Website development, what to ask for before you sign

# TagsWordPressSEOSpeed

The WPhost team21 Sep 202618 min read

You are about to order a new business website and have a few website development offers in hand. Each promises "SEO optimisation" and "fast loading", yet the prices are nothing alike. Those words do not tell you what you will get. The difference shows after launch, when the site is slow on a phone or every text change means chasing the developer.

This guide covers what to ask for in writing, in the offer and the contract, before you sign. You will know exactly what you are buying, and you can send the checklist at the end to any developer.

What a website development offer should include

A good offer describes the site well enough for another developer to build it. Ask for it to list:

the pages and languages, such as home, services, about, contact and blog, in Bulgarian and English
the forms and where the submitted data goes, such as an email to the office or an entry in the admin
any connections to other systems, such as a CRM, accounting software or online booking
who writes the texts and who supplies the photos
how many rounds of design changes the price includes
what is not included, such as the domain, hosting, paid plugins, maintenance and advertising

If something is not written down, assume it is not included. Ask for the work to be split into stages (structure, design, build, launch), with what you sign off after each. Timelines depend on the scope, so ask for one per stage rather than a single date at the end.

A theme built for you, or a page builder

In WordPress the theme decides how the site looks and much of the code the browser loads. Many offers start from a ready-made marketplace theme and a page builder such as Elementor, Divi or WPBakery. A builder lets you arrange blocks with the mouse, but it loads its own code so it can do almost anything, and your content stays tied to it. Remove it later and the pages usually have to be rebuilt.

The other route is a light theme made only for your site, with blocks for the WordPress editor. It holds only what your site uses, and there is no builder for the content to depend on.

Ask for the offer to state:

the name of the theme and whether it is ready-made or built for the project
whether there will be a page builder, and which one
a list of every plugin, free and paid
whose name the paid plugin licences are in and who renews them

Licences matter. With many paid plugins, updates arrive only while the licence is active. Elementor, for example, says that without a renewal you can no longer update Elementor Pro. That is one reason the WordPress websites we build use a light theme made for the client, without Elementor or Divi. Our guide to choosing a ready-made theme or a custom design compares the two in detail.

What speed to ask for and how to measure it

"A fast site" means nothing in an offer until it says how speed is measured. Ask for five things in writing:

The tool, usually Google PageSpeed Insights.
The device. The mobile test is stricter, since it simulates a mid-range phone on a mobile connection.
The pages, for example the home page and the two main service pages.
The score, for example 90 or more for Performance.
When it is measured and what you get, for example on handover day, with the report.

The PageSpeed Insights score comes from a Lighthouse test in a simulated environment. According to Google, 90 or above is good, 50 to 89 needs improvement and below 50 is poor. Scores vary from run to run even on an untouched site, so the Lighthouse documentation recommends several runs and taking the median. Agree on this up front, so nobody argues over one unlucky run.

PageSpeed Insights also shows data from real Chrome users over the previous 28 days, assessed on the three Core Web Vitals. The good thresholds are 2.5 seconds or less for LCP (when the largest element appears), 200 milliseconds or less for INP (how fast the site responds to a tap) and 0.1 or less for CLS (how much the layout shifts). A new site has no such data yet, and with few visits it may never get any, so on handover day only the lab test can be checked.

Agree on third-party scripts too. A chat widget, ad pixels and other scripts added after launch lower the score, so measure with everything that runs from day one, such as analytics and the cookie banner. Our guide to measuring site speed with PageSpeed Insights explains the full report.

The technical SEO the offer should list

"SEO optimisation" can mean almost anything. Ask for the specific items Google describes in its documentation:

A title and a meta description for every page, which you can edit. Google advises descriptive titles that differ from page to page, and it sometimes shows the meta description when it describes the page better than the page text.
Readable addresses, for example /services/roof-repair rather than /?p=123. Google recommends readable words rather than long ID numbers.
An XML sitemap. Since version 5.5 WordPress makes one at /wp-sitemap.xml, and some SEO plugins replace it with their own. Ask for it to be submitted in Google Search Console.
Structured data describing the business name, address and opening hours in a form Google understands. Google states plainly that it does not guarantee the richer results that use it.
hreflang, if the site has more than one language. Each language version has to list itself and all the others, or Google ignores the markup.
A site open to Google at launch. During the build, the "Discourage search engines from indexing this site" box under Settings, Reading is often ticked. It adds noindex to the pages and turns off the sitemap, and if it stays ticked after launch, the site will not appear in Google.

Nobody can honestly promise first place in Google. If an offer does, ask exactly how. The checks to run before launch are collected in our technical SEO checklist for WordPress.

Who owns the domain, the hosting, the code and the accounts?

This is the most important part of the contract, because it decides how much you depend on the developer. If the domain is registered to the agency, parting ways means relying on their goodwill. Ask for this in writing:

The domain is in your company's name or yours, with your email as the contact. How this works for a .bg domain is covered in How to register a .bg domain and what to check first.
The hosting is in your name and paid by you, or at least you have full access to its control panel. If the developer hosts the site on their own server, agree in writing how you get a full copy.
The code is yours. The theme and everything written for the site live in a Git repository you can access, and the contract says you receive the code and the right to use and change it.
You are an administrator in WordPress. That role reaches every setting, and the developer works from a separate account.
You are an owner in Google Search Console and an administrator in Google Analytics. Only an owner in Search Console can add and remove users, and an Analytics administrator has full control of the property. The developer gets access as a user.

Staging and Git, before the site goes public

Staging is a copy of the site at a separate address, for example a subdomain, where work is done and tested without touching the live site. You approve the new site there before it goes public, and after launch every update goes through it first.

Git keeps the history of the code. Every change is recorded with a date and an author, and it can be rolled back if it breaks something.

Ask the developer:

Will there be a staging site, and can I look at it?
Is it password protected? Google advises a password for content that should stay out of search.
What is the launch plan, and how do we get the old site back if something goes wrong?

People tend to skip the last question. At launch the DNS records change, sometimes the server too, and if something breaks, everyone should already know who does what.

Moving the old content and redirecting the addresses

If you already have a site, Google knows its addresses and other sites link to them. When the new site changes an address, the old one has to lead to its new counterpart with a permanent redirect (301), or visitors and Google land on a 404 error page.

Google's advice is to map every old address to its new one, redirect on the server with a permanent code (301 or 308), avoid sending many old addresses to one unrelated page such as the home page, and keep the redirects for as long as possible, generally at least a year. It also warns that rankings fluctuate for a while as the site is recrawled.

Ask for the offer to state:

who moves the texts, images and posts, and whether all of them or only some
who builds the list of old addresses, for example from the sitemap, Search Console and analytics
who checks for 404 errors in the first weeks after launch

The whole process is covered in our guide to redesigning a site without losing rankings.

Will you be able to edit the site yourself?

You or your staff should be able to change a text, a photo or a price without waiting for the developer. Do not settle for "yes, it's easy". Ask to be shown in staging how to:

change the phone number in the footer of every page
add a news item or a blog post
build a new service page from the ready-made blocks
swap a photo without breaking the layout

The WordPress editor lets the developer build blocks and patterns for your design and lock them, so you change the content without moving or deleting part of the layout by accident. The theme can also limit colours and font sizes to those of your brand.

Ask for a short guide or video at handover, and a separate account for each person with the right role. Editor is enough to write and publish, and Administrator should go only to the people who really run the site.

If the site uses Google Analytics or ad pixels, keep in mind that under EU rules, cookies that are not strictly necessary for a service the visitor asked for can be set only after the visitor consents, and withdrawing consent must be as easy as giving it. Google's EU user consent policy also requires this consent when you use Google products.

Ask:

who installs the cookie banner and which tools go through it
whether analytics and pixels wait for consent before they load
whether Google's consent mode is set up

Consent mode only passes the visitor's choice to Google tags, while the banner or a consent management platform asks for it. Talk to a lawyer about the cookie policy and which cookies need consent.

Security and maintenance after launch

The work does not end on launch day. Since version 3.7 WordPress installs minor core updates on its own, security releases included. Plugins and themes update automatically only if auto-updates are turned on for each one, which has been possible since version 5.5.

Plugins are where the risk lies. According to the annual report of Patchstack, a WordPress vulnerability database, more than 11,000 new vulnerabilities were found in 2025, 91% of them in plugins and 9% in themes. Only 6 were reported in WordPress core, all low priority. For 46% of them, the developer had not released a fix by the time they were made public. Someone has to watch which plugins are affected and act, by updating, replacing or removing the plugin.

Ask:

who updates WordPress, the theme and the plugins after launch, and how often
whether updates go through staging first
whether there are backups and whether a restore from them has been tested
who watches for known vulnerabilities (CVE), and what happens if the site is hacked
whether this is in the price or under a separate maintenance contract

If nobody takes this on, the site is left unattended from launch day. What you can do yourself is covered in Secure WordPress with wp-config, .htaccess and Cloudflare.

Checklist

The offer lists the pages, languages, forms and connections to other systems.
You know the theme, the plugins and whether there is a page builder.
The PageSpeed Insights score is written down for mobile and for named pages, with a report at handover.
Titles, meta descriptions, addresses, the sitemap and structured data are in the scope.
The domain, hosting, code and Google accounts are in your name or under your control.
The site is built in password-protected staging, with a rollback plan for launch.
There is a list of the old addresses, and every changed address gets a 301 redirect.
You have seen how to change a text and a photo and build a new page.
The cookie banner holds analytics and pixels back until consent.
It is clear who updates the site and who watches for vulnerabilities after launch.

Do you need everything on the list?

For a brochure site of a few pages that will not grow, a well-maintained free theme and a few carefully chosen plugins may be enough. Even then, check the domain, hosting and logins, which cost the most when they turn out to be in someone else's name.

If you want everything on the list in one contract, our WordPress website development uses a light theme built for you, with no Elementor or Divi. We measure speed in PageSpeed Insights on mobile on the day of handover and give you the report, and the score of 90 or more holds given fast hosting and plugins we have tested. The site runs on your own hosting, and the domain and the data stay yours. With active maintenance we check the plugins, theme and WordPress against the vulnerability databases every day and update in time through staging.

Frequently asked questions

What should a website development offer include?

The offer should list the pages and languages, the forms and where the submitted data goes, connections to other systems such as a CRM or accounting software, and who writes the texts and supplies the photos. It should also say how many rounds of design changes the price includes and what is not included, such as the domain, hosting, paid plugins, maintenance and advertising. If something is not written down, assume it is not included.

How do I put the speed requirement in a website contract?

Ask in writing for the five things that make the promise checkable, which are the tool, usually Google PageSpeed Insights, the device, the pages, the score, and when it is measured and what you receive. For example, a Performance score of 90 or more on mobile for the home page and the two main service pages, measured on handover day, with the report. Scores vary from run to run, so agree up front on several runs and the median.

What is the difference between a theme built for the site and a page builder like Elementor?

A page builder such as Elementor, Divi or WPBakery lets you arrange blocks with the mouse, but it loads its own code so it can do almost anything, and your content stays tied to it. Remove it later and the pages usually have to be rebuilt. A light theme made only for your site, with blocks for the WordPress editor, holds only what the site uses.

Whose name should the domain, hosting and code be in?

Your company's or yours. The domain should have your email as the contact, the hosting should be in your name or at least give you full access to its control panel, and the code should live in a Git repository you can access, with the right to use and change it. In WordPress you should be an administrator and in Google Search Console an owner, with the developer working from a separate account.

Can a developer guarantee first place in Google?

Nobody can honestly promise first place in Google. Ask for specific items instead, such as a title and meta description for every page, readable addresses, an XML sitemap submitted in Google Search Console, structured data and hreflang for a multilingual site. If an offer promises first place, ask exactly how.

What happens to the old addresses with a new site?

When the new site changes an address, the old one has to lead to its new counterpart with a permanent redirect (301), or visitors and Google land on a 404 error. Google advises mapping every old address to its new one, not sending many old addresses to one unrelated page such as the home page and keeping redirects for at least a year. Write into the offer who moves the content, who builds the list of old addresses and who checks for 404 errors in the first weeks.

Will I be able to edit the new site myself?

Do not settle for "yes, it's easy", and ask to be shown in staging how to change the phone number in the footer, add a news item, build a new service page from ready-made blocks and swap a photo without breaking the layout. The WordPress editor lets the developer lock blocks, so you change the content without moving the layout by accident. Ask for a short guide or video at handover too.

Who maintains the site after launch?

That should be agreed in writing. Since version 3.7 WordPress installs minor core updates on its own, but plugins and themes update automatically only if that is turned on for each one, and according to Patchstack's annual report 91% of new vulnerabilities in 2025 were in plugins. Ask who updates the site and how often, whether updates go through staging first, whether there are backups with a tested restore and who watches for known vulnerabilities (CVE).

Sources