vs
In our sample, Bolt sites score higher: a median of 49/100 against 40/100 for Replit, a gap of 9 points. The score counts problems a visitor or a search engine would hit, such as missing headings, exposed keys and blocked zoom, so it says as much about how people use each builder as about the builder itself. One side is a small sample, so treat the gap as a hint rather than a verdict.
| Bolt | Replit | |
|---|---|---|
| Type | AI builder (site written from a prompt) | AI builder (site written from a prompt) |
| Default hosting | *.bolt.host | *.replit.app |
| Sites in our sample | 18 | 114 |
| Median site score | 49/100 | 40/100 |
| Sites with a critical problem of their own | 33.3% | 18.4% |
| Call a Supabase database from the browser | 33.3% | 0% |
| No main heading (H1) | 77.8% | 86.8% |
| No meta description | 5.6% | 41.2% |
| Zoom disabled on phones | 0% | 79.8% |
| Builder badge left on | 0% | 3.5% |
Highlighted: the better of the two on that row. Lower is better for every percentage.
BoltHow to spot it: Look at the address: *.bolt.host is Bolt hosting.
What usually goes wrong: Supabase keys in plain sight. We found a Supabase key in the JavaScript bundle of most Bolt sites we scanned. An anonymous key is meant to be public, but only if row-level security is switched on in the database. Many projects never turn it on, and then the key is enough to read every row.
ReplitHow to spot it: Look at the address: *.replit.app or *.replit.dev is Replit hosting.
What usually goes wrong: The default description is what people see in Google. If the description still says "Update this description to reflect the app", that is the sentence under your title in search results, and in every link preview.
Usually, yes. Each leaves its own traces: Bolt on *.bolt.host and in its scripts, Replit on *.replit.app and in its own markers. Paste the URL in the scanner above and it names the builder with the evidence it found.
Neither decides it alone. In our sample the biggest SEO gaps were a missing main heading and a missing meta description, both fixable on either platform. Compare the rows above, then scan your own site to see which of them apply to it.
Not by being AI-built. The problems we see most are defaults nobody changed: titles, badges, blocked zoom, and database keys used without access rules. Each is a short fix once you know it is there.
Numbers from The AI-built web, October 2026: public sites on each builder's own hosting, scanned once. Read the method and its limits there.