Lovable SEO and security: 90 live apps checked
We ran the same homepage checks on every live app in VibeKing's list of apps built with Lovable. These are the counts of what a normal browser receives from each one. No app is named, and none of this is a security audit.
Search basics: mostly in place
n = 90 homepages
The head of the page is where Lovable apps do best: 88 of 90 have a real title, 88 a share image, and none tells search engines to stay away. The gaps are structured data (37 have none) and canonical links (48 have none).
What a crawler gets before JavaScript runs
n = 90 homepages, visible text in the HTML the server sends (median 72 characters)
51 of 90 homepages send an app shell: almost no text until JavaScript fills the page in the browser. That does not mean search engines see nothing. Lovable's documentation says "Older React + Vite apps are pre-rendered for verified crawlers when they request a page", and names search engines such as Google and Bing and "AI search crawlers such as those of ChatGPT, Perplexity, Claude, and Gemini". It also says "Unverified bots and link checkers see the regular single-page app".
We are not a verified crawler, so we cannot see the pre-rendered version. Fetching 8 of the shells again with Googlebot and GPTBot user agents returned the same shell. For new projects the question goes away: the same documentation says "Apps created from May 13, 2026 (June 22, 2026 on Enterprise plans) use TanStack Start with server-side rendering", and "Every request returns fully rendered HTML, for humans and crawlers."
Why it matters for AI answers: Vercel's study of AI crawler traffic found that "none of the major AI crawlers currently render JavaScript", naming OpenAI's GPTBot, OAI-SearchBot and ChatGPT-User, Anthropic's ClaudeBot and PerplexityBot. Whatever HTML they are served is all they read.
AI readiness
n = 90 homepages
56 of 90 publish an llms.txt, a plain-text summary written for AI assistants. 2 block at least one of the three AI crawlers above in robots.txt; the rest allow all three, or have no robots.txt, which allows them by default.
Security headers: HTTPS yes, hardening rarely
n = 90 homepages, response headers and page HTML
Every app is on HTTPS and 87 of 90 send HSTS. Only 6 send a Content-Security-Policy, which limits where scripts can load from, and 84 can be loaded inside another site's frame, which is what clickjacking relies on. All of these except a page-level CSP are HTTP response headers, so they are set wherever the app is hosted.
What this does not check: logins, databases, API keys, or who can read your data. A site can pass every check on this page and still leak data, and a missing header does not mean an app has been attacked.
Built yours with Lovable?Vibe Check runs these same checks on your homepage for free and lists the top fixes.
Check my appLovable SEO and security FAQ
Is Lovable good for SEO?
On the basics, mostly yes. Of 90 live Lovable apps we checked, 88 had a page title, 88 a meta description, 88 a share image and 72 a sitemap. Fewer had structured data (53) or a canonical link (42). 51 sent a page with under 200 characters of text before JavaScript runs; Lovable says it pre-renders older apps for verified crawlers such as Google, Bing and AI search, and server-renders apps created from May 13, 2026.
Are Lovable apps secure?
This check can't answer that on its own. All 90 apps used HTTPS and 87 sent an HSTS header, but only 6 sent a Content-Security-Policy and 6 stopped other sites from framing them. It does not test logins, databases, API keys or who can read your data, so passing it is not a security audit.
How can I check my own Lovable app?
Paste its URL into VibeKing's free Vibe Check. It runs the same checks as this report on your homepage and lists the top fixes.
Which apps are in the sample?
Every live app on VibeKing's Built with Lovable page on 2026-10-22: 91 listed, 90 found from markers Lovable puts into the sites it builds and 1 named by its maker. 90 homepages answered; 1 blocks automated checks.
Method and limits
- Sample. Every live app on VibeKing's Built with Lovable page on 2026-10-22: 91 listed. 90 were found from markers Lovable itself puts into the sites it builds or hosts, and 1 was named by its maker. 90 homepages answered; 1 blocks automated checks and is left out. 6 of the 90 are on a lovable.app address, the rest on their own domain.
- How. One fetch of each homepage with a desktop Chrome user agent, following redirects, plus its robots.txt, sitemap and llms.txt, scored with the code behind Vibe Check. No browser runs, so no JavaScript runs.
- Counting rules. A sitemap counts only if it is valid XML. An llms.txt counts only if it is plain text, not an HTML page; one site answered with a copy of its robots.txt and is not counted. Text counts only what is visible in the server HTML, without scripts and styles.
- Left out. Page speed and the overall Vibe Check score: they were measured from one location, so they say more about the distance than about the apps. No app is named on this page.
- Snapshot. This page is one run on 2026-10-22 and does not update itself. Apps change, so a fresh check of any single app may differ.
- Disclosure. VibeKing lists these apps and makes Vibe Check.