Lovable is one of the most popular AI app builders: you describe an app or a site, it writes the code and hosts the result. It was previously known as GPT Engineer, and that history still shows up in the pages it makes.
Lovable sites are among the easier ones to recognise, because a typical Lovable page carries several independent traces at once: removing one leaves the others. In our accuracy test we name Lovable on 71 of 85 Lovable sites (84%), and on 51 of 64 in a set we never used to write our rules. The ones we miss are mostly projects exported from Lovable and rebuilt elsewhere, which keep none of what follows.
Here are the traces we look for, from the most obvious to the most subtle.
1. A .lovable.app address
Projects published straight from Lovable live at an address ending in .lovable.app. That’s as clear as it gets: Lovable is serving the site.
2. DNS records that point at Lovable
Many owners connect their own domain, which removes the address above, but Lovable’s guide asks them to point the domain’s A record at 185.158.133.1, or, behind a proxy, a CNAME at their .lovable.app address. A DNS lookup tool shows either one; we read them with every scan.
3. A script from cdn.gpteng.co
Older Lovable pages load a small script from cdn.gpteng.co. “gpteng” is short for GPT Engineer, Lovable’s former name. View the page source (Ctrl+U) and search for gpteng.
4. A script ending in /~flock.js
Some Lovable pages load a script whose address ends in /~flock.js. The odd ~ path is distinctive; search the source for flock.js.
5. Its default meta tags and title
Near the top of the source, an untouched project keeps what Lovable’s starter writes: <meta name="author" content="Lovable" />, a description of “Lovable Generated Project”, a share image (og:image) on lovable.dev, <meta name="twitter:site" content="@Lovable">, and, in newer projects, the title “Lovable App”. Owners often change some of these and forget the others.
6. Its default icon
A new Lovable project starts with Lovable’s own icon (now a heart, before that its older logo). Owners who change everything else often keep it. We compare the site’s icon byte for byte with Lovable’s.
7. data-lov-id attributes
Pages made with Lovable can carry attributes named data-lov-id on their elements, used by its editing tools. Search the source for data-lov-id. Pages drawn entirely by JavaScript may only show this once the page has loaded, in the browser’s element inspector.
8. Uploads stored by the builder
Images and files uploaded through the builder keep a storage address containing /lovable-uploads/ or, in older projects, gpt-engineer-file-uploads. Right-click an image, open it in a new tab and look at the address. We also look for /lovable-uploads/ in the site’s own script.
Weaker traces, and the builder that copies them
A few traces only count together with the Vite build every Lovable project ships, and we rate them Medium, never High:
- The verification record Lovable’s guide asks for (a
lovable_verify=TXT record), since a record can outlive the site it was made for. - The starter’s 404 page, whose script logs “404 Error: User attempted to access non-existent route”.
- The starter’s robots.txt, which allows Googlebot, Bingbot, Twitterbot and facebookexternalhit by name.
The last two are copied. Dyad, another AI builder, starts every app from a copy of Lovable’s starter, 404 page and robots.txt included, and Rork’s web starter copies the robots.txt. When a page shows Dyad’s own traces, such as its starter’s bare page head with only a charset, a viewport and a title (Lovable’s starter has always added a description, an author and social tags), we name Dyad and leave Lovable’s copied traces out. Each result says what its traces mean together.
How sure can you be?
Any one of traces 1 to 8 is strong evidence that Lovable made the page: none of them appears by accident on sites built another way. We treat a single one as a builder signature and rate the AI traces High.
The reverse doesn’t hold. A site that was started in Lovable, exported and rebuilt elsewhere, or carefully cleaned up, may keep none of these traces. “None found” is never proof that a site wasn’t made with Lovable, or with any AI tool.
And a reminder that matters: being built with Lovable says nothing about whether a business is honest. Plenty of real, careful businesses use it. It’s a fact about how a site was made, not a judgement of the people behind it.
Related: other AI builders
Bolt.new (how to spot it), v0 (how to spot it), Replit, Base44, Dyad, Firebase Studio, Google AI Studio and dozens more leave traces of their own, some much fainter than Lovable’s. Our guide on how to tell if a website was built with AI covers them, and our accuracy study shows how often we catch each.
Check any site for all of these traces at once: the AI Website Detector shows each one it finds, with the exact line from the page.