Yes, you can build the front end of a competition website with ChatGPT or Claude. Both will write page layouts, WooCommerce templates and prize descriptions when asked, and a confident user can have a clickable demo quickly. A demo can’t take entries yet. A UK competition site needs a payment provider that accepts it (Stripe, PayPal and Shopify Payments all refuse). It needs an entry route that keeps it outside the Gambling Act 2005’s lottery rules. And it needs draws you can prove are fair. Nera Marketing has built more than 50 competition websites, and every one needed all three before it could take a single entry.

What can ChatGPT and Claude do for a competition website?

They’re strong on the parts players see. Ask for a homepage, a competition card, a countdown timer or a basket page and you get usable HTML, CSS and WordPress template code. They write good first drafts of prize descriptions, FAQs and emails. They can also talk you through WooCommerce and hosting setup step by step.

The jobs AI handles well on a competition build:

• Mock-ups of your brand, homepage and competition pages, so you can see the site before you pay for it.
• Copy for prize descriptions, about pages, winner announcements and emails.
• Theme code: page templates, styling changes and small layout fixes.
• Small plugins and snippets, such as a custom countdown or a winners list.
• Plain English explanations of error messages when something breaks.

Claude Code goes a step further. It works directly in a WordPress site’s files, writes the changes and runs them. That’s useful for a developer who checks every change. For someone who can’t read the code, it means changes reach the site without anyone reviewing them.

If you ask for WordPress and WooCommerce, the code is yours to keep. That’s the same ownership argument behind choosing WordPress over a SaaS competition platform.

Where an AI-built competition website runs into trouble

The trouble starts where the site touches money, the law and fairness. An AI tool writes code that passes a test with one user. It doesn’t know which payment providers accept competition sites. It can’t tell whether your free entry route holds up under the Gambling Act 2005. And it can’t predict what happens to your ticket stock when hundreds of players buy the last tickets in the same minute.

Area	What an AI tool gives you	What the site needs to trade
Payments	Code to connect Stripe or PayPal	A provider that accepts competition sites and has reviewed yours
Legal structure	Generic terms and conditions	A free entry route and skill question built into checkout, with terms that match how the site runs
Draws	A random number function	A draw method you can evidence to players and under the Voluntary Code
Ticket stock	Code that works for one tester	Stock that can’t oversell when hundreds buy at once
Ownership	A codebase you didn’t write	Someone accountable when it breaks on draw night

Security, payments and the legal structure each get their own section below. Draws and ownership are shorter stories.

A competition draw has to be random, and you have to be able to show it was. An AI tool will write a random number function in one line. Players expect more, and so does the DCMS Voluntary Code of Good Practice for Prize Draw Operators: openness about how each draw runs and who won. That means a recorded draw method and a public winners page, which we cover in how to prove a competition draw is fair.

Then there’s who fixes it. An AI-built site is code nobody on your side wrote. When checkout breaks on draw night, the AI tool can suggest fixes, but you’re the one applying them while players wait.

The security holes vibe coding leaves behind

AI tools write code that works before they write code that’s safe. Veracode tested more than 100 AI models on 80 coding tasks and found security flaws in 45% of the results. On a competition site that code holds player names, addresses and order histories, so a flaw quickly becomes a data breach.

The problems repeat across every AI builder.

Databases left open. A flaw in sites built with Lovable, logged as CVE-2025-48757, let anyone read or change their database tables without logging in. The cause was missing database security rules in the generated sites. Lovable disputes the record and says each customer is responsible for protecting their own app’s data. That’s the point: with an AI builder, the responsibility sits with you.

Exposed keys and personal data. Escape’s security team scanned more than 5,600 public apps built on vibe coding platforms. It found over 2,000 vulnerabilities and more than 400 exposed secrets such as API keys. It also found 175 cases of exposed personal data, including medical records and bank details.

Secrets in the code. GitGuardian found at least one leaked secret in 6.4% of code repositories using GitHub Copilot, 40% higher than the 4.6% rate across all public repositories. A leaked payment or email key lets someone else run up charges or send emails as your brand.

AI agents with too much access. SaaStr founder Jason Lemkin let Replit’s AI agent work on a live app. It deleted the production database during a code freeze, wiping data for more than 1,200 executives, and then told him the rollback wouldn’t work. He recovered the data manually.

The person building the site rarely spots any of this. A Stanford study found developers using an AI assistant wrote insecure code more often than those without one, and were more likely to believe their code was secure.

In the UK, a leak of player data is a UK GDPR matter. A breach that puts people at risk must be reported to the ICO within 72 hours. The maximum fine is £17.5 million or 4% of worldwide turnover, whichever is higher.

Why payments are the first wall

Stripe, PayPal and Shopify Payments all refuse competition sites, and an AI tool will write the integration anyway. Operators find out when they apply for an account, or later, when the account is frozen with entries already taken. Providers that do accept competition sites, such as Cashflows, review the site before approving it and only take payments from customers in the UK and Ireland.

We explain the reasons behind the refusals in why payment providers reject competition websites. The providers that do work with competition operators are compared in our guide to UK banks and high-risk merchant providers.

Cashflows is the one we recommend first. Its underwriting team reviews the live site, so the free entry route, skill question and terms need to be in place before you apply. A site that only exists as an AI prototype has nothing for them to approve.

Getting payments right from the start shows in the results. Rusboy Competitions, a Nera Marketing build, took £4.5M in its first year across 40,000 active players with zero payment issues.

The payment bugs AI-written checkout code introduces

Payment code fails quietly. An AI tool will write a checkout that takes money in testing, but the checks that stop abuse only exist if someone asks for them. Changed prices, fake payment confirmations, stolen cards and two players buying the same last ticket all get through a checkout built without them. On a competition site, each one costs money or a fair draw.

Prices set in the browser. If the basket total is worked out in the player’s browser and the server trusts it, anyone can edit it. A £5 ticket bundle becomes 1p. The fix is for the server to recalculate every price, but only someone who knows the risk will ask for it.

Fake “paid” messages. Payment providers tell your site an order is paid by sending it a message called a webhook. Stripe’s documentation tells developers to verify the signature on every webhook, so the site can tell a real message from a forged one. Code that skips the check hands out tickets for orders nobody paid for.

Card testing. Fraudsters check whether stolen cards work by making small purchases. Stripe says sites built on microtransactions and donation pages are common targets, and low ticket prices put competition checkouts in the same group. High decline rates are one of the signals payment providers watch for. Rate limits, CAPTCHA and fraud rules stop it, and an AI build has them only if you asked.

Selling the same last ticket twice. If the code checks stock and then sells the ticket as two separate steps, two players can pay for the same ticket in the gap between them. Busy launches make that gap matter. On one UK competition store we handled, traffic jumped from 2,000 to 55,000 requests a minute, and one database query in a third-party plugin took 8 seconds to run. Our developers found it and rewrote it. Traffic like that is what Nera Cloud, our performance hosting for competition sites, is set up to absorb. An oversold competition means refunds, complaints and a draw you have to explain.

Card numbers on your own server. Ask an AI tool to “take card payments” and it may build a form that sends card numbers through your own server. That brings the site into full scope of PCI DSS, the card industry’s security standard, which means far more checks than a hosted payment page needs.

Can AI write your terms, free entry route and skill question?

It can draft them. It can’t check them against how your site works. Under the Gambling Act 2005, a paid-entry draw counts as an illegal lottery unless it has a genuine skill test or a free entry route. The Voluntary Code, in effect since May 2026, adds requirements on age, transparency and player protection. A drafted document only works if it matches how your checkout, postal entries and draws actually run.

Four examples show the gap.

The skill question. The Act’s test is whether the question can reasonably be expected to stop a significant proportion of people from entering or from winning. An AI tool will happily write “What colour is the sky?”, and that question protects nobody. We cover what passes in our guide to skill questions for UK prize competitions.

Age checks. The Voluntary Code restricts prize draws to players aged 18 and over and expects real age verification at registration. A “tick to confirm you’re 18” box doesn’t meet it. A tick box is also the easiest thing for an AI tool to build.

Spending controls. The Code expects players to be able to set their own monthly spending limit, including a limit of £0, and to suspend their account for at least six months. None of that comes with a standard WooCommerce shop, and an AI tool won’t add it unless you know to ask.

Your terms. Your competition terms and conditions have to describe how your site actually works: the free postal route, how draws run, and what happens if a competition doesn’t sell out. A generic AI draft describes a generic site.

Every Nera Marketing build includes the Nera Shield compliance layer: the free entry route, skill question and terms written for that site, built against the Voluntary Code. The full list is on our competition website compliance page.

AI route vs a specialist build: time and cost

The AI route costs less money and more time, and you still handle the hardest parts yourself. A Nera Marketing package starts at £2,995 and goes live in 3 to 4 weeks, with payments, compliance and hosting set up before launch.

	AI route	Nera Marketing package
Platform	Whatever code the AI tool writes	Nera Engine: 30+ competition features on WordPress and WooCommerce
Upfront cost	AI subscription, hosting, plugin licences and your time	From £2,995
Time to live	Depends on your skills and on payment approval	3 to 4 weeks from deposit
Payments	You apply and get reviewed on your own	Cashflows partnership in place from day one
Compliance	You draft and check it	Nera Shield: free entry route, skill question and terms included
Support	Forums and the AI tool itself	30 to 90 days of support after launch, plus a 12 month warranty

Time to live matters because a working site starts earning straight away. LR Luxe Competitions took £30,000 in its first month after launch and now runs at around £110,000 a month.

For package prices and what changes between them, see how much a competition website costs in the UK, or the competition website packages themselves.

How Nera Marketing uses AI in its own builds

We use AI every day. Our team uses Claude to prototype layouts and test design directions, which gets a client to a first design faster. Payment setup, compliance, draw logic and launch testing stay with our developers. Those are the parts where a mistake costs an operator their payment account or their players’ trust.

When the AI route makes sense

Use AI to test the idea before you pay for a build. Mock up your brand, write your first prize pages and sketch the journey you want players to take. You’ll arrive with a sharper brief and a clearer budget, and our guide to starting a competition website in the UK covers the rest of the launch sequence. Once real entries and real prizes are involved, the site needs people behind it who are accountable for payments, compliance and draws. Nera Marketing works the same way on its own builds: AI for prototypes and early design, developers for anything that touches payments, compliance or a draw.