AI code vs human code: what the difference looks like on a live website.

What is the difference between AI-generated code and human code?

The only difference you can count on is authorship: a model wrote one from a prompt, and a person wrote the other. View your page source and you'll find HTML, CSS, JavaScript and response headers. No byline. No watermark. Your browser can't tell who typed it, and neither can you. (Try it on a page you think you can spot. You'll be guessing.)

You can judge the output itself: your rendering model, script weight, heading order, structured data and response headers. Each traces back to a decision you can inspect. A model decides from your prompt; a person decides from the project. Either one can decide well or badly. And your page shows which.

As you read the studies in the next section, ask what each one means for your pages. A defect rate in a pull request describes a repository, not your site. A missing header on your homepage? That describes your site, and you can fix it. So run the free assessment and see what your pages ship.

What do studies say about the quality and security of AI-written code?

The studies you will find mostly say AI-written code carries more defects and more security findings than human-written code, though the gap changes with the study. CodeRabbit's review of 470 open-source pull requests found 10.83 issues per pull request for AI code against 6.45 for human code, or 1.7 times more defects. Its table put cross-site scripting flaws at 2.74 times higher.

Veracode's 2025 study of 100+ LLMs found a 45% overall vulnerability rate. On cross-site scripting, the failure rate hit 86%. Tenzai then tested 15 applications built with Cursor, Claude Code, Replit, Devin and OpenAI Codex, five different tools, and none implemented CSRF protection or set any security headers. Five tools, one shared blind spot.

Not every result points the same way. One analysis of public GitHub repositories found 87.9% of AI-generated code has no identifiable CWE-mapped vulnerability, and an arXiv study found human code more duplicated, at 25.89% against 18.69%. Read these as risk signals about repositories. They are not verdicts on your site, and a repository is not a page.

What does AI-written code look like once it is a live page?

Once live, your AI-written code is whatever your build sent to the browser: a rendering model, scripts, headers and markup. Request your homepage and read your response headers (your browser's network tab will do). In the Tenzai test, none of the 15 applications set any security headers. Check whether yours did.

The studies cannot show you these, but your page can. View your source and check whether your content is in the HTML or arrives only after your scripts run. Weigh your scripts and images. Read your heading order and look for structured data, then open your robots file to see what crawlers may fetch. And none of this needs a login.

The assessment reads your homepage and up to eight sampled pages for the signals you checked. It cannot see your repository, so you will not learn about duplicated logic or made-up packages. What shipped? That you can learn, and it is the part your visitors meet. The rest stays in your repository, out of reach.

Can you tell from outside whether a site was AI-built?

No, you cannot tell reliably from outside. A public read of your site shows what your pages ship, not who wrote them. Open your page source and look for a pattern such as thin headers, a heavy script bundle or no structured data. But a rushed human build leaves the same marks. The pattern proves nothing about who wrote your code.

Authorship evidence sits in your repository, not your browser tab. GitClear's 2026 report tracks copy-pasted code, which rose from 9.4% of new code in 2022 to 15.7% in the first half of 2026. Count what share of your own new code you pasted. The arXiv study tracks revisits within 30 and 90 days. To see either, you need your commit history (the one thing your browser never receives). That is your blind spot.

If a tool claims to detect AI authorship from your live page, doubt it. Score your rendering model, headers, markup and crawler access instead, and let the result stand whoever typed your code. The free assessment runs that read on your own site and shows you what you ship. Evidence beats a guess about authorship.

Does it matter who wrote the code if the page works?

Not much, if "works" means more than "loads." Your visitors and crawlers judge what your page ships, not who typed it. And your page can render fine in your browser while still shipping no security headers, hiding your content behind scripts, or blocking crawlers in your robots file (it happens more than you'd think). So before you call your site finished, check your headers, your scripts and your robots file.

Author does matter for what happens next, so hold your own review habits against these numbers. Stack Overflow's 2025 Developer Survey found trust in AI tool accuracy fell to 33%, down from 43%. Yours may have dropped too. Second Talent reports that 71% of developers do not merge AI-generated code without manual review, and 66% spend more time fixing almost-right output. Do you review yours that way? LeadDev, citing Google's DORA report, says every 25% of additional AI usage creates 7.2% more instability. So check yours. Would you merge your own AI output unread?

Your visitors and crawlers see only your page, never your author. But if you cannot explain why your code does what it does, you cannot trust your next change. Your page works by luck, and luck runs out (usually on a deploy day). Run the free assessment on your site to see what your page ships to your visitors.

What should you review in AI-written code before it ships?

Check your diff against the core of SiteGround's checklist: your scope, unrelated edits, duplicated logic, new dependencies, and whether you can explain your change. Then decide. Keep it, refactor it, revert it, or escalate. Open your tests first. SpecStory notes that an agent can pass your suite by editing your tests (yes, really), so a green run proves less than you think.

Run your linters, type checker, security scanner and tests, as Real Python's five-step workflow has you do. Then confirm that every method and import in your diff exists, and that every dependency you added is a real, published package. You'll miss made-up APIs and packages by eye, because they read fine. But they fail at install, and they are a common AI failure.

Vibe Coder Blog says Veracode's 45% vulnerability figure drops to under 10% when you apply a structured review process. Treat that as a secondary-source claim, not a guarantee for your team. And code review can't show you what your site sent the browser, so run your page through the public read.

How do you check a site's condition regardless of who wrote it?

Run the free assessment on your site's URL, and you get a score out of 100 whoever wrote your code. It reads your homepage and up to eight sampled pages. Enter your address and your work email. Your report link arrives once, in about two minutes. And you can run three checks per hour per connection, so rechecking after your fix is fine.

Your score weights eight pillars: operational health 16%, architecture 15%, performance 15%, security 12%, search 12%, schema 10%, AI readiness 10% and editorial experience 10%. Each pillar comes with its evidence. So you see which header, script or heading on your pages earned the number.

Your bands show where you stand: 80 to 100 is good standing, 60 to 79 constrained, 40 to 59 at risk, and 0 to 39 legacy condition. The read does not log in to your site, read your analytics, use your field performance data or interview you. It judges your page and leaves the author out of it. If your AI tool wrote your site, you get the same read as if you typed every line (no discount, no penalty).

Questions, answered.

Check your own site.

1. 01Website repairDown, hacked or broken: what survives, what to rebuild.
2. 02Website health checkThe general read, all eight pillars.
3. 03Next.js SEO auditRendering mode, metadata, hydration cost.

More from What Ships.

1. 01The best vibe coding tools in 2026, judged by what they ship.Tools · 2026-10-25
2. 02The best AI website builders, by what their sites score.Builders · 2026-10-25
3. 03Lovable vs Bolt vs v0: what each one ships.Head to head · 2026-10-25