Can you build a website with AI? Yes, and it’s fast. Every day I come across online posts from someone who built a website with Lovable in an afternoon. But a website you build in an afternoon still needs someone to look after it for years. Last week proved that once again.
On 21 October 2026, a serious security vulnerability in PHP was made public. Two critical vulnerabilities were discovered, together dubbed PHP2Shell. The risk was high. To give you an idea, an estimated 70 per cent of the web runs on PHP. In the worst case, an attacker could use these flaws to run their own code on a web server from the outside, and so take over a website or view data, for example. As a precaution, many organisations worldwide took their websites offline.
One thing first: this vulnerability was in PHP itself and hits custom-built websites just as hard as websites made by AI. So the question is not whether AI websites are less secure than others. The question is who looks after your site when something like this happens. And whether you actually know what your website runs on.
What can an AI website do?
An AI tool builds a website incredibly fast, and that is certainly useful.
We would choose it ourselves for a prototype you want to show internally. Other uses that work are short-lived campaign pages without user data, or small informational websites that rarely change and need no payments, logins or personal data.
With AI you build a website quickly and cheaply, which is a real gain in these situations.
When do we definitely not choose an AI website?
As soon as your website is an essential part of how you operate, the situation changes. That is the case for a festival, a concert hall, a web shop or a healthcare organisation, for example.
No CMS, no scheduling
A pure AI website often has no CMS behind it that lets an editorial team manage the content. A line-up announcement at 10 a.m. can then not happen automatically. Someone has to have it generated and published at that moment. If something is scheduled anyway, that data is already in the frontend and can in principle be traced.
In our Architect CMS, you can easily schedule news items, pages and line-up announcements. The data stays shielded until the moment it is allowed to go online.
AI-generated code is not secure by default
The 2025 GenAI Code Security Report by Veracode shows that AI models introduced a security flaw in 45% of the tasks tested. The study tested more than 100 AI models on 80 specific tasks, not complete websites.
The flaws found fall under the OWASP Top 10. This is a list of the ten most important categories of security risk for web applications, through which malicious actors can gain access to data.
That figure does not mean an AI website is automatically insecure. It does show that AI-generated code is not secure by default. You can’t trust it blindly, and a review by an experienced developer remains essential. That is Inventis’s view on AI.
Maintenance
With PHP2Shell it was a race against the clock. As soon as the vulnerability became public, information on how to exploit it also started circulating. That immediately caught the attention of hackers. The same day, there were already numerous reports of active attempts to exploit the flaw.
As soon as we were informed, we took action straight away together with our hosting partners. The official security updates for the current PHP versions were made available the same day.
But who takes on that responsibility for a website generated with AI? Who follows up on security issues and makes sure the necessary updates are carried out? Without a clearly responsible person, there is a risk that maintenance is postponed or even skipped altogether. And that is exactly where the danger lies: putting a website online is one thing, keeping it secure and up to date is another story.
Do you know what your website runs on?
The PHP vulnerability raised a question that many organisations could not answer straight away: does our website actually use PHP, and in which version?
That is understandable. Technology sits deep inside a website and you can’t see it. With an AI tool it is even vaguer, because the technical choices are made behind a prompt. But if you don’t know which technology your website is built with, you also won’t notice when a vulnerability is circulating. And if you don’t notice, you can’t react.
If nobody can answer which technologies your website uses, who follows up the security alerts for those technologies, and who makes sure patches are applied within a reasonable time, then you have a website without an owner for its maintenance. That applies to an AI website, but just as much to a website that was once delivered by an agency. So feel free to ask us too.
Integrations
A website that controls ticketing, an app, a CRM or a stock system has to keep working when an external API changes. With AI you can generate an integration easily and quickly, but who stays informed and tests it with every change? And more importantly, who notices when the integration fails?
We build and monitor numerous integrations, from ticketing and planning to CRM and ERP. You can find the full overview on our partners page.
Peak traffic
A static page handles peaks well. Peak traffic on dynamic components such as ticket sales doesn’t just take care of itself. That takes hosting, caching and queueing, with monitoring and follow-up during the peak itself.
A website rarely gets even traffic. As soon as a line-up is announced or ticket sales open, everyone arrives at once. Whether an AI website keeps working with thousands of simultaneous visitors, you only find out by testing it, and you can’t redo the moment of your peak.
A peak also hits your integrations. Every visitor also puts load on the external system. That calls for deliberate choices: what do you store, what do you fetch live, and what happens when the external system slows down? You design that in advance and don’t leave it to generated code. On top of that, someone has to be responsible at the moment itself.
Together with our hosting partners, we make sure the infrastructure is prepared for this. Peak traffic doesn’t go away, and no platform removes every risk. What you can do is prepare, test and follow up. That is exactly where a platform with experience makes the difference.
Accessibility and legislation
Since 28 June 2025, the European Accessibility Act has applied, setting WCAG 2.1 level AA as the standard for web accessibility. But what does that mean in practice? A website must also be usable for people with a disability. Think of enough contrast between text and background, navigation that can be operated with a keyboard, and images with text for screen readers. That takes more than a visually appealing website: the structure, code and interactions have to be right too.
AI tools can easily build a website, but there is no guarantee that the website meets all accessibility requirements.
Our approach: a solid foundation, with room for AI
At Inventis, we see AI as an extension, not a foundation. A good website takes care of hosting, stable peak traffic, reliable integrations and compliance with applicable legislation such as GDPR and WCAG.
Our Architect CMS therefore includes the option to add vibe-coded components. These components run isolated from the platform. A wrong prompt can therefore make the component fail, but it can’t break the website.
We are a web agency, so we have a stake in this position. That is why we are also honest about when an AI website is a good choice.
Doubting whether an AI website is right for you?
Tell us what your website needs to do, and we'll tell you honestly whether AI will do.