This guide is for anyone who has built a website with Lovable, Bolt, v0, Replit, Claude, ChatGPT or Framer, or by hand, and now wants to put it in front of customers. It's also for freelancers who build sites with these tools for clients. You don't need to be a developer. We explain each term as it comes up.
AI builders are very good at the part you can see. The parts you can't see decide whether the site keeps working: where the code lives, who holds the domain, whether the contact form reaches your inbox, and what happens when something breaks at 9pm on a Friday.
We'll go from the basics to the finishing touches: owning your code, the domain and hosting, SSL, the contact form, privacy and analytics, backups and updates, and who looks after it. A launch checklist sits at the end.
Get a copy of your code you control
Your website is a set of files: the code that lays out each page, plus images and text. While you build, those files sit inside the AI tool's account. If the tool changes its pricing, your plan lapses or the account is closed, you want a copy somewhere else.
The usual place is GitHub. GitHub stores code in a repository, which is a folder that remembers every version of every file. A repository can be private, so only you and the people you invite can see it. Every major AI builder can send your project there.
- Lovable: connect GitHub in the project settings. Lovable creates a repository and keeps it in sync both ways, so changes made in Lovable appear in GitHub and changes pushed to GitHub flow back. Lovable's docs say that if you disconnect, the repository stays on GitHub.
- Bolt: connect GitHub from the project. Bolt commits your work automatically each time a change doesn't break the project, and its docs note that once the code is in GitHub you can publish it with Bolt hosting, Netlify or another service.
- v0: connect a new or existing repository in the project settings. v0 creates a private repository, pushes the current code to it, and from then on treats GitHub as the source of truth.
- ChatGPT, Claude or by hand: the files are probably on your computer already. Create a private repository and upload them, or ask a developer to do it once.
Domain, hosting and SSL
Three separate things put your site on the internet. The domain is your address, such as yourbusiness.com.au. Hosting is the computer that sends your files to visitors. SSL is the security certificate that gives you the padlock and the https at the start of the address. Our guide to what website hosting is explains how they connect.
The domain
Register the domain in the business's own name. For a .com.au, auDA, the body that runs .au names, requires a connection to Australia, usually an active ABN or ACN, and the name has to relate to your business, such as its name, an acronym or a service you offer. You have to keep meeting those rules for as long as you hold it. Our guide on how to buy a .com.au domain walks through it, and how to put an AI-built website on your own domain covers connecting it.
Hosting, and when free is enough
Free hosting is real and often good. Read the terms, because several free tiers rule out business use or stop when you hit a limit. At the time of writing (October 2026):
- Vercel Hobby: free, with 100 GB of data transfer a month included. Vercel's fair use guidelines restrict Hobby to non-commercial personal use. A site that advertises a product or service, or one someone was paid to build or host, needs a paid Pro plan.
- Netlify Free: 300 credits a month with a hard limit and no automatic top-up. The Personal plan is US$9 a month.
- Cloudflare Pages Free: requests for static files are free and unlimited, with 500 builds a month. A strong option for a simple site that doesn't change often.
- GitHub Pages: free, but GitHub says it isn't intended or allowed as free hosting to run an online business.
- The AI builder's own hosting: convenient while you're testing. Lovable, for example, offers custom domains only on paid plans.
For a personal project or a side project with no commercial purpose, the free tiers are enough. For a business site, check that the plan allows commercial use, and decide who will watch the limits. Our guide on where to host a website you built yourself compares the options in more detail.
SSL
Without SSL, Google Chrome labels a site "Not secure" and warns people not to enter personal information. Every host listed above sets SSL up for you, usually with free certificates from a service like Let's Encrypt. Those certificates last 90 days and renew automatically, which is why a site whose domain or hosting settings drift can suddenly show a security warning. After launch, open the site and check for the padlock.
Make sure the contact form reaches you
AI builders are good at drawing a contact form. Making it send anywhere is a separate job, and it's the most common gap we see. A form can look perfect, say "Thanks, we'll be in touch" and send nothing.
- Test it like a customer. Fill it in on your phone, on mobile data, and check the message arrives. Then check your spam folder.
- Check the sender is set up properly. Forms send email through a service, and that service has to be authorised to send for your domain. Google requires every sender to Gmail addresses to use SPF or DKIM, two DNS records that prove an email really came from your domain. Without them, enquiries can land in spam or vanish.
- Keep secret keys out of the page. Many AI-built sites use Vite, and Vite's docs warn that any setting starting with VITE_ ends up in code anyone can read, so it shouldn't hold API keys. If your form or database uses a secret key, it needs to sit on the server side.
- Send it somewhere someone reads. A shared inbox or the owner's phone works better than an address nobody checks.
Privacy policy and analytics
A contact form collects names, emails and phone numbers, which is personal information. The Privacy Act 1988 covers businesses with an annual turnover over $3 million, and some smaller ones too, such as health service providers. Many small businesses are exempt, but our guide on whether your website needs a privacy policy explains the exceptions and what a policy should say.
Analytics tools often decide the question for you. Google Analytics' terms require you to have an appropriate privacy policy and to disclose that you use Google Analytics. So if you add it, publish a privacy policy and link it in the footer.
Analytics tells you how many people visit, where they come from and which pages they read. You have free choices:
- Google Analytics: free, detailed, and the most widely used. It takes some learning.
- Vercel Web Analytics: 50,000 events a month on the Hobby plan. Collection pauses when you hit the limit.
- Cloudflare Web Analytics: free, and Cloudflare says it doesn't collect or use your visitors' personal data.
- Google Search Console: a different kind of tool. It shows how Google crawls and indexes your site and which searches you appear for. Set it up on day one with our guide to adding your website to Search Console.
Backups, updates and security
If your code is in GitHub, you already have a history of every version. That covers the code. It doesn't cover anything the site collects, such as form entries, bookings or a database of products. The Australian Cyber Security Centre recommends regular backups for every business, kept somewhere separate and tested so you know they restore.
Modern websites are built from dependencies, which are small packages of code written by other people. An AI-built site can rely on hundreds of them. Now and then a security flaw is found in one, and the fix is to update it.
- npm audit: a command that checks your project's dependencies against a list of known security problems and can apply fixes.
- Dependabot: a free GitHub feature that watches your repository and opens a suggested update when a dependency has a known vulnerability.
- Someone to review: an update can break a page. Somebody needs to check the change, test the site and publish it.
A simple static site with few dependencies needs little of this. A site with logins, a database or payments needs much more, and it's worth getting a developer to review it before launch. If the worst happens, our guide on what to do if your website is hacked has the steps.
Who fixes it when it breaks
Every website breaks eventually. A domain renewal fails on an expired card, a hosting limit is reached, an update breaks the menu, or the form stops sending. The question to settle before launch is who notices and who fixes it.
- You do it yourself. Free or cheap, and fine if you enjoy it and have the time. Write down every login and where each part lives.
- The freelancer who built it. Agree in writing what's included, how fast they respond and what happens if they stop working on it.
- Managed hosting. You pay monthly and someone else watches the site, keeps it updated and makes small changes.
Lumeen hosting is one managed option for sites built with HTML, Next.js, React, Vite or Astro, including exports from Lovable, Bolt and v0. We move the site in free. Essentials is A$24.99 a month with SSL, DDoS protection, automatic backups, up to 1 million requests and 5 edits a month. Growth is A$49.99 a month with 3 million requests, 15 edits, feature development and quarterly speed and SEO work. Both include GST and are month to month. We don't host WordPress or PHP sites, sites with their own database or server, or online shops.
Your launch checklist
Work through this list before you tell anyone the site is live.
- Code: in a private GitHub repository owned by the business.
- Domain: registered in the business's name, with auto-renew on and a current card.
- Hosting: on a plan that allows commercial use, with someone watching the limits.
- SSL: padlock showing on the main address, with and without www.
- Contact form: tested from a phone, arriving in an inbox someone reads, not in spam.
- Secrets: no API keys in front-end code.
- Privacy policy: published and linked in the footer if you collect details or use analytics.
- Analytics and Search Console: set up and showing data.
- Backups: covering anything the site collects, and tested once.
- Updates: Dependabot or a person checking dependencies.
- Logins: written down and stored in a password manager.
- Support: a named person who fixes it when it breaks.
- Phones: every page checked on a real phone, including tap-to-call links.
Once it's live, give Google a little time to find it. If it still doesn't show up, our guide on why an AI-built website isn't showing on Google covers the usual causes.
Key takeaways
- (01)
Put your code in a private GitHub repository owned by the business, so you can move it whenever you need to.
- (02)
Register the domain in the business's name, and host on a plan that allows commercial use.
- (03)
Test the contact form from a phone, and keep secret keys out of front-end code.
- (04)
Decide before launch who backs it up, updates it and fixes it when it breaks.
Frequently asked questions
Can I keep using the AI builder after I export to GitHub?
Usually yes. Lovable and Bolt keep syncing with the repository, so you can keep editing in the builder while GitHub holds a copy. v0 works on separate branches and merges into your main branch when you publish.
Is free hosting good enough for a business website?
Sometimes. Cloudflare Pages allows unlimited requests for static files on its free plan. Vercel's free Hobby plan is for non-commercial personal use only, and GitHub says Pages isn't for running an online business. Check the terms before you launch.
Do I need a privacy policy for a small website?
If you collect any personal details or use Google Analytics, publish one. Google Analytics' terms require a privacy policy, and some small businesses are covered by the Privacy Act even under the $3 million turnover threshold.
Why isn't my contact form sending emails?
Often the form was never connected to an email service, or the sending service isn't authorised for your domain, so messages land in spam. Test it from a phone, check spam, and make sure SPF or DKIM records are set up for the sender.
More answers on price, hosting and timing in our FAQ.