Should I vibe code
Assemble a startup landing page from constrained components and export static code
You don't want a website builder. You want one page. Those two things are about three months apart.
?
Their verdict, the Maker price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
The confusion in this category is that the thing you want and the thing on sale are not the same object. You want a landing page — one page, some sections, a headline you will rewrite eleven times. Unicorn Platform is the machine that produces landing pages: a constrained block editor, hosting, TLS on a domain you own, a form endpoint, a blog CMS, reCAPTCHA, image optimisation, and the sitemap and OG plumbing that make the page worth having at all. Write the page and you are finished in an afternoon with something better than the template. Build the machine and you will spend three months on a drag-and-drop editor you personally open twice a year. The one part of it with a stranger on the other end is the form, and that is the part homemade versions consistently ship without a rate limit, without a spam check, and without anywhere to look when a month of leads turns out to have gone nowhere. Unicorn sells invisible reCAPTCHA on every paid tier because it has watched what happens to a public POST endpoint on a page that ranks.
What actually breaks
not "if". the specific failures.
- The contact form, which is an unauthenticated POST sitting on a page you are actively driving traffic to. Within a week it is receiving agency pitches; within a month somebody is testing whether it will send mail through your domain
- Where the submissions go. A form that writes to a table nobody queries and an email that quietly starts landing in spam are indistinguishable from a slow month, and you find out at the quarter
- Certificate renewal on the custom domain, which works flawlessly for eighty-nine days
- The blog you add in week two, which ships without a draft state, so the half-written post is live the moment you hit save
- The SEO plumbing — sitemap, canonical tags, OG image, structured data — none of which is fun and all of which is the reason a landing page exists
- Images, because nobody hand-writes responsive sources and the hero photo goes out at 4 MB
- The editor, which absorbs eighty percent of the build and gets opened roughly twice a year after launch
Is that you?
the verdict is a default, not a law
- It is your own site and the output is static files in a repository
- The form posts to something that already solves spam, delivery and storage, rather than to a route you wrote on Sunday
- Every submission lands in two places, one of which you look at without being reminded
- You are writing a page, not building an editor
- You are hosting sites for clients who will phone you when the domain stops resolving
- The form endpoint has no rate limit, no honeypot and no captcha
- Submissions exist only as an email nobody has ever confirmed arrives
- You are three weekends into a block editor and the page it was for is still unwritten
If you build it anyway
the checklist, then the prompt that enforces it
- Do the form first, before a single visual feature. Rate limit by IP and by content hash, add a honeypot field and a timing check, and put a captcha in front of it the day the page starts ranking.
- Never build your own mailer for form notifications. Post to a hosted form service or send through a provider with a verified domain, or your marketing site becomes an open relay with your DNS on it.
- Write every submission to durable storage before you try to notify anybody. Email is the notification, not the record.
- Alert on zero submissions over an interval that would be abnormal for you. A broken form is invisible by design.
- Say what you collect and how long you keep it. A contact form is personal data, and 'we'll delete it eventually' is not a retention policy.
- Automate certificate renewal and set an expiry alarm anyway. Manual renewal has a success rate of about one.
- Generate the sitemap, robots.txt, canonical tags and OG images from the content at build time rather than maintaining them by hand.
- If you catch yourself building a drag-and-drop editor for an audience of one, stop and write the page instead.
I want a landing page. Before you write any code, push back on the scope, then
build it in this order.
1. First, ask me whether I need a builder or one page. If it is one site that
I edit, tell me plainly that a static site generator and a repository beats
a visual editor, and only continue past this if I insist.
2. Assume the answer is one site. The first thing you build is the contact
form path, because it is the only part with a stranger on the other end.
3. The form writes to durable storage first and notifies second. Never treat a
delivered email as the record of a submission.
4. Rate limit the endpoint per IP and per content hash, add a hidden honeypot
field and a minimum time-to-submit, and wire a captcha behind a flag I can
turn on the day the spam starts. Assume it will.
5. Do not implement SMTP. Send through a provider on a domain with SPF, DKIM
and DMARC configured, or post to a hosted form endpoint. Explain that an
open form plus a homemade mailer turns my domain into a spam source.
6. Add a health check that alerts me if no submission arrives for an interval
I choose. A silently broken form looks exactly like a quiet month.
7. Write down, in the README and on the page, what the form collects and how
long it is kept, and make the code match.
8. Then the page itself: static output, no client-side framework unless I ask,
images generated as responsive sources at build time with a size budget.
9. Generate sitemap.xml, robots.txt, canonical tags and OG images from the
content, not by hand.
10. Custom domain with automated certificate renewal, plus an expiry alarm as
a backstop.
11. If I ask for a blog, it gets a draft state and a publish action from the
first commit. Saving must never be publishing.
12. Out of scope, and say so rather than half-building: a drag-and-drop
editor, multi-site management and client accounts. If I want those, tell
me Unicorn Platform is $14 a month and already exports HTML.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
The moment there is more than one site, or the site belongs to someone who will call you about it. $14 a month for Maker is one published site with a custom domain, HTML export and captcha on the forms — and that export clause means paying is not a lock-in decision. Watch the ladder, though: it is $49 before you get unlimited blog posts and $99 before you get eight sites, so agency use gets expensive quickly, which is precisely the point at which people start building their own and regret it.
$14/mo is cheaper than your weekend.
Unicorn's own answer is the best one available, and it is worth copying whether or not you pay them: every paid tier exports the whole site as HTML you can host anywhere. Build to the same standard. If your output is static files in a repository, moving off your own builder is a deploy step rather than a migration. The two things that do not export themselves are the form submissions and the DNS, so keep the submissions in a table you can dump as CSV, and keep the domain registered somewhere separate from whatever is serving it.
Open-source visual website builder designed around web standards, and the closest thing to this product you can run yourself.
MIT visual editor for React that hands you the block-and-slot model without writing a canvas.
Questions
It's a landing page. Why isn't this SHIP IT?
Because a landing page is not what is on sale here. Writing the page yourself is genuinely a SHIP IT activity and we would encourage it. This entry is about building the thing that makes pages — editor, hosting, domains, forms, blog — and that is a product with an audience, a public write endpoint and a certificate to renew. If your build stops at 'HTML in a repo, deployed to a CDN', you have already dodged everything on this page.
What actually goes wrong first?
The form. It is the only unauthenticated write path on a page you are deliberately sending traffic to, and it gets found fast. First it is agency spam, then somebody probes whether your notification email will relay arbitrary content, then there is a header injection attempt in the name field. Unicorn puts reCAPTCHA on every paid tier because that sequence is not hypothetical.
Does the AI page generator change the calculation?
Not much. Generating a plausible page from a prompt is the easy half and always was — it is layout and copy, and models are good at both. What you are paying for sits underneath: the domain resolving, the certificate renewing, the form not being a spam relay, and the submissions still being there next quarter. None of that gets easier because the first draft arrived faster.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
The builder is a weekend. The hosting company you accidentally founded is not.
Tilda ships 550 blocks that survive a 320-pixel phone. Your agent will build the editor and nine blocks.
A text-first site builder is a static site generator with a nicer front door. You already own three of those.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice