Is Lovable good for SEO? I checked what 90 live Lovable apps send to a crawler

I run VibeKing, a directory of things people build. It keeps a page of apps built with Lovable. On October 22, I ran the same homepage checks on every live app on that page. 90 homepages answered; 1 blocks automated checks and is left out.

The method is deliberately simple: one fetch of each homepage with a desktop Chrome user agent, plus its robots.txt, sitemap.xml and llms.txt. No browser, so no JavaScript runs. That matters, and I'll come back to it.

No app is named here, and this is not a security audit.

The head of the page: mostly fine

Check	Apps (of 90)
Has a page title	88
Has a meta description	88
Has a share image (og:image)	88
Has a valid sitemap.xml	72
Has structured data (JSON-LD or microdata)	53
Has a canonical link	42
Tells search engines to stay away (noindex)	0

The parts people see get done. The quiet ones lag: 48 apps have no canonical link and 37 have no structured data.

Before JavaScript runs: mostly an app shell

I counted the visible text in the HTML the server sends, with scripts and styles stripped. The median was 72 characters.

What the server sends	Apps (of 90)
Readable: 600+ characters of text	34
Thin: 200 to 599 characters	5
App shell: under 200 characters	51

So 51 of 90 send almost nothing until JavaScript fills the page in.

That does not mean Google sees a blank page. Lovable's SEO docs say "Older React + Vite apps are pre-rendered for verified crawlers when they request a page". They name search engines like Google and Bing, plus "AI search crawlers such as those of ChatGPT, Perplexity, Claude, and Gemini". The same page says "Unverified bots and link checkers see the regular single-page app".

I'm not a verified crawler, so I can't see the pre-rendered copy. When I fetched 8 of the shells again with Googlebot and GPTBot user agents, I got the same shell.

For new projects the question goes away. The docs say "Apps created from May 13, 2026 (June 22, 2026 on Enterprise plans) use TanStack Start with server-side rendering", and "Every request returns fully rendered HTML, for humans and crawlers."

Why the shell still matters: anything Lovable doesn't verify gets it. And Vercel's study of AI crawler traffic found that "none of the major AI crawlers currently render JavaScript" (December 2024). Whatever HTML a crawler is served is all it reads.

AI readiness

Check	Apps (of 90)
Publishes /llms.txt	56
Has a robots.txt	87
Lets GPTBot, ClaudeBot and PerplexityBot in	88

2 apps block at least one of those three crawlers in robots.txt. The rest allow all three, or have no robots.txt, which allows them by default.

Security headers: HTTPS yes, hardening rarely

Check	Apps (of 90)
Served over HTTPS	90
Sends HSTS (Strict-Transport-Security)	87
Sends X-Content-Type-Options: nosniff	86
No mixed content	90
Sends a Content-Security-Policy	6
Restricts framing (X-Frame-Options or frame-ancestors)	6

Every app is on HTTPS. But 84 of 90 can be loaded inside another site's frame, which is what clickjacking relies on, and only 6 send a Content-Security-Policy.

What this doesn't check: logins, databases, API keys, or who can read your data. A site can pass every row here and still leak data, and a missing header doesn't mean an app has been attacked.

If you built yours with Lovable

Going by the gaps above, the cheap wins:

• Add a canonical link to every page (48 of 90 have none).
• Add structured data; JSON-LD in the page head is fine (37 of 90 have none).
• Send a Content-Security-Policy. It can be a response header or a meta tag.
• Restrict framing with a response header (frame-ancestors in a CSP header, or X-Frame-Options). A meta-tag CSP can't do this one, so it goes in your host or CDN settings.
• Open view-source: on your homepage. If the body is one empty root div, crawlers depend on Lovable's pre-rendering to read it.

The full numbers, the method and its limits are in the report: Lovable SEO and security: 90 live apps checked. To run the same checks on your own homepage, use Vibe Check. It's free.

Disclosure: I run VibeKing. It lists these apps and makes Vibe Check. This is a snapshot from October 22, 2026, and apps change, so a fresh check of any one app may differ.