Research · October 29, 2026 · 8 min read
What AI-built pages contain
We read the HTML of 2,213 pages that people published on Pagelive, a host for pages made with AI tools. Not what they say: what they are made of. Which outside servers they load code from, whether they ask for a password, whether their images load, whether they work on a phone. Here is what we found, and what to check before you send yours.
The short version
- Half the pages are a single self-contained file. 50.0% load nothing at all from another server, and for another 22.6% the only outside request is Google Fonts.
- The typical page is small. The median file is about 30 KB. But 9.1% are over 1 MB, mostly because images are pasted into the file itself.
- One in six pages with images has a broken one. 76 of the 465 pages that use an
<img>tag (16.3%) point at a file that was never uploaded. - 7.0% ask for a password, code or card number. Of those, 29% check the password against a value written in the page, where anyone can read it.
- Trackers are rare. 0.9% of pages carry an analytics or ad tag.
- 8.5% have no viewport tag, so phones show them as a shrunken desktop page. 10.6% do not say what language they are in.
- The tool that made a page almost never shows. 99.0% of pages carry no fingerprint we could tie to a specific AI tool.
What the pages contain, at a glance
Outside code: half the pages need another server
46.7% of pages load code or styles from another host when someone opens them. The biggest single reason is fonts: 22.6% of all pages load nothing from outside except Google Fonts. 22.2% load at least one script from another host, and the typical page that does loads just one.
Only six hosts appear on 10 or more pages. Every one is a public CDN or a Google service:
| Host | Pages | Share of all pages |
|---|---|---|
fonts.googleapis.com | 819 | 37.0% |
cdnjs.cloudflare.com | 263 | 11.9% |
cdn.tailwindcss.com | 259 | 11.7% |
cdn.jsdelivr.net | 168 | 7.6% |
unpkg.com | 71 | 3.2% |
gstatic.com | 37 | 1.7% |
By library, the pattern is the same. Pages lean on a small set of drop-in tools:
| Library | Pages | Share |
|---|---|---|
| Google Fonts | 852 | 38.5% |
| Tailwind (from its CDN) | 264 | 11.9% |
| Font Awesome | 168 | 7.6% |
| Three.js | 83 | 3.8% |
| Lucide icons | 60 | 2.7% |
| canvas-confetti | 39 | 1.8% |
| Chart.js | 30 | 1.4% |
| React | 27 | 1.2% |
| jQuery | 13 | 0.6% |
| KaTeX or MathJax | 11 | 0.5% |
Charts are less common than you might expect: 1.7% of pages load a charting library, and Chart.js is the only one used on 10 or more pages. 76.3% of pages carry their own inline script.
Size: small files, with a long tail of embedded images
The median page is about 30 KB. A quarter are under 9.7 KB and three quarters under 100 KB. The tail is long: the 90th percentile is about 809 KB, and 201 pages (9.1%) are over 1 MB. In 164 pages (7.4%), more than half the file is images stored inside the HTML as text (data URIs). 9.8% of pages embed at least one image that way.
| File size | Pages | Share |
|---|---|---|
| Under 10 KB | 565 | 25.5% |
| 10 to 50 KB | 822 | 37.1% |
| 50 to 100 KB | 272 | 12.3% |
| 100 to 500 KB | 286 | 12.9% |
| 500 KB to 1 MB | 67 | 3.0% |
| 1 to 5 MB | 139 | 6.3% |
| Over 5 MB | 62 | 2.8% |
Images: the file that was never uploaded
Most pages have no image tag at all: 21.0% use one. Of those 465 pages, 76 (16.3%) have at least one image that cannot load for anyone else. Every one of those broken images is a relative path like logo.png or images/photo.jpg: the page names a file that sat next to it on the author's computer, and only the HTML file was published.
We looked for the other usual suspects too. No page used a sandbox: or file: image path, and fewer than 10 used a blob: address or a placeholder image service.
Password and card fields: mostly locks that do not lock
155 pages (7.0%) have a field for a password, a one-time code or a card number. Almost all are password fields (153 pages); code and card fields each appear on fewer than 10. A further 28 pages (1.3%) create such a field from script rather than in the markup.
Most of these fields go nowhere. 136 of the 155 pages (87.7%) have no way to send what is typed to another server, so it stays in the visitor's browser. In 45 pages, 29% of the 155, a script compares the typed password with a value written into the page. That is a lock with the key taped to it: anyone who opens View Source can read the password.
19 pages (0.9% of all pages) have such a field and also call an outside service.
Outside calls and API keys
2.4% of pages call another server with an address written directly in the code. Counting calls whose address is built at run time beside an API address in the same script, and forms that post to another host, the share is 4.9% (109 pages). No single API host is called by 10 or more pages; grouped by kind:
| Kind of service | Pages | Share |
|---|---|---|
| Other public APIs (weather, maps, books, and so on) | 66 | 3.0% |
| AI model APIs | 19 | 0.9% |
| Databases and hosted backends | 14 | 0.6% |
| Form and notification services | 14 | 0.6% |
A page's code is public to anyone who opens it, so we also looked for keys. 23 pages (1.0%) hold a browser key of the kind that is meant to be public (a Firebase or Supabase client key, for example). Fewer than 10 pages hold a string shaped like an AI provider's secret key, and none hold a payment, cloud, code-hosting or chat-bot secret of the shapes we test for.
Phones, languages and dark mode
8.5% of pages have no <meta name="viewport"> tag. 10.6% have no lang attribute on the <html> tag. Among pages that do declare a language, English leads, and 26.0% of all pages declare another language:
| Declared language | Pages | Share |
|---|---|---|
| English | 1403 | 63.4% |
| Indonesian | 88 | 4.0% |
| Russian | 58 | 2.6% |
| Arabic | 53 | 2.4% |
| Chinese | 52 | 2.3% |
| Spanish | 31 | 1.4% |
| Korean | 29 | 1.3% |
| Portuguese | 28 | 1.3% |
| Vietnamese | 25 | 1.1% |
| French | 24 | 1.1% |
| No lang attribute | 235 | 10.6% |
20.7% of pages support dark mode: 16.9% follow the visitor's system setting and 15.8% have a dark theme class or a switch (some do both).
Trackers: almost none
Only 19 pages (0.9%) carry an analytics or advertising tag. Google Analytics is the only one on 10 or more pages (13 pages, 0.6%). Every other tracker we test for appears on fewer than 10 pages, and Google Tag Manager, Meta Pixel and Hotjar on none.
Which AI made it? Usually, you cannot tell
We looked for traces that a tool itself leaves in a file: its own asset hosts, a generator tag, a platform API, the tracking parameter a chat assistant adds to links it cites, or the planning comments one canvas tool writes. We never judged by what a page says about itself; a page about ChatGPT is not a page made by ChatGPT.
Only 22 pages (1.0%) carry such a trace. The other 99.0% are unclassified. The one tool that reaches 10 pages is Claude: 12 pages (0.5%) call the storage API that Claude's artifacts provide. That API exists only inside Claude, so once those pages are published elsewhere they cannot save anything. The remaining 10 identified pages are spread across tools that each have fewer than 10.
So treat any claim that a page "looks like" a particular AI with suspicion. The HTML these tools write is ordinary HTML.
What to check before you send an AI-built page
- Open it somewhere other than your own computer. A relative image path works on your machine and breaks for everyone else, which is what happened on 16.3% of the pages with images. Paste the HTML into the HTML viewer and look for empty boxes, then ask the AI to embed the images or use full URLs. If the chat gave you a
sandbox:/link instead of a file, here is what that is. - Do not protect a page with a password written in its own code. 45 pages did. Use a real gate on the server side instead; this guide covers the options.
- Add the two lines that 8.5% and 10.6% of pages miss:
<meta name="viewport" content="width=device-width, initial-scale=1">in the head and alangon the<html>tag. Then open it on a phone. - Know what your page needs from other servers. 46.7% of pages depend on another host being up when they are opened, most often a font service or a CDN. That is usually fine; it matters when the page must work offline or behind a strict network.
- Watch the file size. 9.1% of pages are over 1 MB, usually from images pasted into the file. The HTML minifier trims markup and shows the bytes saved; for a one-image preview of a long page, use HTML to image.
- Never put a secret key in a page. Anyone can read it. If a page calls an AI model, the key belongs on a server, not in the HTML.
- Got an HTML file from someone else? Here is how to open it on any device.
How we measured
Sample. Every page that was live on Pagelive on October 29, 2026: 2,213 pages, first published between June and October 2026 (61.4% in October). We left out pages that were removed or held for review by moderation, pages of banned accounts, expired anonymous pages, our own onboarding page, and test and staff accounts. 408 pages (18.4%) were published without an account.
Method. We read the latest stored version of each page as text. Nothing was run, rendered or fetched from the network: images were classified by their address, not by trying to load them. The detector is a set of pure functions in our code base, with tests, so the numbers can be produced again. A tracker, library or chart counts only when it appears in a script address, a stylesheet address or script code, never in a page's visible text.
Privacy. We report counts only. No titles, addresses, owners or page content appear here, and any group with fewer than 10 pages is not shown.
Limits. This is a sample of people who chose Pagelive, not a sample of the web. Most pages carry no trace of the tool that made it, so we cannot confirm each one was built with AI. Some people published the same file more than once: there are 1,894 distinct files among the 2,213 pages. Static reading misses anything a script adds after load, such as an image whose address is set by code, and remote images that no longer exist were not detected.
Check it, then send it as a link.
Pagelive turns an HTML file into a private, tracked link, with a password gate that lives on the server. Free for 2 public pages.