Hidden Costs of AI-Built Websites: Lovable, Replit, Vercel

Credits, usage-based hosting and stacked services make AI-built websites cost more than they seem. Where the charges hide and what to check if AI built your site.

By Hamisi A. Mnaro · September 15, 2026 · 8 min read

A business owner types a few sentences into Lovable, Replit, Bolt or v0, and twenty minutes later there is a working website. It looks good. It cost a $25 subscription. It feels like the end of paying web designers.

Then the second month arrives. The credits ran out halfway through fixing a contact form. The hosting account wants a card. A database service sent a "you are approaching your limit" email. An AI feature inside the site is billing per request against an API key nobody remembers creating. And the site, it turns out, is barely visible on Google.

We are seeing more of these sites arrive at our studio in Arusha, usually after the bills or the problems have started. This field note explains where the costs hide and what to check if your website was built with AI.

In short: AI builders are cheap to start and can get expensive to run. You pay in credits for every change, including changes that only fix the AI's own mistakes; hosting is often billed by usage; and the database, email, domain and AI features are separate accounts with separate bills. Set spending limits, put every account in your own name, export your code, and check security and SEO before you rely on the site for business.

Where the money actually goes

1. Credits you spend fixing the AI's mistakes

Most AI builders do not charge per website. They charge per change. Lovable uses credits whose cost varies with the complexity of each request; its own examples range from 0.5 credits for a simple edit to 1.7 credits for a landing page with images. Bolt sells monthly token allowances, with its Pro plan at $25 a month starting at 10 million tokens. Replit's Core and Pro plans ($20 and $100 a month) come with a matching dollar amount of usage for its most powerful models.

The trap is simple: when the AI breaks something, you pay for it to try again. A bug that goes round in circles, "fixed" and then broken again, can burn through a month's allowance in an afternoon. Credits also expire. Lovable's free daily credits do not roll over and its monthly credits expire after two months; Bolt's unused Pro tokens stay valid for two months in total, and only while the subscription is active.

2. Hosting that bills by usage, not by month

Traditional hosting is a fixed fee. Platforms such as Vercel and Netlify are metered. Vercel Pro costs $20 per developer seat per month and includes a $20 usage credit; after that you pay for what the site consumes, such as data transfer beyond 1TB at from $0.15 per GB, function invocations at from $0.60 per million, and image optimisation at from $0.05 per thousand transformations. Netlify now runs on credits: every production deploy costs 15 credits, and bandwidth, compute and requests all draw from the same balance.

For a quiet brochure site these numbers are small. But a viral post, a bot hammering your pages, or an AI-generated site that loads unoptimised images on every visit can turn a $20 month into something much larger. Vercel gives new teams a default on-demand budget of $200, so without a lower cap you can be charged up to that amount before anything stops.

3. The free plan you are not allowed to use

Many AI-built sites are deployed on a free tier because it worked during the demo. Vercel's Hobby plan is for personal, non-commercial use, so a business website on it is outside the terms and can be moved to a paid plan or restricted. Free tiers also carry branding (Bolt's free plan shows Bolt branding on your site), daily limits and caps on requests.

4. The bills stacked behind the app

An AI-generated app is rarely one product. Behind a single "website" there is often:

the builder subscription (Lovable, Replit, Bolt, v0);
a hosting account (Vercel, Netlify or the builder's own cloud);
a database and login service, often Supabase or the builder's own cloud credits;
an email service for contact forms and notifications;
an AI API key (OpenAI, Anthropic, Google) if the site has a chatbot or "AI" feature, billed per use;
the domain name, and sometimes a separate charge to connect it.

Each has its own free tier, its own limits and its own card on file. Nobody sees the total until the statements come in. Free database projects can also be paused when they are inactive, which quietly takes your site's forms or logins offline.

5. The cost of leaving

The most expensive hidden cost is lock-in. If the code lives only inside a builder's workspace, the database sits on an account a freelancer created, and the domain is registered in someone else's name, moving away means rebuilding. Many owners discover this only when they want to change developer, cut costs, or add a feature the AI cannot manage.

The risks that do not show on an invoice

Exposed secrets. AI tools sometimes place API keys in code that runs in the visitor's browser. Anyone can read them and run up charges on your account.
Open databases. Generated apps often ship with database access rules that are too loose, so customer data can be read or changed by people who should not see it. This matters under Tanzania's Personal Data Protection Act as much as under GDPR.
Invisible to search and AI assistants. Many AI builders produce single-page JavaScript apps. Google can render them, slowly, but many AI crawlers and link previews see an almost empty page. We fixed exactly this on our own site. See our note on why being cited by AI search now matters.
No backups, no history. If nobody set up backups, one bad AI change or an expired account can lose everything.
Nobody to call. When a payment form breaks on a Saturday, the AI builder is not your support team.

Advice if your website was built with AI

None of this means you should throw the site away. Work through this list:

Set spending limits today. Add a hard budget and alerts on every metered account: the hosting platform, the AI API provider and the database. Turn on automatic pausing where it is offered.
List every service and who pays for it. Builder, hosting, database, email, AI keys, domain. Write down the plan, the renewal date and the card each one uses.
Calculate the real 12-month cost. Add the subscriptions, typical usage and the credits you spend on changes. Compare that with fixed-price hosting and a maintenance plan.
Check the plan allows business use. A commercial site on a personal or hobby plan is a risk you do not need.
Own every account. The domain, hosting, database and code repository should be registered to your company email, with the developer added as a user, not the owner.
Export your code to GitHub. Most builders offer this. It is your insurance against lock-in and price rises.
Get a security check. Look for API keys in front-end code, rotate any that were exposed, and review database access rules before you collect customer data.
Check what Google and AI crawlers see. Use Google Search Console's URL Inspection, and view the page source: if your text is not there, many bots cannot read it.
Set up backups of both the database and the code, and test that you can restore them.
Stop prompting in circles. If the AI has failed to fix the same problem three times, stop spending credits and ask a developer. It is usually cheaper.

Frequently asked questions

Can I use Vercel's free Hobby plan for a business website?

No. Vercel describes the Hobby plan as being for personal, non-commercial use. A business website belongs on its Pro plan, at $20 per developer seat per month plus usage, or on another host.

What does a website built with Lovable, Replit or Bolt really cost to run?

More than the builder subscription. Add the credits or tokens you spend on every change, the hosting, the database and login service, the email service, any AI API usage and the domain. Replit's Core plan is $20 a month and Bolt Pro is $25 a month before any of those extras.

Can I move an AI-built website to normal hosting?

Usually, yes, if you can export the code and you own the accounts. The database and login service may need migrating too, and a JavaScript-only site may need server rendering so search engines and AI crawlers can read it.

Are websites built with AI secure?

Not by default. The most common problems are API keys exposed in the browser and database rules that let anyone read or change data. Have both checked before the site collects customer details or payments.

When an AI builder is the right choice

AI builders are excellent for prototypes, internal tools, idea validation and simple landing pages you expect to replace. They are a weaker fit for a business website that must rank, take bookings or payments, handle customer data and run for years at a predictable cost. The build is not the expensive part of a website. Running it is.

Prices in this note were checked on the providers' own pricing pages, linked above, in September 2026. They change often, so confirm them before you decide.

If you already have an AI-built site and want to know what it really costs, whether it is secure and whether Google can read it, we can review it and suggest a fix, or move it to predictable web hosting with ongoing website support. For sites that need to perform over the long term, see our approach to premium web development, or say hi and tell us what you are running.

Hamisi A. Mnaro — Founder and CEO of Timeless International, the Arusha studio he has run since 2009. He leads the team that built SafariSync and the platforms behind Gosheni Safaris, Ecological Adventure and Inspiration Africa.