Choose a web design agency by asking for verifiable ownership, accessibility, SEO, costs and support evidence—not just attractive portfolio screenshots. Request the same written scope and handover conditions from every finalist. An agency that can show real testing artifacts, explain exclusions and transfer your domain, code and data safely may be a better fit than the cheapest proposal. Use the 18-question interview below before signing.
You will decide: which agency model fits your company stage, how to compare equivalent proposals, what to ask in writing, and which unanswered questions should delay a signature.
Editorial review: October 19, 2026. U.S.-focused procurement guidance. All company scenarios are fictional illustrations; this article does not quote market-wide agency rates, claim real client outcomes or provide legal advice.
0. Decision snapshot: 18 questions reveal what a portfolio cannot
A portfolio proves that someone can present a finished design; it rarely proves who will own the website afterward, whether keyboard navigation was tested, whether redirects were checked or who responds when checkout stops working. Those are operational risks. The decision is not simply “small agency versus large agency.” It is how much verifiable delivery capability, ownership clarity and continuity your situation requires.
A small business with five service pages, an editor and a straightforward contact form may be served well by a specialized team with clear responsibilities. A regional ecommerce brand with pricing feeds and payment systems needs stronger integration and release controls. A regulated enterprise will need approval records, access controls and contractual remedies that a beautiful pitch deck does not demonstrate.
Start by comparing written responses to the same eighteen questions for each agency. Give each a chance to provide examples, anonymized records or a live demonstration, while protecting confidential client information. A verbal assurance is not evidence. If a vendor cannot demonstrate a critical capability, request a named remediation or exclude that capability from the signed scope.
Separate capability from suitability
A large team is not inherently safer; a lean studio is not automatically faster. The real fit depends on who performs the work, whose processes the buyer can inspect, which handover artifacts will exist and how the company manages change. Define must-haves and genuine deal breakers before reviewing the price.
1. Quick decision summary: best-fit scenarios
Three common buyer situations illustrate where the selection boundary changes. They are examples, not recommendations based on measured agency performance.
Lean business. A local services company needs clear positioning, six pages, accessible inquiry forms, basic SEO and self-service text editing. A focused agency or well-managed platform specialist may be sufficient if it gives the owner domain and CMS access, explains maintenance duties, and tests the actual lead path. Purchasing a large integration program for this scope adds needless coordination.
Growth company. A B2B organization is expanding to multiple product lines, CRM-connected lead workflows and regular content production. It may need user research, a repeatable design system, real staging environments and better publishing governance. The key requirement is not headcount, but demonstrated experience connecting the website to sales and operations without breaking tracking or publishing.
Complex enterprise. A multi-market platform connects identity providers, permissions, external APIs, internal editorial approvals and sensitive business processes. Contracting must address security review, data-processing roles, access handover, incident response and testing at scale. A single-person delivery team could still contribute specialist work, but the buyer needs accountable coverage for the full operational chain.
| Buyer condition | Likely delivery model to evaluate | Minimum evidence | Common deal breaker |
|---|---|---|---|
| Lean, mostly editorial | Small specialist team or managed platform partner | Page scope, editor demo, accessible form QA, handover | No direct owner access |
| Growing lead-generation operation | Cross-functional studio with integration expertise | CRM proof, reporting definitions, repeatable release checklist | Unclear scope ownership |
| Ecommerce / revenue-critical | Engineering and operations-capable team | Checkout test, rollback process, support response | No incident responsibilities |
| Enterprise / multi-locale | Agency with accountable governance partners | Identity/security architecture, approval workflow, locale QA | Unreviewed data access |
These options are starting points. The cheapest project may be the most expensive if the company must rebuild it after discovering inaccessible integrations or a closed proprietary content system.
2. Side-by-side comparison on buyer criteria
A fair comparison makes the buyer's needs the constant. If Agency A proposes a branded landing site and Agency B proposes a full content workflow with CRM integration, their quoted prices do not describe the same work. Normalize deliverables, assumptions, acceptance tests and operating ownership before treating cost or timeline as an advantage.
| Criterion | Option A: managed-platform agency | Option B: custom engineering agency | Trade-off | Who should care |
|---|---|---|---|---|
| Total cost of ownership | Often simpler vendor billing | More variable support and infrastructure | Predictability versus architecture freedom | Finance owner |
| Launch speed | Reusable templates can reduce setup | Custom integration needs discovery and QA | Speed versus bespoke behavior | Campaign manager |
| SEO and performance | Platform constraints and available controls | Greater potential flexibility, with more engineering duty | Capability depends on proven implementation | Search lead |
| Data and code ownership | Export may vary by platform contract | Contract must specify IP, repo and infrastructure access | Switching friction | Business owner |
| Integrations | Prebuilt connectors | Custom adapters and APIs | Fast setup versus deeper control | Sales/operations |
| Scaling | Managed operational limits | Architecture tailored to loads, at a cost | Vendor dependence versus maintenance | Engineering lead |
| Security and governance | Platform plus agency responsibilities | Client, cloud and agency share responsibility | Clear incident ownership matters | Security/legal |
| Editorial workflow | Existing CMS experience | Tailored roles and content model | Ease of editing versus complex approval needs | Content team |
The table compares delivery models, not named providers or independently measured capabilities. Many agencies offer both. Ask each bidder to mark whether a requirement is included, excluded, subcontracted or separately priced. A proposal that says “SEO-ready” without a validation checklist is not comparable with one that lists canonical, indexation and redirect acceptance tests.
Editorial comparison model; the labels are example verification requests and do not represent real agency results.
3. Total cost of ownership and contracting reality
The initial build quote is only one part of cost. Document discovery, design, accessibility, development, content migration, integration testing, hosting, software subscriptions, security updates, monitoring, performance work and future changes. Some agencies include training and warranty fixes; others charge for each handover step. Without a common scope, neither price is meaningful.
Ask for a statement of work (SOW) that names pages or templates, supported devices, reusable components, content responsibilities, data interfaces, testing methods, review rounds and acceptance criteria. Clarify who buys and owns domain registration, hosting, paid integrations and proprietary assets. Any important line that says “to be agreed later” should receive a budget owner or defined exclusion before signature.
Questions 1–3: ownership is a contract and an operational test
1. Who legally owns the domain, content, designs and code after final payment? Request specific IP and licensing language, including third-party exclusions. The proposal must distinguish custom deliverables from licensed fonts, themes and images.
2. Will the agency provide a tested export and migration path without penalties? Ask for a demonstration using a sample database, asset library or repository. “You can export” is not enough when the export omits crucial fields.
3. Who controls DNS, hosting, analytics, Git and admin credentials? Verify that accounts exist under the business's control, with individually assigned access. No agency should require sharing a permanent owner password just to publish a text change.
A sound agreement also documents milestones, acceptance deadlines, defect remediation, termination assistance and ownership of incomplete paid work. Contract law varies; have appropriate counsel review material liability, data-processing and intellectual-property terms.
4. Speed to launch and day-2 operations
A fast delivery date does not matter if the team cannot publish a new product page or patch a vulnerability the following week. Ask candidates to describe the first thirty days after launch: who monitors uptime, approves content, triages form failures and coordinates platform updates. A launch announcement is not the same as a stable operating process.
The buyer should define a realistic content approval chain. A company with one editor may need straightforward permissions; a company with several regional teams may require draft, review, legal approval and publication stages. Agency bids should include training time and a documented escalation path, rather than assuming the original designers will always be available.
Questions 4–6: demonstrate real user-experience work
4. How did research change a recent information architecture decision? Ask for the original hypothesis, observations, design change and a limit on interpreting the findings. Do not require disclosing another client's private recordings.
5. Can you show a mobile user task test and the fixes it triggered? A screenshot of a responsive homepage does not establish that a real person can finish the contact or checkout task.
6. Who signs off inclusive content, forms and conversion journeys? Request an owner for copy, labels, validation and error recovery. The person responsible must be able to explain how the website communicates a failed submission.
Timeline depends on dependencies
The typical sequence is discovery, content inventory, design direction, implementation, integration, quality assurance, launch approval and monitoring. It changes when stakeholders need legal review, translations, external API access or data cleanup. A contract should name client dependencies so a delay in receiving product data does not become an unexplained development charge.
5. SEO, performance and technical flexibility
Good SEO begins with accurate pages and indexing controls. Ask how the agency tests title tags, canonical URLs, redirects, structured data, XML sitemaps and the site's real navigation. A proposal claiming “optimized for Google” should identify specific measurable checks, not promise rankings.
Google's Core Web Vitals documentation and Search Central guidance give practical performance concepts, including LCP, INP and CLS. Vendors should show the testing environment, device assumptions and scope of work. A passing desktop lab report does not establish that a slow mobile checkout or external integration performs well.
Questions 7–9: request the test evidence
7. How will canonical redirects, metadata and structured data be QA tested? Request a prelaunch URL inventory, representative route tests, a redirect map and a clear owner of SEO review after launch.
8. Which real-device Core Web Vitals evidence is delivered? Ask for field data where available, relevant lab evidence and a prioritized plan for slow templates. Beware of fabricated “100 out of 100” guarantees.
9. How will content editors publish without developer deployment? See a CMS demonstration with preview, role-based editing, a revision history and safe rollback. A website that requires a code build for every article may not fit a high-frequency editorial program.
Architecture follows business requirements
Do not demand a particular frontend framework simply because it appears modern. Require a solution compatible with the company's actual editor workflow, third-party integrations, accessibility goals and maintenance capacity. Evaluate vendor dependence, team knowledge and exit cost. The buyer should know which features are portable and which require rebuilding.
6. Integrations, data ownership and lock-in
Integrations are where apparently similar agency proposals diverge. A lead form feeding one CRM field is different from multi-stage qualification, deduplicated contacts, consent choices, lead scoring and attribution reconciliation. Write the expected input, transformation, failure handling and destination for each data flow.
Ask for the architecture diagram, authentication method, ownership of credentials and error monitoring. A workflow that silently drops an enquiry can cost more than a minor layout defect, yet remain invisible in visual review. Protect personal data; vendor demonstrations should use fictitious or authorized test records.
Questions 10–12: accessibility is not a plugin checkbox
10. What WCAG 2.2 success criteria and manual checks are in scope? The W3C WCAG 2 overview explains the guidelines and conformance model. Ask for the relevant target level and independent evidence, not the existence of a toolbar.
11. Can you show keyboard, screen-reader and form error testing? A legitimate test report identifies browsers, assistive technology where relevant, failure observations and remedial verification. Automated scans alone do not cover every user task.
12. How are accessibility defects triaged after launch? Identify the responsible owner, severity rules and accessible fallback. Legal duties vary by jurisdiction and sector; this article does not replace legal review.
Illustrative gap categories. The interactive scorecard later in this article shows counts driven only by the reader's selected statuses, not objective ratings of actual agencies.
7. Security, governance and enterprise requirements
Security obligations cannot be discharged by a marketing phrase such as “enterprise-grade.” An agency should be able to map administrative permissions, secrets, backups, dependency patching, vulnerable plugin response, incident escalation and restoration testing. The OWASP Application Security Verification Standard supplies a reference for specifying application-security verification requirements; the relevant subset should match the site's risk and architecture.
Different people may own cloud infrastructure, the CMS, payment processing and business data. A responsibility matrix prevents gaps between them. A shared account with unchecked administrative access can undermine an otherwise excellent design project. Ask who receives production credentials, how access ends and what happens when a subcontractor leaves.
Questions 13–15: procurement controls
13. Can we inspect a statement of work with assumptions and exclusions? It should be specific enough that a reviewer can determine whether a feature is included or not.
14. Which recurring vendor, hosting and support costs remain with us? Require itemized subscriptions, renewal owners, likely usage-related charges and the currency. Do not extrapolate a one-time quote into an imaginary industry average.
15. How are change requests estimated and authorized before work? Ask who approves extra charges, how schedule impact is documented and what baseline acceptance criteria remain protected.
A clear procurement process protects both sides. When the business requests a new feature, the agency should provide scope, assumptions, effort and acceptance criteria before work begins. Silent scope changes are not sustainable.
8. Scenario recommendations by company stage
Suppose an illustrative professional-services company has just one content editor and wants a six-page site in several weeks. The best fit could be a team that offers a documented platform configuration, reliable inquiry testing and a one-hour editor training session. A custom commerce engine would add risk without solving the company's problem. The handover test matters more than a sophisticated portfolio animation.
Now imagine a fictional B2B software company that publishes weekly research and routes requests to several sales teams. Its web partner should demonstrate author permissions, staging previews, structured SEO QA, analytics consent controls, reliable CRM delivery and deployment-free publishing. An agency without an integration testing process may be the wrong fit even if it wins the visual pitch.
For a fictional enterprise with six markets and stricter data policy, the buyer needs governance reviews, contractual data responsibilities, locale-specific content, identity integration and incident coordination. The shortlist must include suppliers willing to work with the organization's security and legal review; faster mockups cannot substitute for those controls.
Questions 16–18: verify the operating handover
16. Who patches dependencies, verifies backups and monitors uptime? Identify what is included, what needs additional subscriptions and what evidence the buyer receives.
17. Who responds to an incident and what is the escalation window? Avoid vague phrases such as “priority support.” Ask for named contacts, coverage hours, response targets and a route if the first responder is unavailable.
18. Can we rehearse a handover and recovery before contract acceptance? Request an actual editorial change, a backup restoration demonstration or an agreed simulation, using test data and documented permissions.
These three questions often reveal whether the vendor plans to hand over a sustainable service or merely an attractive launch artifact.
9. Migration and switching considerations
Switching agencies can involve content records, image rights, data exports, analytics tags, search redirects, hosting, domain control, form endpoints and software licenses. Before ending a contract, inventory what is actually accessible and who owns each asset. A rebuild can be unnecessary if the CMS and hosting are portable and the new team can maintain them.
The buyer should prioritize canonical continuity and reliable leads. Prepare a route mapping for URLs that change, check redirects and metadata, and test forms with non-personal sample submissions. Document SEO reporting definitions so a migration does not conceal a tracking break as a traffic decline.
Evaluation-and-handover timeline
Process diagram, not a fixed contract timeline. The actual sequence may include additional security, legal, procurement and approval stages.
A responsible agency should accept independent review of the promised artifacts. The buyer should also appoint a project owner who can give timely content decisions, access to required systems and precise feedback. Accountability on the client side makes scope comparisons more meaningful.
10. Decision checklist and FAQ
The scorecard below makes the full eighteen-question interview practical. For each agency and question, select Missing, Claim only or Verified artifact after personally reviewing the contract, technical evidence or demonstration. Critical gaps appear separately. The bars show only how many boxes you marked as verified; they are neither vendor scores nor a substitute for judgment.
If Agency A has more verified boxes but cannot satisfy your essential identity or content ownership requirement, do not treat its coverage as a win. Use the Copy function to share unanswered critical questions with procurement, then request an updated SOW and demonstrable responses.
Interactive agency evidence scorecard
Agency evidence interview: 18 questions
What is the single most important question?
Ask who owns and can operate the complete site after the relationship ends. It is a necessary question, not the only one; a company can own a flawed inaccessible website. Verify the supporting legal and technical handover artifacts rather than accepting a one-word yes.
Can a smaller agency deliver a serious business site?
Yes, when the scope fits and the team demonstrates the actual responsibilities. A small agency with excellent testing and clear escalation may be more appropriate than a large firm that sends the work to an undisclosed subcontractor. Check delivery ownership and continuity.
Should I choose the lowest quote?
Not without comparing the same deliverables and exclusions. A lower quote may reflect a reusable platform, fewer review rounds, limited custom integrations or omitted maintenance. Some savings are reasonable; unrecognized exclusions can cause expensive surprises.
What if an agency refuses to share another client's confidential test data?
That is a legitimate boundary. Ask for sanitized artifacts, a demonstration on a public or consented example, a test methodology, an agreed contract acceptance demonstration, or evidence from your own pilot. Never demand customer secrets to prove capability.
What should happen before contract signature?
Document the scope, decision-making roles, accessible content requirements, support ownership, artifact handover, intellectual property treatment, price/currency, renewal costs, milestones, defect remedies, and a transparent change process. Confirm what is excluded and who pays for client-side delays.
What does an effective next-step brief contain?
List the business goal, target audience, approved content, integrations, existing domain/CMS, languages, access needs, company review owners, first launch deadline, postlaunch support expectations and the scorecard's unresolved evidence. That gives candidates a common basis for a realistic proposal.
For a scoped assessment of web architecture, accessible user journeys and handover ownership, see WebDesignK web design & development. Bring the eighteen interview responses, requirements and any written quotes; the next step is a comparable delivery plan, not a promise of rankings or conversions. When ready, contact the team.
Related published guides: Technical SEO audit checklist, Core Web Vitals and performance budget, and B2B website strategy provide additional evaluation dimensions. Only use those resources after confirming their current canonical content and relevance.
References (reviewed October 19, 2026): W3C WCAG 2 overview, OWASP ASVS, Core Web Vitals, and Google's Search performance guide. These standards help define requirements; they do not certify a particular agency. Pricing and liability discussions are general buyer education, not professional legal or financial advice.
