Vibe Coding Websites + Why I’m Not Leaving WordPress for the Latest AI Hype

I recently watched a video of a former WordPress developer vibe coding websites with VS Code, Claude, GitHub, Vercel, and Sanity CMS. Five different platforms chained together to serve what is, essentially, a static site with a content management option.

My first thought: this is pretty cool.

My second thought: this is dangerously complicated for what it accomplishes.

And my third thought — the one I can’t get out of my head — was about the business owners who will pay for sites built this way without understanding what they’re buying into.

I’ve been in web design long enough to know what hype looks like when it rolls through. I’ve also been around long enough to know that the tools don’t matter nearly as much as the thinking behind them.

So I want to break this down honestly — as someone who’s both curious about the future and concerned about what happens when we rush toward it.

I Didn’t Start With Confidence. I Started With Google Cloud Free Credits.

Back in 2017, I was brand new to WordPress. I didn’t come from a computer science background. I didn’t have a mentor in web development. What I had was curiosity, a willingness to figure things out, and Google Cloud’s free credit offer.

I spun up a server, installed WordPress, and started hosting dozens of my personal projects for free. It was a playground. I was learning in public, breaking things, fixing them, and slowly building an understanding of how websites actually work — from DNS to databases to file structures.

But here’s what I didn’t have:

• the confidence to sell web design as a service.

I could build things for myself. I could tinker and experiment. What I couldn’t do was look a business owner in the eye and say, “I understand this system well enough to be responsible for your online presence.” I knew too much about what I didn’t know.

That changed when I picked a proper hosting provider. For me, that was Kinsta. Suddenly, the infrastructure layer had guardrails. Backups were automatic. Security was handled at the server level. Support was available when I hit a wall. I wasn’t guessing anymore — I was operating within a system I could trust, explain, and hand off to a client.

That was over six years ago. And the confidence I built during that period is exactly what I see missing in the current wave of AI-built websites.

What Is Vibe Coding, and Why Should You Care?

The term “vibe coding” was coined by Andrej Karpathy, a co-founder of OpenAI and former AI lead at Tesla, in a social media post in February 2025. He described it as a style of building software where you “fully give in to the vibes, embrace exponentials, and forget that the code even exists.”

In practical terms, vibe coding means describing what you want in plain language — “build me a landing page with a contact form and a blog” — and letting an AI tool generate the code. You don’t review it. You don’t necessarily understand it. You just accept the output and move on.

For personal projects and weekend experiments, this is genuinely exciting. Karpathy himself framed it as ideal for “throwaway weekend projects.”

The problem is that vibe coding isn’t staying in the weekend project lane. It’s being marketed as a legitimate way to build production websites for paying clients. Platforms like Lovable, Bolt, Replit, and others are positioning themselves as tools that let anyone — regardless of technical background — ship functional web applications.

And that’s where my concern starts.

The Stack I Watched: Impressive Engineering, Questionable Fit

The setup in the video I watched — VS Code + Claude + GitHub + Vercel + Sanity — is what the development world calls a JAMstack architecture. JavaScript, APIs, and Markup.

For a developer who understands each layer, it’s elegant:

• Version-controlled code through GitHub
• Edge-deployed static output through Vercel
• Headless CMS for content through Sanity

Each piece serves a purpose. Each piece is also a separate service with its own pricing model, its own terms of service, its own deprecation timeline, and its own security surface.

For an experienced developer building a SaaS product or a high-traffic media site, this stack makes sense.

For a roofing company in Alberta or an HVAC contractor in Ontario who needs a site that loads fast, ranks well, and converts visitors into phone calls? This is engineering overkill that creates long-term dependency problems.

The Real Risk: Ownership and Maintainability

Here’s the question I keep coming back to: what happens when the relationship with the developer ends?

With a WordPress site on managed hosting, the client can log into wp-admin and see their own content. They can update a phone number. They can publish a blog post. They can hire any one of thousands of WordPress developers worldwide to pick up where the last one left off. The ecosystem is massive, documented, and standardized.

In fact, I teach all my clients how to use WordPress so they can enjoy total ownership and zero dependencies on me.

When a client pays for a vibe-coded site built on Vercel + Sanity + a GitHub repo, they now own infrastructure they:

• Can’t maintain without developer tooling and technical knowledge
• Can’t easily migrate to another platform without a rebuild
• Can’t access or modify without understanding Git, deployment pipelines, and API configurations
• Can’t hand off to another provider without significant onboarding

The portability story is fundamentally different. WordPress gives clients real ownership. A vibe-coded stack gives clients new dependencies.

Security: The Elephant in the AI-Generated Room

This is where the conversation gets serious.

According to Wiz Research, one in five organizations using vibe coding platforms have inadvertently exposed themselves to significant security risks. The most common issues include client-side authentication (passwords visible in browser code), leaked API keys, and exposed admin paths.

A Veracode study found that 45% of AI-generated code contains vulnerabilities from the OWASP Top 10 list — the industry’s standard benchmark for web application security risks. These aren’t obscure edge cases. We’re talking about SQL injection, cross-site scripting, broken authentication, and insecure data handling.

Databricks’ AI Red Team found that vibe-coded applications routinely ship with critical flaws that go unnoticed because the code “appears to just work.” The problem isn’t that AI can’t write secure code — it’s that vibe coding, by definition, means accepting code without reviewing it.

When I build a WordPress site on Kinsta, security is handled at multiple layers: server-level firewalls, automatic malware scanning, DDoS protection, and isolated container architecture. The CMS itself has 20+ years of security patches, a bug bounty program, and a global community of developers auditing core code.

When someone vibe-codes a site and deploys it to a platform they don’t fully understand — who’s responsible when it gets hacked?

• The AI?
• The platform?
• The person who typed the prompt?

That question doesn’t have a clear answer yet. And that alone should give business owners pause.

The Pricing Question Nobody Wants to Answer

Let’s say you don’t give a flying monkey whether your company’s website is vibe coded, built with HTML by human hands, or powered by WordPress.

In that case, how much does a vibe-coded website cost?

It’s a simple question with a deliberately fuzzy answer. Most vibe coding platforms operate on credit-based systems. You get a certain number of “AI edits” or “generations” per month. Need more? Buy more credits. Need to fix something the AI broke? That costs credits too.

Some platforms start with free tiers — five daily AI edits, three monthly projects. Paid plans range from $20 to $25 per month and up. That sounds cheap until you realize you’re paying recurring fees for a tool that generated code you can’t maintain without continuing to pay for that same tool.

Compare that to a professional WordPress build:

• You pay a project fee — and the result is yours.
• Your hosting is a separate, transparent line item.
• Your domain is yours.
• Your content is yours.
• Your theme files are yours.
• There’s no credit system.
• No opaque “effort-based” pricing.
• No surprise charges when you need to make an edit.

I’m planning a deeper analysis on the true cost of AI-built websites versus traditional builds. But the short version is this: cheap to start is not the same as cheap to own.

By The Way… What Happens When the Tools Go Down?

Right now, everything is evolving rapidly. We’re becoming dependent on AI tools to help us become smarter, faster, and more productive. I use AI tools every day in my own work. I’m not anti-AI. I’m anti-blind-trust.

But here’s what keeps me up at night:

• What happens when one of these tools goes down?
• When Claude goes offline for a day?
• When Vercel changes its pricing or deprecates a feature?
• When a SaaS company gets acquired by a venture capital firm that decides to sunset the product?
• When Sanity pivots its business model and your client’s CMS becomes an afterthought?

These aren’t hypothetical scenarios.

SaaS acquisitions and shutdowns happen constantly. And when your client’s entire web infrastructure is built on a chain of third-party services, every link in that chain is a potential point of failure.

WordPress has been around since 2003.

It powers over 43% of all websites on the internet and roughly 60% of the CMS market — more than three times the next five platforms combined, including Shopify, Wix, Squarespace, Joomla, and Drupal.

It’s open source, which means no single company can acquire it, sunset it, or change its pricing model. The code is yours. The community is global. The ecosystem is self-sustaining.

But hey, what do I know?

Maybe you should continue listening to your favorite internet guru on LinkedIn.

The Rise of AI Gurus (and Why It Matters)

There’s another dimension to this that doesn’t get discussed enough: the people selling vibe-coded websites.

The barrier to entry for building websites has never been lower. That’s genuinely good for personal projects, internal tools, and experimentation.

But it also means a wave of new “web designers” and “developers” are entering the market who have never configured a DNS record, never debugged a 500 error, never dealt with a site migration, and never been on the phone with a client whose website went down during a product launch.

They can prompt an AI to generate a website. They cannot explain what the code does, why it was written that way, or how to fix it when it breaks.

For business owners evaluating web design providers, this creates a new kind of due diligence question:

• Did this person build my website?
• Or did they prompt an AI to build it and accept the output without review?

The distinction matters.

Not because AI-assisted development is inherently bad — I use AI in my own workflow — but because there’s a stark difference between using AI as a tool within a process you understand versus using AI as a substitute for understanding the process at all.

Why I’m Staying With WordPress

After everything I’ve laid out, my position probably isn’t surprising. But I want to be clear about why.

I’m not staying with WordPress because I’m resistant to change. I’m staying because, for the clients I serve — B2B companies in industrial, manufacturing, and service sectors — WordPress remains the most responsible choice.

It’s a 20+ year-old proven system with a track record that no vibe coding websites can match. It makes handoff easy. It makes maintenance predictable. It gives clients genuine ownership of their web presence. And it allows me, as the person responsible for their digital infrastructure, to stand behind my work with confidence.

When I build a site on WordPress with managed hosting, I’m not hoping the AI got the security right. I’m not crossing my fingers that the deployment pipeline didn’t introduce a vulnerability. I’m operating within a system I understand, can explain, and can maintain.

The future will include more AI-assisted development. I’m certain of that. But “the future” and “what’s right for a B2B company investing $10,000 in a website today” are not the same conversation.

My Final Questions for Business Owners

Here’s what I’d ask you to consider:

• Are you turning to someone who knows how to build sites that drive your business forward?
• Someone who can deliver more of the right traffic, more of the right leads, and ultimately, more revenue?
• Or are you falling for hype?

Being steered into a system that’s going to need to be rebuilt again in two years when the platform pivots, the pricing changes, or the person who prompted the AI is nowhere to be found?

The answer to that question is worth more than any tool.