A Durban business owner sent me a login last month and asked us to “just take over the site”. A firm had built it for R2,500 in a few days using AI tools and then gone quiet. The site looked fine. It was also a problem in five directions at once: no Google Search Console, no analytics, a nulled premium theme two years out of date, a contact form emailing an address nobody checked, and an admin account we could not get the password for. The owner did not own the website. She owned a screenshot of one.
This is happening across South Africa right now. “We build websites with AI” has become a sales line, and for a certain price it means something real: a working-looking site, fast. The problem is not the AI. The tools are genuinely good at layout and copy. The problem is everything the AI does not do and the cheap operator does not bother to do either. Security. Handover. The tracking and search setup that turns a website from a brochure into a business asset.
Here is what those cheap AI-built sites actually cost you, and how to check before you pay.
What "We Build Websites With AI" Actually Means
Most of the time it means a template filled by a language model, published without the work that sits underneath a real build.
AI is good at the visible layer. It writes passable copy, arranges sections, picks stock images, and produces something that photographs well. Point a modern tool at “plumber in Sandton” and you will get a homepage in minutes. That speed is real and it is why the price can be R2,500 instead of R25,000.
What it does not produce is the invisible layer: a hardened server, a maintained plugin stack, working conversion tracking, a search-engine setup, and documentation so you can run the thing after handover. A competent agency spends most of a build on that invisible layer. A cheap AI operator skips it, because skipping it is the entire business model. You are not paying for less work at a discount. You are paying for a different, smaller job that happens to look identical in a screenshot.
That gap is where the cost hides. It surfaces three to six months later, usually when you try to advertise, rank, or get someone else to fix a problem.
The Security Risks Nobody Mentions in the Sales Call
A website built for speed and price is almost always built without security, and on WordPress that is where South African sites get hurt.
Most of these sites run on WordPress because it is cheap and fast to spin up. WordPress itself is fine. What breaks it is how these builds are assembled: nulled or pirated premium themes and plugins with the licence stripped out, code copied from forums, plugins installed and never updated, and no firewall, backups, or two-factor authentication on the admin login. Every one of those is a documented entry point. The OWASP Top 10 reads like a checklist of exactly what a rushed build ignores: injection, broken access control, outdated components with known vulnerabilities.
The consequences are ordinary and expensive. An out-of-date plugin gets exploited and your site starts serving spam or redirecting visitors to a betting page. Google flags it. Your hosting suspends the account. You are now paying someone to clean malware off a site you paid to have built badly.
There is a compliance edge too. If that contact form or checkout collects personal information, POPIA applies to how it is stored and secured, and the Information Regulator expects reasonable safeguards. An AI-built site with no SSL enforcement, no update discipline, and form submissions sitting in an unsecured database is not a POPIA risk in theory. It is one in practice. Cheap builds treat security as optional. Attackers and regulators do not.
Handover and Continuity: Who Actually Owns Your Website?
The most common problem with a cheap AI-built site is not that it breaks. It is that when it breaks, you cannot get in to fix it and neither can anyone you hire.
Ask a hard question before you pay anyone: at the end of this, what do I actually hold? On a proper build the answer is your own domain registrar login, your own hosting account, full administrator access to the site, and the accounts behind anything connected to it. On a cheap build the answer is often a link to a live site and nothing else. The domain is registered under the builder’s account. The hosting is theirs. There is one admin login and it is not yours. There is no documentation. When the operator stops replying, and low-cost operators stop replying often, you are locked out of your own business address on the internet.
Some tools make this worse by design. Site builders that generate a website inside their own closed platform mean you cannot move the site elsewhere without rebuilding it. Your content, your layout, and your search history are held hostage to a monthly fee. Cancel and the site vanishes.
This is the part of the UX-first web design service we treat as non-negotiable. A website should hand over cleanly: you own the domain and hosting, you get administrator access, you get a short training session and documentation, and the build sits on a standard stack that any competent developer can pick up later. You should never be one unanswered email away from losing your website. We wrote about the wider version of this problem in authentic marketing over polished shortcuts: the cheap shiny option usually costs more once the real bill arrives.
The Setup That Always Gets Skipped
A website with no measurement or search setup is a brochure, not a marketing asset, and the cheap AI build almost never includes it.
This is the quietest cost of all, because the site works. It just cannot be found, measured, or advertised properly. Here is what a real launch includes and a R2,500 build leaves out:
- Google Search Console. Someone needs to verify a site in Google Search Console and submit the sitemap so Google indexes your pages and tells you when something is wrong. Skipped almost every time.
- GA4 analytics. Without a properly configured GA4 property you have no idea how many people visit, what they do, or which pages generate enquiries. You need to set up a GA4 property and mark the real conversions as key events. Getting this wrong is so common we wrote up the eight GA4 tracking mistakes we see on SA WordPress sites.
- Meta Pixel and Conversions API. The day you want to run Facebook or Instagram ads, you need historical Pixel data. If nobody installed it at launch, you start from zero. Install the Meta Pixel at build time, not the week before a campaign.
- LinkedIn Insight Tag. For B2B firms, the same logic applies to LinkedIn. The tag has to be live and collecting before the ads run.
- Schema markup and redirects. Structured data helps you show up correctly in search and AI answers, and a rebuild without redirects from old URLs quietly kills whatever ranking you had.
None of this is visible on the page, which is exactly why it gets cut. But this is the layer that connects a website to search visibility and SEO and to any paid advertising setup you plan to run. Leave it out and you have bought a car with no dashboard, no fuel gauge, and no ignition. It looks like a car.
How to Vet a Web Provider Before You Pay
You do not need to be technical to separate a real build from a cheap one. You need six questions.
Ask every provider, AI-assisted or not, the following. The answers tell you almost everything:
- Will the domain and hosting be registered in my name, with my logins? The only correct answer is yes. Anything else is lock-in.
- Will I get full administrator access and a handover session? You should own the keys and know how to use them.
- What is the security setup: SSL, backups, updates, two-factor login? A blank look here is your answer.
- Will you install Search Console, GA4, and the ad tracking I will need? If tracking is “extra” or unfamiliar to them, they build brochures.
- Are the theme and plugins properly licensed and kept updated? Nulled software is a security time bomb and a legal one.
- If I leave you in a year, can another developer take over cleanly? A yes means a standard build. A no means you are trapped.
A provider who answers these confidently is worth more at R25,000 than a brochure at R2,500. Price is what you pay once. A broken, un-owned, un-trackable website is what you pay for every month after.
What This Means For You
- Separate the tool from the operator. AI building part of a site is fine. An operator using AI to skip security, ownership, and tracking is not.
- Demand ownership in writing. Domain, hosting, and admin access in your name, confirmed before any money changes hands.
- Treat tracking as part of the build, not an upsell. Search Console, GA4, and your ad pixels should be live on launch day.
- Check the security basics. SSL, backups, updates, and licensed software are the floor, not a premium tier.
- Run the six questions. They cost you nothing and expose a cheap build in five minutes.
Where GKnect Comes In
We build websites for South African businesses on a standard, owned, maintainable stack, with the security, tracking, and search setup included rather than sold back to you later. You get the domain, the logins, a handover session, and a site that another developer could take over tomorrow if you ever needed them to. If you already have a site you are not sure about, we will look at it and tell you honestly what is solid and what is exposed.
Frequently Asked Questions
Are AI-built websites bad?
No. AI is a genuinely useful tool for drafting copy and laying out pages, and good agencies use it. The risk is not the AI. It is operators who use AI to sell a site fast and cheap while skipping security, ownership, and tracking. Judge the operator and the full build, not the tool.
I paid for an AI-built site and cannot log in. What now?
Start with what you can control: your domain registrar and your hosting provider. If either is in your name, you can regain control of the site through them. If both are under the builder’s account, you may need to rebuild on hosting you own and point your domain there. Either way, get your own domain and hosting accounts first, then migrate.
How do I know if my website is secure?
Check the basics yourself. Does the address show https with a padlock on every page? Ask your provider whether backups run automatically, whether the software is updated monthly, and whether the admin login has two-factor authentication. If you cannot get clear answers, assume it is not secure and get it audited.
Why does tracking matter if my website already works?
Because a working site you cannot measure is a guess. Without Search Console and GA4 you do not know how people find you or what they do once they arrive, and without ad pixels you cannot advertise effectively. Tracking is what turns a website into something you can improve and grow.
Is a cheap website ever the right choice?
For a brand-new business testing an idea, a simple site is reasonable. The line to hold is ownership and safety: even a cheap site should be registered in your name, run on https, and be something you can move or expand later. Cheap is fine. Trapped and exposed is not.
