Publishing sites built with Claude – or any other LLM coding tool

You described the website you wanted, watched an AI write it in front of you, and now there’s a working site sitting in a chat window. That puts you in great company. Andrej Karpathy coined “vibe coding” in February 2025, Collins made it Word of the Year by November, and the tools have been sprinting ever since: Lovable alone reports a million new projects a week, and Bolt and Netlify passed a million AI-generated websites deployed back in early 2025.

Here’s the part the chat window doesn’t mention. Building the site was the easy half. Publishing it, on an address you own, in a way that survives, is the half the AI can’t do for you.

Take Claude’s own publish button as the honest example. It’s genuinely useful: one click and your creation is live on a shareable link. But read the fine print: the link lives on Anthropic’s URL, custom domains aren’t supported, and if you unpublish, the hosted copy is permanently deleted. That’s a demo, not an address. Every LLM tool has some version of this gap, and this guide is for closing it.

First, figure out what you actually made

AI tools produce two very different kinds of websites, and your publishing path depends on which one you’re holding.

• A single HTML file. Claude artifacts and simple ChatGPT builds usually produce one self-contained file with everything inside. This is the friendliest output: it needs no build step or special platform. Any web hosting that can serve a file can serve your site, which makes ordinary shared hosting the shortest path from chat window to real website.
• A framework project. Claude Code, Cursor, Lovable, Bolt, and v0 typically generate React, Vite, or Next.js projects: a folder full of files that needs a “build” before browsers can use it. These want a host that runs the build for you (GitHub Pages, Netlify, Cloudflare Pages, and similar all do this on free tiers) or a one-time build on your computer that produces plain files you upload anywhere.

If you’re not sure which you have, ask the AI that built it. That’s one question it will answer perfectly.

The last mile is the part you own

Whatever the hosting choice, three pieces turn “a file on the internet” into a website people can trust, and they’re the same three pieces every site has needed since long before AI.

• A domain. The AI tool’s subdomain announces “temporary experiment.” Your own domain is the one part of your web presence that’s genuinely yours: portable across every host, every tool, and every future rebuild. It’s also the piece that makes everything else replaceable, because visitors follow the name, not the server.

• DNS. The signpost that points your name at wherever the site actually lives. Every host gives you a value to paste in; every registrar gives you the place to paste it. This step scares first-timers most and takes about four minutes.

• SSL. The padlock. Browsers now shame sites without it, and there’s no reason to be shamed: certificates are free or nearly free everywhere, and most hosts issue them automatically.

None of this is hard. It’s just the part where the AI hands you the keys and stops, and where the site quietly changes owner, from the tool to you. Namecheap’s own AI website builder exists for people who’d rather have building and publishing in one place, but if Claude already built your site, you only need the publishing half.

Before you point the domain at it: five checks

The AI wave has a documented quality problem, and going live is the moment casual stops being casual. Run these before DNS, in this order.

1. Hunt for API keys. The most common vibe-coding disaster is a working feature powered by a secret key pasted straight into the page, where anyone can view source and steal it. It happens constantly: GitGuardian’s 2026 report counted 28.65 million secrets leaked on public GitHub in 2025, with AI-service keys up 81% year on year. One founder famously launched a paid app built entirely with AI and reported that strangers maxed out his keys within two days. Search your code for “key,” “token,” and “secret” before anyone else does.

2. Assume the code is insecure until checked. Not because AI code is uniquely bad, but because it’s unreviewed. Veracode tested code from more than 100 models and found 45% of samples failed basic security tests, a rate that didn’t improve with newer models. When researchers scanned apps built on one popular vibe-coding platform, 170 of 1,645 were exposing users’ personal data. If your site collects anything from visitors, ask a second AI session to audit the first one’s work, and be specific: “find security problems in this code” produces remarkably useful paranoia.

3. Check the contact form actually goes anywhere. Static sites can’t process forms on their own. The AI happily builds a beautiful form with no destination; you need a form service or a host that provides one. Test it. Email yourself.

4. Do the ten-minute SEO pass. AI builds routinely skip the invisible basics. One audit of twenty vibe-coded sites (a small sample, so treat it as a warning rather than a statistic) found sixteen with no structured data and nearly all missing working sitemaps. Title tags, meta descriptions, a sitemap, and readable text content: boring, teachable, and the difference between existing and not existing on Google.

5. Export the code and keep it. This is the ownership check. Download the project from whatever tool built it and store it somewhere you control. Claude deletes unpublished artifacts. Startups pivot, get acquired, and change pricing. The generative AI behind these tools will keep improving, and you’ll want to hand the code, not a chat log, to whatever builds version two.

One caveat

One thing the checklist can’t fix: maintenance. TechCrunch’s reporting on the vibe-coding boom notes that maintaining AI-built code is proving harder than creating it, and there’s no survey yet on how many of those million-a-week projects are alive a year later. If your site matters to your livelihood, budget for the occasional human review, or keep the site simple enough that regenerating it beats repairing it. Simple, static, and boring is a completely legitimate architecture. It’s also the cheapest to host and the hardest to hack.

Twenty minutes, honestly

Add it up: a domain, DNS, an SSL box ticked, five checks. Call it twenty minutes and the cost of a takeaway dinner, sitting between you and a real published website that no tool can unpublish out from under you.

The AI did the impressive part. This is the part that makes it yours.