Should I vibe code
Website builder with templates, AI tools, ecommerce, bookings, and apps
The website is the weekend. The store, the bookings, and the person who edits it while you’re away are not.
?
Their verdict, the Core price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Two different projects hide behind one question. Replacing Wix for a brochure site is among the best things you can point an agent at — a static build, a CDN, output that beats any template, done in a weekend. Replacing Wix at the tier people actually pay for is another matter entirely: Core is where payments, bookings and a store turn on, and that converts your weekend site into a system holding strangers’ addresses and taking their money. Then add the part nobody plans for, which is that Wix’s real customer is the non-technical person who needs to change the opening hours on a Sunday. Between the checkout, the CMS, the certificate renewal and the phone call, you did not build a website. You took a support contract. Ship the site; rent the store.
What actually breaks
not "if". the specific failures.
- The order that took the money and never wrote the row — an unverified or non-idempotent payment webhook, on the one checkout where the customer double-clicked
- Bookings across time zones, where a slot offered at 2pm reaches a phone that says 3pm, and the last Sunday in March finds every bug you didn’t write a test for
- Order confirmations landing in spam, because a brand-new sending domain with no DKIM looks exactly like a site that took the money and vanished
- TLS renewal, on a weekend, on the domain the business is named after — the failure mode is a full-page browser warning, not a 500
- The edit request. Every copy change is now a pull request and you are the only person who can merge it, including on holiday
- Cookie banners, a privacy policy and the analytics snippet somebody pasted in, all of which became your problem the moment you owned the origin
- Nothing at all for eleven months, and then a CVE in a dependency that sits in the checkout path
The launch weekend goes well until it doesn’t. A key rotation in the payment dashboard invalidates the webhook signing secret, so every event now fails signature verification and your handler returns 400. Stripe keeps taking payments — that side is fine, that side is theirs — but nothing writes an order row, no confirmation email goes out, and no stock decrements. By the time the first customer emails asking where their receipt is, forty-one people have paid for things your database has never heard of, and the only reconstruction available is a CSV export from the payment provider and a great deal of apologising.
Is that you?
the verdict is a default, not a law
- It is a brochure site: static output, no login, no payments, one contact form pointed at a form provider
- You are the only person who will ever edit it
- Nothing on the site is the difference between the business trading and not trading
- It takes money. Use hosted checkout so a card number never touches your origin, or buy the platform outright
- It books appointments that people will rearrange their day around
- A non-technical owner needs to change copy, prices or opening hours without you
- You are building it for someone else’s business and there is no second person who understands the deploy
If you build it anyway
the checklist, then the prompt that enforces it
- Static output on managed hosting. If a build fails, yesterday’s site is still being served — that property alone removes most of the risk in this category.
- Payments go through hosted checkout (Stripe Checkout, Payment Links). Raw card data never reaches your origin and your PCI scope stays at the smallest self-assessment tier.
- Verify the payment webhook signature and make the handler idempotent on the event ID, then write the test that delivers the same event twice.
- Send transactional email through a provider on a domain with SPF, DKIM and DMARC configured before the first order, and alert if confirmations stop going out.
- Automate certificate issuance and renewal, then monitor the renewal job rather than the certificate. The silent cron failure is the incident.
- Decide who edits the copy before launch. If the answer is not you, that is a CMS with logins and it is a separate project with a separate budget.
- Write the retention rule and the deletion job in the same commit as the orders table. Addresses and emails have a lifetime.
- Put uptime monitoring on the domain before launch, alerting somewhere that reaches a human on a Saturday.
I am rebuilding a small business website that Wix currently hosts. Push back on scope — most of the danger lives in the parts that are not the website.
1. Start by asking what the site actually does. If it only informs, build a
static site and refuse to add a database. If it sells or books, say plainly
that this is a shop rather than a page, and that everything below applies.
2. Static output on managed hosting — Cloudflare Pages, Netlify, S3. If a
build fails, yesterday’s site must still be served. No origin server unless
I can name the feature that needs one.
3. Payments go through hosted checkout (Stripe Checkout or Payment Links). Do
not build a card form. Do not store a card number, a CVV or a PAN anywhere,
ever, and tell me so if I ask you to.
4. Verify the payment webhook signature, make the handler idempotent on the
event ID, and write me a test that delivers the same event twice. The order
that took the money and never wrote the row is the failure mode here.
5. Transactional email goes through a provider on a domain with SPF, DKIM and
DMARC configured before the first order, plus an alert if confirmations
stop sending. A silent delivery failure looks like fraud to the buyer.
6. Automate certificate issuance and renewal, then monitor the renewal job
itself and alert at 30, 14 and 3 days before expiry.
7. Ask who edits the copy. If the answer is not me, that is a CMS with logins,
which is a second project — scope it separately instead of bolting an admin
panel onto this one.
8. Write the retention rule and the deletion job in the same commit as the
orders table. Names, addresses and emails are personal data with a
lifetime, not rows that live forever.
9. Uptime monitoring on the domain before launch, alerting to a phone.
10. Out of scope unless I insist: customer accounts, saved carts,
subscriptions, reviews, multi-currency, and anything that emails a list.
11. Then tell me what Wix Core costs per month and let me decide again.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
The moment the site sells anything or books anything. Twenty-nine dollars a month buys a checkout that has been through PCI review, a bookings engine that has already met daylight saving, hosting with a status page, and — the underrated one — an editor the owner can use without texting you. Build the marketing site by hand if you like; it will be faster and nicer. Just do not also become the payments team.
$29/mo is cheaper than your weekend.
Keep the site as a folder of static files generated from content you own, with the domain in the owner’s registrar account and never yours. That combination means handing the whole thing back is an email, and moving to a hosted platform is a rebuild of the theme rather than a rescue of the data. If there is a store, keep the order history in a database you can dump to CSV on demand — the payment provider has its own copy of the money, but nobody else has your line items.
Open-source web builder library for visual page editing.
Open-source visual website builder designed around web standards rather than a proprietary page format.
Questions
What if I only want the brochure site?
Then most of this entry evaporates and the answer is yes, enthusiastically. A static site generator, a managed host and an agent that knows CSS will beat a Wix template on speed, accessibility and how it looks on a phone. The verdict here is aimed at the tier Wix actually sells: the one with a store, a booking calendar and a non-technical owner attached.
Can I not just add Stripe and be done?
Adding Stripe Checkout is genuinely easy and is the right call. What is not easy is everything around it — the webhook that must be verified and idempotent, the inventory that must decrement exactly once, the refund path, the tax question, the confirmation email that has to actually arrive. The payment is the smallest part of taking a payment.
How is this different from hosting a static page for a friend?
It is not, until money or appointments are involved, and that is exactly where the line sits. A page for a friend is a favour. A checkout for a friend is a system whose failures cost them customers, and the phone call arrives at the least convenient possible moment because there is nobody else to call.
- GDPR Art. 5 — principles relating to processing of personal data
- GDPR Art. 32 — security of processing
- Stripe — reducing your PCI compliance scope
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Completion is an API call. Completion that is right often enough to trust is a product.
Sure. Build the tool you are building it with. See you in eighteen months.
You are bolting a container-escape surface to a plaintext secrets panel and giving an agent a shell.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice