What is gpteng.co, and why is it in your website?
If you opened a page source and found a script from gpteng.co, you found the most reliable marker an AI website builder leaves behind. It belongs to Lovable (the company was GPT Engineer before it was renamed), and it is how a Lovable project keeps talking to the editor that generated it.
It is not malware and it is not an ad tracker. It is the builder’s own runtime. But its presence does mean one thing with near certainty: the page was generated by Lovable, not written by hand.
What the script actually does
It loads the small client Lovable uses to connect a published project back to the editor: live preview, the badge on free projects, and the error reporting that tells the editor when a generated page broke. On a published site none of that is needed by the visitor.
Because it is a third-party script, every visitor’s browser makes a request to gpteng.co. That host then sees the visitor’s IP address and user agent. If you are in the EU and have a privacy policy, that is a third-party processor you are supposed to name in it.
Is it safe to leave it in?
For most sites, yes, in the sense that it will not break anything. What it costs you is a request on every page load, a name that tells anyone how the site was made, and a dependency on a host you do not control: if it is slow, your page waits for it.
The real risk on Lovable sites is usually elsewhere. In our scans of live Lovable projects, the common serious problem is a Supabase key sitting in the JavaScript bundle, which is only safe when row-level security is switched on for every table. Check that before you worry about the script.
How to remove it
On a project you still edit in Lovable, you cannot: the editor puts it back. Exporting the project to GitHub and hosting it yourself removes it, along with the badge. In the exported code it is a single <script> tag in index.html.
Removing it does not improve your search ranking. It stops advertising the tool, which matters if you are handing the site to a client.
Questions
Does gpteng.co mean the site was made by AI?
It means the site was built with Lovable, which generates code from a prompt. So in practice yes: the first version of that page was written by a machine, however much a person edited it afterwards.
Is gpteng.co a tracker?
It is not an advertising or analytics tracker. It is the builder’s runtime. It does, however, mean the host sees the IP address of everyone who loads your page.
Can I block it?
A visitor can block it with any content blocker and the page will usually still work. As the site owner, exporting the project is the only reliable way to remove it.