How to Choose a Web Design Agency: A Checklist for 2026
Three proposals, three prices and usually three different jobs. What to test in a portfolio, what each proposal should spell out, the US and UAE rules on accessibility and privacy, and five red flags.
Key takeaways
- Test an agency on its live sites: a page passes Google's Core Web Vitals when 75% of page loads get LCP within 2.5 s, INP within 200 ms and CLS within 0.1.
- Send every agency the same brief and compare scope before price: templates, integrations, languages, copy and launch work explain most of the gap between quotes.
- Build to WCAG 2.2 level AA: the DOJ says the ADA covers what businesses open to the public offer online, and plaintiffs filed 3,117 federal website accessibility suits in 2025.
- The domain, hosting, platform and analytics accounts should be in your company's name, with the code and design files handed over and ownership of the work set in the contract.
- Build consent and notices into every form: the UAE data protection law bars processing without consent outside the cases it lists, and the CCPA requires a notice at collection.
To choose a web design agency, send the same brief to every studio and compare what you can check: live sites that work on a phone and meet Google's Core Web Vitals, a written process with a test site, launch SEO and accessibility in the scope, every account in your company's name and support terms in writing. Compare price last, because three quotes usually describe three different jobs.
This guide is for owners of US and UAE companies weighing three proposals for a marketing site or an online store. It follows how we run our own website projects, with examples from our client work.
How do you check a web design agency's portfolio?
Open three or four live sites from the portfolio on your phone, try to do what a buyer would do there, then run each address through PageSpeed Insights. Mockups show taste; a live site shows what the studio actually ships.
On the phone, check four things:
- the menu works with one thumb;
- the main action (call, quote, booking, purchase) is one tap away on every page;
- phone fields bring up a number pad, and email fields an email keyboard;
- text reads without zooming, and nothing jumps while the page loads.
Then measure. Google's Web Vitals guidance sets three thresholds for a good experience: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of page loads, separately on mobile and desktop.
PageSpeed Insights shows two kinds of data. The top block is field data from real Chrome users over the previous 28 days, and a page passes the Core Web Vitals assessment when the 75th percentiles of all three metrics are good. The Lighthouse score below it is lab data from a controlled test, useful for finding causes but not the pass mark. A small site may lack field data, and the tool then shows the whole domain or nothing.
Ask what the agency did on each site and who on your proposed team worked on it. A good case says what changed. Encore, a PR and events agency in Dubai, had an old site of 8 pages with no meta descriptions and 38 H1 tags on the homepage. The site we built has 34 pages, each with one H1 and its own description, and scores 100 for SEO in Lighthouse on mobile.
What process should a web design agency follow?
A sound process settles structure and copy before design, shows you key pages before any code is written and builds on a test copy of the site, not on the live one. Ask each agency to put its steps in the proposal, with what you approve at each one.
This is the order we follow, and the one to look for:
- Discovery. Goals, buyers, pages, integrations and languages, ending in a written scope, an estimate and a timeline.
- Structure. A sitemap and page outlines, sometimes a clickable prototype: what each page says and which action it drives, agreed before anyone picks colors.
- Copy. Written or edited before design, because a layout drawn around placeholder text breaks when the real text arrives. The proposal should say who writes it, for how many pages and by when.
- Design. Key pages for phone and desktop first. You comment before any code is written.
- Build on staging. A separate address, closed to search engines, where you test forms, payments and content on your own phone.
- Launch and support. Redirects, metadata and analytics go live with the site. Then the agency stays on or hands everything over.
Get the number of review rounds per template in writing, and how a request after the last round is billed.
Staging works even for a store that can't close: when we rebuilt Barber & Co's Tilda store in Minsk, new pages went live on temporary addresses and swapped in when ready, over three weeks on the live store.
What SEO work belongs in a website quote?
Launch SEO belongs in every website quote as its own line: a redirect map from the old site, a title, a meta description and one H1 for every page, a sitemap, and analytics and Search Console on your accounts. If a proposal only says "SEO-friendly", ask what will be delivered on launch day.
The minimum to see in writing:
- Redirects. A 301 from every old URL with traffic or links to its closest new page.
- Metadata. A unique title, meta description and one H1 per page, plus sharing tags and structured data where they fit.
- Sitemap and indexing. A new sitemap submitted to Search Console, and the staging block on indexing removed at launch.
- Analytics. Analytics, Tag Manager and Search Console on your company's accounts, with form sends, calls and purchases tracked as conversions.
- Speed. Core Web Vitals checked on the new templates before launch.
Redesigning a site that already ranks? The full move plan, from the URL inventory to eight weeks of monitoring, is in how to redesign a website without losing SEO. After the Barber & Co rebuild, every old catalog address redirects, with zero 404s in the post-move check.
Does your website need to meet WCAG 2.2?
Build to WCAG 2.2 level AA. The US Justice Department has no regulation with detailed web standards for businesses, but it says the ADA covers what businesses open to the public offer online, and lawsuits are common: plaintiffs filed 3,117 website accessibility suits in federal court in 2025.
The DOJ's web guidance, published in March 2022, calls existing standards such as WCAG helpful guidance and names common barriers such as poor color contrast, images without alt text, videos without captions, inaccessible forms and mouse-only navigation.
The count comes from Seyfarth Shaw's annual tally, published in March 2026. That is up 27% from 2,452 in 2024, and suits filed in state courts are not counted.
WCAG 2.2 became a W3C Recommendation on 5 October 2023. Three of its new criteria matter most on a marketing site or a store:
- Target Size (Minimum): buttons and links are at least 24 by 24 CSS pixels, or have enough space around them.
- Redundant Entry: the visitor isn't asked for the same information twice in one session, such as an address at checkout.
- Accessible Authentication (Minimum): no puzzle, memory test or retyping to log in.
Ask each agency which level it builds to, how it tests and whether fixes are in the price. An automated scan is a start, not proof: the W3C notes that tools cannot check all accessibility aspects automatically and that human judgment is required. Look for a scan plus a person testing with a keyboard and a screen reader. This is not legal advice: if you have received a demand letter, talk to a lawyer.
Who should own the domain, hosting, code and accounts?
Your company should. The domain, hosting, platform, analytics, Search Console and ad accounts should be registered to your company, with the agency added as a user. At handover you get the code, the design files and admin access, and the contract says who owns the finished work.
Check before you sign:
| What | Registered to | The agency gets |
|---|---|---|
| Domain | Your company, with your own registrar login | DNS access, if needed |
| Hosting and platform | Your company, with your card on file | Its own staff account |
| Code | A repository your company owns, or a full export at handover | Write access during the project |
| Design files | Your team's Figma workspace | Editor access |
| Analytics, Tag Manager, Search Console, ads | Your company's Google and ad accounts | User access |
| Fonts, photos, paid plugins | Licenses in your company's name | Nothing |
Give each person their own login, not one shared password, so access can be removed when the work ends. RYTM, a wellness brand in Bali, runs on one system it owns: staff sign in with Google, and their changes go to an audit log.
In the UAE, .ae names are sold only by registrars accredited by the .ae Domain Administration (aeDA), part of the TDRA, and the registrant should be your name or your organization's name, as Gulf News explains.
The contract decides who owns the work. It should say who owns the code, design and content once paid for, what the agency keeps (its own tools, code libraries and templates) and whether it may show the project in its portfolio. Rules on commissioned work differ by country, so have a lawyer read this clause.
What privacy basics should forms and cookies cover?
Forms and analytics or ad tags collect personal data, so consent and notices belong in the build, not in a fix after launch. In the UAE that means the federal data protection law; in the US, state laws such as California's CCPA. This is a general overview, not legal advice.
UAE. Federal Decree-Law No. 45 of 2021 on the protection of personal data came into force on 2 January 2022. The government's summary says it prohibits processing personal data without the owner's consent, except in cases the law sets out. Where you rely on consent, it must be clear, simple, unambiguous and easily accessible, and you must be able to prove it.
US. The CCPA applies to for-profit businesses that do business in California and meet any of three tests, such as gross annual revenue over $25 million, which California's privacy agency raised to $26,625,000 from 1 January 2025, or buying, selling or sharing the personal information of 100,000 or more California residents or households. A covered business gives a notice at collection that lists what it collects and why and links to its privacy policy. If it sells or shares personal information, it needs a "Do Not Sell or Share My Personal Information" link and must honor the browser's Global Privacy Control signal.
What to ask the agency to build:
- a consent checkbox the visitor ticks, where you rely on consent, with the time saved with the lead;
- a short notice and a privacy policy link next to every form;
- a cookie banner that holds analytics and ad tags until the visitor agrees, where your market calls for one;
- a list of every tool that receives form data, for your lawyer to check.
The policy text comes from you or your lawyer; the agency builds the mechanics. On BG Moving's quote form in New York (9 fields, only 1 optional), the phone field has a US mask and SMS consent is asked in the form itself.
What should support after launch include?
Support terms should say who fixes what, how fast and how changes are billed, in writing, before you sign. Fixing defects in what was delivered is not the same as new work, and the proposal should keep the two apart.
A simple way to set response times by severity:
| Severity | Example | What to agree |
|---|---|---|
| Critical | The site is down, checkout or forms fail | A response within hours, weekends too if you sell online |
| Major | A page breaks on one device, a payment method fails | A fix within one or two business days |
| Minor | A typo, a photo to swap | The next scheduled update |
| Change | A new page, section or integration | An estimate you approve before work starts |
Set the hours by what downtime costs you. Changes are usually billed as a monthly block of hours, a quote per request or time spent; with our clients we agree on a monthly block of hours and a response time, in writing. Whatever the model, ask:
- what is included without a request: platform and plugin updates, backups, uptime monitoring;
- whether unused hours carry over to the next month;
- for how long after launch defects in delivered work are fixed at no charge;
- what happens when support ends: the code, files and access stay with you, and the agency's logins are removed.
How do you compare three website proposals line by line?
Put the three proposals into one table and compare scope before price. Most of the gap between quotes comes from scope: the number of unique templates, integrations and languages, who writes the copy and what happens at launch. Our guide to what a website costs explains each of these drivers.
Send all three agencies the same one-page brief first, so they price the same job.
If the proposals use different platforms, settle that first. Shopify fits a standard catalog that needs checkout and payments from day one, a custom build fits a store tied to bookings, customer records or several warehouses, and Tilda fits a simple catalog and a fast start; the trade-offs are in Shopify vs custom vs Tilda. A ready-made theme is fair when the proposal names it: the Esturión store we built for US buyers runs on Shopify's Refresh theme.
| Line | A clear proposal states | If it's missing, ask |
|---|---|---|
| Scope | Pages, unique templates, integrations, languages | Which pages are custom, which reuse a template? |
| Team | Named people and who leads | Who will I talk to every week? |
| Copy and photos | Who writes and supplies them, for how many pages | Is the copy in the price? |
| Design | Key pages for phone and desktop, rounds per template | What happens after the last round? |
| Platform | Which one and why, with your running costs | What will I pay monthly after launch? |
| Staging | A test address for your review | Where do I see the site before launch? |
| Launch SEO | Redirects, metadata, sitemap, analytics | What do you deliver on launch day? |
| Accessibility | Target level and test method | Who tests with a keyboard and a screen reader? |
| Privacy | Consent, notices, cookie banner | Who writes the privacy policy? |
| Ownership | Accounts in your name, code and files at handover | Whose name is on the domain? |
| Timeline | Milestones and what you deliver when | What if our content is late? |
| Support and payments | Response times, change billing, payment schedule | What do I pay before I see a design? |
Red flags when choosing a web design agency
Five signs should stop you, or at least prompt hard questions: a template sold as custom design, everything on the agency's accounts, no staging, no written scope and reviews you can't verify.
- A template sold as custom. A theme is fine when it is named and priced as one, not when you pay for custom design and get a stock layout with your logo. If several portfolio sites look alike under different logos, ask which theme they start from.
- Everything on the agency's accounts. A domain, hosting or analytics account in the studio's name means you can't leave without its help.
- No staging. If you first see the site when it goes live, you test it in front of your customers.
- No written scope. "A modern responsive website" is not a scope. Without a list of pages, templates and integrations, every request becomes a debate about what was included.
- Reviews you can't verify. Testimonials without names, companies or links can't be checked. Clutch says every review goes through a verification process that confirms the reviewer's identity and work history; it doesn't disclose its methods, and a review it couldn't verify can still be published, marked "Not Verified". Read the labels and ask the agency for two clients you can call.
In the US, fake reviews also break a federal rule: the FTC's final rule, announced in August 2024, bans buying and selling fake reviews and testimonials, AI-generated ones included, with civil penalties for knowing violators.
If you want a fourth proposal to compare against, this is how we design and build websites: a partner scopes the job on a call, structure and copy come before design, the site launches with redirects and analytics in place, and every account stays in your company's name.
Questions we get asked
How do I choose a web design agency?
Send the same brief to three studios, then compare what you can check: live portfolio sites tested on a phone and in PageSpeed Insights, a written process with a test site before launch, launch SEO and accessibility in the scope, every account in your company's name and support terms in writing. Compare price last, because different quotes usually describe different jobs.
What questions should I ask a web design agency?
Ask who will work on your project and who leads it, which pages get a custom design, who writes the copy, how many review rounds come with each template and where you will see the site before launch. Then ask what they deliver on launch day, which accessibility level they build to, whose name goes on the domain and hosting, and how changes after launch are billed.
Who should own my website's domain, hosting and code?
Your company. The domain, hosting, platform, analytics and ad accounts should be registered to your company, with the agency added as a user you can remove. At handover you should get the code, the design files and admin access. The contract should say who owns the finished work and what the agency keeps, and a lawyer should read that clause before you sign.
Does my business website have to comply with the ADA?
The US Justice Department says the ADA applies to what businesses open to the public offer online and calls standards such as WCAG helpful guidance, though it has no regulation with detailed web standards for businesses. Plaintiffs filed 3,117 federal website accessibility suits in 2025, so building to WCAG 2.2 level AA is the safer course. This is not legal advice.
What should a website support agreement include?
Response times by severity, from an outage or a broken checkout down to a typo; what is included without a request, such as updates, backups and uptime monitoring; how changes are billed, as a monthly block of hours, a quote per request or time spent; how long defects in delivered work are fixed at no charge; and what happens to the code, files and access when support ends.
How can I tell if an agency sells a template as custom design?
Ask which theme or starter each portfolio site is built on, and look for several sites that share one layout under different logos. A theme is a fair choice when the proposal names it and prices it as one. The problem is paying for custom design and getting a stock layout with your logo, so the proposal should list which pages are designed from scratch.
Sources
- Web Vitals · web.dev, 2024
- About PageSpeed Insights · Google for Developers, 2024
- Guidance on Web Accessibility and the ADA · U.S. Department of Justice (ADA.gov), 2022
- Federal Court Website Accessibility Lawsuit Filings Bounce Back in 2025 · Seyfarth Shaw LLP, 2026
- What's New in WCAG 2.2 · W3C Web Accessibility Initiative, 2023
- Selecting Web Accessibility Evaluation Tools · W3C Web Accessibility Initiative, 2024
- Starting a new business: How to get a .ae domain for your website in the UAE · Gulf News, 2022
- Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data · UAE Legislation, 2021
- Data protection laws · The UAE Government portal (u.ae), 2025
- California Consumer Privacy Act (CCPA) · State of California Department of Justice, Office of the Attorney General, 2026
- Updated Monetary Thresholds in CCPA · California Privacy Protection Agency, 2024
- How Clutch verifies reviews · Clutch, 2025
- Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials · Federal Trade Commission, 2024
Share this article
About the author
Artsiom Yankovich
Head of Design & Strategy
Leads design and strategy, from product logic to brand. 9+ years, 150+ projects.
