tracking, security configuration and two review rounds, all checked by a person.

And you should know what goes into the tools. Anything typed into an AI service is processed on that provider's servers, and US privacy laws such as the CCPA/CPRA set rules for how the businesses they cover handle and share customers' personal information. Your customer list has no business in a chatbot prompt.

If AI does the work, why pay an agency?

Fair question. Honestly, if you need a five-page brochure site and you're comfortable with an AI builder, you might not. For plenty of small businesses that's a reasonable choice, and we compare the options in our post on AI-assisted development versus vibe coding.

For a business with staff, a sales team and a reputation, the value was never the typing. It's knowing what to build for your customers, and knowing when the code is wrong even though it runs. AI has made the typing nearly free. It hasn't made the judgment any cheaper, and a store that quietly fails to record payments costs far more than the build did.

Luado, our projects manager, keeps track of which new AI tools are worth adopting and which are noise. The ones that earn a place make us faster. None of them get to sign off on your site.

Questions to ask any web designer about AI

Which parts of my site will AI write, and who reviews them?
Who checks code that handles payments, logins and customer data?
Will any of my business or customer data be put into AI tools?
How do you check that plugins or packages are genuine and maintained?
Will you test on real phones and put a live payment through before launch?
If something breaks because of how you built it, who fixes it, and who pays?

A good answer to every one of these is specific. "Don't worry, we handle all that" isn't.

If your current site was built quickly, by a person or a tool, and you'd like to know whether it holds up, send us the link. We'll look at it properly and tell you honestly what we'd change, including if the answer is "not much".

Frequently asked questions

Does my web designer use AI?

Very likely, yes. Most developers now use AI tools in some form. The question to ask is which parts it touches and who reviews the output, especially code that handles payments or customer data.

Is a website built with AI bad for SEO?

Not by itself. Google says AI-generated content is acceptable if it's accurate and useful, but pages with little originality or added value can breach its spam policies. Generic AI copy that reads like every competitor's is the bigger risk.

Is AI-generated website code secure?

Not reliably. Veracode found 45% of AI-generated code samples introduced a known type of security flaw, and its 2026 update showed little improvement. AI code needs review by a developer who understands security before it goes live.

Does using AI make a website cheaper?

It makes some work faster, mainly repetitive coding and first drafts. At a careful agency that saved time goes into structure, copy and testing rather than a lower-quality build. Planning, review and testing still take people.

Can AI tools see my customer data?

Only if someone puts it in. Anything typed into an AI service is processed on that provider's servers, and privacy laws such as the CCPA/CPRA set rules for how customers' personal information is handled and shared. Ask your designer directly what goes into their tools.

Using AI to build websites: how we actually do it, stage by stage