A business owner called me a while back because her website felt slow and she wasn’t getting calls from it. Routine stuff. I started where I always start, which is looking at how the site is actually put together and where its pieces live.

Within a few minutes I was looking at her invoices. Not through some clever trick — they were simply sitting in online storage with no password on it, reachable by anyone who came across the address. And they weren’t the only thing there. In the same open folder were signed contracts. Tax documents. Scans of identification. Then I realized something worse: not all of it was hers. The person who built her website had been using that same storage for every client, and had never turned the lock. Other businesses’ invoices. Other businesses’ contracts. Their customer lists. Mixed in with the guy’s own personal photos and his own paperwork.

I stopped, wrote it up, and told her to get it closed immediately. I didn’t go digging, I didn’t download anything, and I’m not going to describe how it was configured, because the point isn’t the technical detail. The point is that there was nothing to bypass. No lock to pick. It was a door standing open on a busy street, and it had apparently been standing open for months.

She had no idea. Of course she didn’t. She hired someone to build a website. She’s not a technologist. She was never going to know to ask, and nobody told her.

I’m writing this because that call wasn’t unusual anymore. I get some version of it regularly now, and I’ve watched the pattern behind it get worse over the past couple of years. So I want to lay out plainly what I keep finding when I get called in, and why I’m increasingly having to tell business owners that the thing they paid for has to be thrown away and started over. If you’re a business owner who’s about to hire someone to build your website — or you already did and something feels off — this one’s for you.

Where this is coming from

You’ve probably seen the videos. Someone on your phone screen, sitting in a rented car or a nice kitchen, explaining that you can build a professional website in twenty minutes with AI and charge small businesses thousands of dollars for it. No experience needed. No coding. Start today. There’s usually a course you can buy.

And here’s the thing — the demo genuinely works. You really can get something that looks like a website out of a modern AI tool in an afternoon. That part isn’t a lie. What the video leaves out is everything that happens after the screenshot: whether it can be found, whether it converts, whether it’s secure, whether it’s backed up, whether anyone can maintain it, whether it will still be working in eighteen months, and who’s answering the phone when it isn’t.

So a wave of people who have never run a server, never configured a permission, never had to restore anything from a backup, and never been responsible for a business’s livelihood are now selling websites to small businesses. They capture the client, collect the payment, ship the thing, and move on to the next one. And when it breaks — and it breaks — the client is standing there alone holding something nobody understands.

I want to be careful here, so let me say the quiet part directly: I’m not going to call this a scam. I don’t think most of these folks set out to hurt anybody. I think a lot of them genuinely believe they’re delivering something good, because the output looks good and they have no framework for evaluating anything else. I’m just going to tell you what I keep finding, and you can decide what to call it.

And to get ahead of the obvious question: this is not an anti-AI article. I use AI every single day. It’s in my workflow constantly, and it makes me faster and better at my job. AI is not the problem here, and anybody telling you otherwise is selling something too. The problem is what happens when a powerful tool is handed to someone who can’t evaluate what it produced, doesn’t know what questions to ask of it, and won’t be around when the answers matter. A great tool in unaccountable hands doesn’t produce a great result. It produces a convincing-looking one. Those aren’t the same thing, and the gap between them is where your business ends up.

One: the security problem, and it’s the one nobody sees

Let’s go back to that open storage folder, because that story is not a one-off and I want you to understand what it actually represents.

When you build something on the modern internet, you’re not just making pages. You’re standing up infrastructure — storage, databases, accounts, connections between services, ways for people and systems to authenticate. Every one of those things has settings. Most of them ship in a convenient, permissive state so that developers can get moving quickly, with the clear expectation that a professional will lock them down before anything real goes near them. That last step isn’t optional. It’s the job.

If you don’t know that step exists, you don’t skip it on purpose. You just never do it. And nothing tells you. The site loads. The client is happy. The invoice gets paid. Meanwhile, everything the site touches is sitting in the open, and it stays that way indefinitely because there’s no alarm bell for “you left this unlocked.” Here’s what I’ve actually come across in cleanups:

• Client documents in wide-open storage. Contracts, invoices, signed agreements, tax paperwork, scanned IDs — available to anyone who knew the address, with no login of any kind.
• Every client mixed together in one bucket. This is the part that should scare you most. When one person builds forty sites and dumps everything into a single storage account, one mistake exposes forty businesses at once, and none of them know each other or will ever be told.
• Credentials sitting in plain text. Passwords and keys pasted into files that get uploaded right along with the website, because a tool generated a config file with a placeholder in it and nobody knew it needed to be handled differently.
• Form submissions going nowhere — or everywhere. Contact forms that quietly collect customer names, phone numbers, and messages into a database that isn’t protected. Your customers trusted you with that.
• No backups whatsoever. Not bad backups. None. The entire business presence exists in exactly one place, and if it’s lost or corrupted or encrypted, it’s gone.
• Abandoned accounts nobody can get into. The domain registered under the builder’s personal account, hosting under his credit card, admin access that was never handed over. Which brings us to a special kind of nightmare: the builder stops answering, and you cannot get to your own website, your own domain, or your own email.

Sit with that last one for a second, because it comes up more than you’d think. I have talked with business owners who could not move their own website, could not update it, could not even prove ownership of the domain their customers type in, because a person who stopped returning calls holds the keys. That’s not a technical problem at that point. That’s your business held still by somebody who’s moved on.

Here’s what makes the security piece uniquely unfair to you as the owner: you cannot see it. A slow website, you can feel. A site that doesn’t bring you calls, you’ll eventually notice. But an unsecured storage bucket full of your clients’ contracts produces no symptom at all. Everything looks fine right up until the day it very much doesn’t — and by then, the person responsible is three clients down the road and unreachable. The exposure is invisible, the consequences are yours, and the liability lands on your name, not theirs.

Two: “handcrafted” — the honesty problem

Now for the part that genuinely bothers me, and I want to be precise about why it bothers me, because it’s easy to get this one wrong.

I keep running into sites built end-to-end by AI with effectively no human judgment applied — and sold under marketing copy that talks about handcrafted, bespoke, custom-built work, “no templates,” “designed by hand for your brand.” Sometimes there’s a photo of a person at a desk with a sketchbook.

To be clear: using AI to build a website is fine. I’ve said it already and I’ll say it again so there’s no confusion. I use these tools. They’re extraordinary. The problem isn’t the tool in the workflow. The problem is a claim that describes work that didn’t happen, and the reason that claim matters isn’t philosophical — it’s practical. Here’s why.

When you pay for “custom, handcrafted work,” what you’re actually paying for — whether anyone explains it this way or not — is judgment. You’re paying for someone to look at the output and know that a heading structure is wrong, that an image is nine megabytes and will kill the page on a phone, that a form isn’t actually delivering anywhere, that a setting has been left open, that the copy says something your industry legally can’t say, that the layout works on a laptop and collapses on the device 70% of your customers will use. The tool produces something. A professional decides whether it’s right. That decision is the product.

So when someone tells you they handcrafted your site and they actually just accepted whatever came out, they’re not merely shading the truth about their process. They’re telling you they applied judgment they didn’t apply. You didn’t buy a lie about their workflow — you bought a missing review step, and you paid for it, and nobody told you it was missing.

There’s also a simple test buried in here that you can run without knowing a thing about technology. Ask them why. Why is the navigation arranged like this? Why does the homepage lead with that instead of this? Why is this page structured for that search term? Someone who made decisions can tell you, in plain English, and their answer will be about your business and your customers. Someone who accepted output can’t, because there were no decisions — and you will hear it immediately. That’s not a gotcha. It’s the difference between someone who built you something and someone who generated you something.

Three: it doesn’t actually work

Here’s the part that costs you money every single day, quietly, without ever announcing itself.

A website has a job. The job isn’t to exist, and it isn’t to look nice in a screenshot. The job is to be found by people who need what you sell, to load fast enough that they don’t leave, to tell them why you’re the right call, and to make contacting you effortless. A site that does none of that while looking beautiful is a very expensive brochure sitting in a drawer.

What I find, over and over, when I audit these builds:

• Invisible to search. No real keyword work, no page structure that matches how people actually search, no local signals, missing or duplicated page descriptions, no structured data. The business does not appear when someone nearby searches for exactly what it sells. Not ranked poorly. Absent.
• Slow, especially on phones. Enormous uncompressed images, bloated code, third-party junk loading on every page. Most of your visitors are on a phone on cellular data, and they leave before the page paints.
• Forms that don’t deliver. I have found contact forms that had been silently failing for months. Every person who filled one out believed they had contacted that business. Nobody had. There is no way to calculate what that costs an owner, and no owner ever finds out on their own.
• Broken on real devices. Fine on the builder’s laptop, a mess on an actual phone — overlapping text, buttons you can’t hit, menus that won’t open.
• No way to measure anything. No analytics, no search console, nothing connected. So there’s no way to know if it’s working, which is convenient for everyone except you.
• Content that could be any business. Generic copy that never says the thing that actually makes this company different — the twenty years, the family name on the building, the one service nobody else nearby offers. The single most valuable thing about the business is simply missing.
• Impossible to maintain. Built in a way that nobody else can pick up and continue, so any future change means starting over.

And here’s the part that turns frustration into something closer to anger for me. Many of these arrangements come with a recurring monthly charge — for “maintenance,” for “hosting,” for “support.” I have reviewed situations where a business was paying a premium rate, in some cases roughly double what that service should reasonably cost, for months, and I could find no evidence that anything was being done for the money at all. No updates applied. No backups running. No monitoring. No security patching. No reporting. The site was simply sitting there, aging, while the payments went out.

That’s the piece I can’t wave off as inexperience. Not knowing how to secure a storage bucket is a knowledge gap. Charging every month for maintenance that isn’t happening is a different kind of thing.

Why I usually have to throw it out

This is the conversation I hate having, and I have it a lot, so let me explain the reasoning rather than just delivering the verdict.

When an owner shows me one of these builds, their hope is always the same and it’s completely reasonable: can you just fix it? They already paid once. Paying again feels like being punished for someone else’s failure, and I don’t blame anybody for pushing back on that.

Sometimes I can fix it, and when I can, I do — rebuilding is not a bigger invoice I’m angling for; it’s frequently a harder sale and I’d rather avoid it. But often the honest answer is no, for a reason that has nothing to do with how it looks. These aren’t sites with a few mistakes in them. They’re sites with no foundation — no coherent structure underneath, settings scattered and undocumented, no version history, no way to know what was done or why, pieces wired together in ways that only made sense to a tool in a single session that nobody recorded. Repairing that means first reverse-engineering it, and reverse-engineering an undocumented build usually costs more than building it correctly would have. Worse, when you patch something with no foundation, you inherit every hidden decision inside it. You’re now responsible for problems you can’t see.

So I tell people the truth, which is that starting clean is usually cheaper, faster, and safer than restoring something that was never sound — and that it’s the last time they should ever have to pay for this particular site twice. It’s a rough conversation. It is a much better conversation than the one where I patch it, it fails again in four months, and they’ve now paid three times.

Before anyone meets you, they meet your website

Let me step back from everything that’s broken and say why I think this matters more than most owners realize.

Almost nobody calls you first anymore. They look you up. They check your site on their phone in a parking lot, or at 11pm on the couch, and they decide something about you before they ever dial. Your website is the first conversation you have with nearly every customer you will ever get — and you are not in the room for it. It runs twenty-four hours a day, it talks to every prospect who’s considering you, and it answers the question “are these people any good?” before you get to say a single word on your own behalf.

That’s not a brochure. It’s the only part of your business that meets every prospect, and it does it without you.

Which is why the real cost of getting it wrong isn’t the money you spend fixing it. It’s the people who looked, decided, and never called — and you will never know who they were. There’s no missed-call log for that. No notification. Just a quieter phone than you should have, month after month, for reasons nobody ever tells you. It’s the same problem as the security piece: the damage is invisible, so it goes on for a very long time.

There’s a second cost almost nobody mentions, and it’s the one that actually makes “get it right the first time” more than a saying. Being found in search is earned over time — months of a stable address, accumulating credibility, content that’s been indexed and trusted. When a site has to be thrown out and rebuilt, a lot of that clock resets. So getting it right the first time isn’t about avoiding paying twice. It’s about not surrendering a year or more of ground you can’t buy back at any price. The cheap build isn’t cheap; it’s expensive on a delay.

And I want to be careful how I say this next part, because it’s easy to get wrong. I could not install a heat pump. I have clients who do that work, and I have real respect for it — it’s precise, it’s licensed, it’s earned over years, and I would not dream of doing it because I watched a video on a Saturday. That respect runs both directions. This is a trade too. So when the most visible part of a business — the thing that introduces it to every prospect it will ever have — gets handed to somebody doing it as a weekend side hustle because a video made it look easy, that’s not a bargain. It’s your storefront, built by someone who doesn’t do this for a living and won’t be here when it matters.

What I mean when I say I own the whole thing

Here’s where I’ll tell you plainly how my firm is built differently, and I’ll do my best to keep it from sounding like a brochure.

Pendergrass Consulting is an IT firm. Websites are one of the things we do — not the only thing. We also build custom web and mobile applications, set up and secure business email, host on our own infrastructure, run local and cloud backup, plan disaster recovery and business continuity, and do cybersecurity work. I’ve spent more than twenty years in this, a good stretch of it supporting hospital systems and data centers, where downtime isn’t an inconvenience you apologize for — it’s a serious event with consequences. That’s the standard I brought to small business, because I never understood why a small business should get a lesser version of it.

But the reason that list matters isn’t its length. Anybody can list services. It matters because almost every disaster I get called into happens in the seams — the gaps between the people who each own one piece and none of the connections. Let me show you what I mean, because these are real and they’re common:

• Email. This is the big one. Somebody moves or rebuilds your website, mishandles the settings that also route your mail, and your business email simply stops. For days. Orders, invoices, and customer replies go into a hole. Then the website person says it’s the hosting company, the hosting company says it’s your mail provider, your mail provider says talk to whoever changed the settings — and you are the one making phone calls at nine o’clock at night trying to get your own business back. I have watched this happen to people, and it is entirely preventable by the one thing nobody had: somebody who owned both sides of it.
• Backups. Ask who’s backing up your website. Very often the honest answer is nobody — the builder assumed the host did it, the host assumed you did, and it was never in anybody’s scope. Nobody discovers this until the day they need it, which is the worst possible day to discover it.
• Security. A site gets compromised, and the person who built it has never handled an incident in their life. Sometimes they go quiet. The owner is left to figure out what happened, what was taken, what to tell customers, and how to get clean — alone, in the middle of the worst week of their year.
• Growth. Eighteen months in, the business needs online booking, or a customer portal, or a real application to run something internally. The site can’t grow into any of it because it was built as a finished object, not a foundation. So you start over — again.

Every one of those is a gap between vendors. When one firm owns the whole chain — the site, the email, the hosting, the backups, the security, whatever gets built next — the gap doesn’t exist. And more to the point, neither does the finger-pointing. There’s one number to call and one name on it. If something I handed you breaks, it genuinely does not matter to you which piece it was; it’s mine to answer for. That’s the actual product. Not a service list — a single point of accountability, which is the thing that was missing from every story in this article.

I’ll add the small-business part without making a slogan out of it, because I think slogans about this are insulting. Practically, it means: I answer my own phone. You deal with the person who actually built your site, not an account manager reading a ticket. And I know exactly what it feels like to pay for something that doesn’t do what it promised, because I’m somebody’s customer too, and a bad month here feels the same as a bad month at your place.

The questions nobody told you to ask

Alright — enough about what’s wrong. Here’s the part I actually want you to keep, and you don’t need to understand any of the technology to use it. If you’re about to hire someone to build or manage your website, ask them these. You are not looking for technically perfect answers. You’re listening for whether they have an answer, whether it’s specific, and whether they seem relieved or annoyed that you asked. A professional will be glad you did. Print this. Screenshot it. Use it.

1. Whose name is on my domain and my hosting account? The only acceptable answer is yours. If it’s registered under their account “for convenience,” your business is on a leash. Ask for the login. Today.
2. If I fired you tomorrow, what exactly would I walk away with? The answer should be: everything — domain, hosting, files, content, admin access, and a way to hand it to someone else. Watch their face.
3. What happens to my email when you move my website? Ask this one and watch carefully. Your website and your business email are wired together behind the scenes in ways that are easy to break. Somebody who does this professionally will answer immediately and specifically. Somebody who doesn’t will get vague — and that vagueness is the sound of your email going down for three days.
4. Where will my customers’ form submissions and files be stored, and who can see them? They should be able to tell you where the data lives and that it’s protected. Vagueness here is the exact failure I opened this article with.
5. Do you keep my clients’ data separate from your other clients’ data? If forty businesses share one storage account, one mistake exposes forty businesses.
6. What’s backed up, how often, and can you show me a restore? “It’s backed up” is a claim. A restore is a fact. Anyone who actually does this can demonstrate it.
7. What exactly does my monthly fee cover? Ask for the list: updates, security patching, backups, monitoring, edits, reporting. Then ask how you’ll know it happened. If nobody can tell you what you’re buying every month, you may be buying nothing.
8. Who answers when something breaks at 6pm on a Friday, and how fast? Get a name and a number, not a form.
9. How will we know if this site is working? They should mention measurement — analytics, search performance, tracked calls or forms — and offer to show you. “It’ll look great” is not a success metric.
10. What did you do so people can find me when they search? Listen for specifics about your services, your towns, your customers. Generic SEO talk with no reference to your actual business means it wasn’t done.
11. What happens when I need this to do something new next year? Online booking, a customer portal, taking payments, a tool to run part of your operation. You want to hear that the site is a foundation that can grow, not a finished object you’d have to abandon. “We’d have to start over” is a real answer — just make sure you hear it now rather than later.
12. Do you use AI in your process, and where does your judgment come in? The right answer in 2026 is almost certainly “yes, and here’s how I check it.” Somebody who says they never touch AI is probably not being straight with you; somebody who can’t describe their review step is the risk.
13. Why did you make this choice? Point at anything on a site they built. Ask why it’s that way. Decisions have reasons. Output doesn’t.
14. Can I talk to a client you built for two years ago? Not last month — two years ago. Anybody can look good at launch. The tell is who’s still standing behind their work after the excitement wore off.

If you’ve already hired someone, start with four of them: whose name is on the domain, what happens to your email if the site moves, where customer submissions are stored, and what the monthly fee actually covers. Those four surface most of what I find in cleanups, and you can ask all four in a single email this afternoon. The answers — or the silence — will tell you a great deal.

What I actually want you to take from this

I’m not asking you to be suspicious of everyone, and I’m certainly not asking you to be afraid of AI. I’d be a hypocrite on both counts. There are excellent people doing this work, some of them young, some of them new, plenty of them using the same tools I use. Newness isn’t the problem. Tools aren’t the problem.

Accountability is the whole thing. Somebody has to be responsible for what gets shipped, has to understand what they handed you well enough to explain it, and has to still be reachable in a year when it matters. That’s what you’re really buying. It’s what I could not find behind any of the builds that ended up on my desk, and it is the single thing that separates a website that quietly grows your business from one that quietly costs you money — or worse, one that leaves your clients’ contracts sitting open on the internet without anyone knowing.

The woman whose invoices I found had done nothing wrong. She hired somebody in good faith, paid what she was asked, and had no way to know what she was actually getting. That’s what makes this worth writing about. The business owners on the receiving end of this are not careless — they’re being asked to evaluate something nobody ever taught them how to evaluate, by people who benefit from them not knowing what to ask.

So now you know what to ask. Use the list. Ask hard questions of whoever built your site, including me if you ever hire me — especially me.

If you want a second opinion, I’ll give you one free

If reading this put a knot in your stomach about your own website, get it checked. I offer a free website audit, and I’ll tell you straight what I find — including “this is in good shape, you’re fine,” which is an answer I give regularly and am always happy to give. If it isn’t fine, you’ll get a plain-English explanation of what’s wrong, what it’s costing you, and what actually needs to happen, with no obligation to hire me for any of it.

I would much rather spend twenty minutes telling you your site is solid, or catching something small before it becomes expensive, than meet you the way I met the business owner in this story. And if you’re in the middle of shopping for someone to build your site right now, take the question list with you. Even if you never call me, asking those fourteen questions will protect you from most of what I’ve described here — and that’s genuinely the outcome I’m after.

— Adam Pendergrass, Principal Engineer, Pendergrass Consulting