How to Choose a Web Design Agency in 2026: What to Check Before You Call

Search for advice on picking a web design agency and the first page hands you behavior. Watch for poor communication. Watch for vague pricing. Watch for a firm with no clear process. Every warning on those lists describes how a seller acts inside a sales conversation, which is the one part of this relationship the seller has rehearsed.

There is a second kind of check that almost none of those pages mention, and it runs before you speak to anyone. Three public records will date the claims on an agency's website, and two free tools will measure the work. Google publishes its own list of questions for hiring this kind of help, and the guides competing for this search do not cite it. Every figure below was read or measured on 19 August 2026, and where a test was run on our own site the result is printed here, including the one that came out badly. Since we sell websites, this is a page written by one of the firms you would be checking, and it should be read that way.

The 30-second answer

Most of this decision can be settled before a single call, from records the agency does not control. Look up the domain registration to date the firm, pull its portfolio sites out of the Internet Archive to see whether that work is still live, measure its own site with PageSpeed Insights, and find the company registration behind the trading name. Then read Google's own published guidance on hiring, which tells you that nobody can guarantee a ranking and that you should grant read access to Search Console and nothing more while a firm is still pitching. Two checks are left for the conversation itself: what account access they ask for, and what the contract says about ownership. The whole records pass takes about half an hour.

What the advice on page one is actually measuring

The standard red-flag list measures sales performance, and sales performance is the least reliable signal available to you. An agency with no process can describe a process. A firm that has never shipped for your industry can talk fluently about your industry for forty minutes. Clear communication during a pitch predicts clear communication during a pitch.

This is not an argument that the conversation is worthless. It is an argument about order. Do the records first, take what you find into the call, and you will be asking about specific things rather than listening for a tone. A firm that has been trading for four years and a firm that says it has been trading for fifteen sound identical on a call. They do not look identical in a registry.

One more thing worth saying plainly, because it shapes everything below. Every check here is one you can run on us, and we have run them on ourselves at the end of this article. If a check only works in one direction it is marketing, not a method.

Check one, the domain record, which dates every claim on the site

The registration record is the cheapest way to test an agency's history, because it is published by the registry rather than written by the agency. Since 28 January 2025 the authoritative source for that data is the Registration Data Access Protocol, not the old WHOIS service. From that date ICANN stopped requiring generic top-level domain registries and registrars to run WHOIS at all, with .com, .name and .post carved out of the change. ICANN runs a free lookup at lookup.icann.org, and in the announcement making the change it put RDAP traffic at more than 10 billion queries a month as of December 2024.

Four fields are worth your attention. The registration date, which you compare against any claim about years in business. The registrar, which tells you where the asset actually lives. The status flags, where a set of client-side locks means somebody has deliberately made the domain harder to move or delete. And whether the zone is signed with DNSSEC, which most small business domains are not.

The company register behind the trading name is the second free record, and it is the one that tells you what you would actually be contracting with. In the United States that is the Secretary of State business search in the state of incorporation, which returns the formation date, the entity type and whether the company is in good standing. In the United Kingdom, Companies House publishes the same thing plus filed accounts and the list of officers, free, at find-and-update.company-information.service.gov.uk. A trading name with no registered entity behind it is not automatically a problem, since plenty of good freelancers are sole traders, but you should know which one you are hiring before you send a deposit.

Read the date as a question, not a verdict. Plenty of good studios rebranded and bought a new domain last year, and plenty of empty shells own fifteen-year-old domains they bought at auction. What you are testing is the gap between the record and the claim. A homepage that says it has served clients since 2011 above a domain first registered in 2024 has a story to tell, and it might be a perfectly good one. Ask for it.

Check two, the portfolio, which is a claim until you open the live sites

Treat a portfolio as a list of assertions to verify, and verify it in two passes. First, open every live URL. Screenshots with no link attached are the format of choice for work that is no longer live, was never live, or was never theirs. Second, run the ones that matter through the Internet Archive, which lets you see what a page looked like on a given date rather than what it looks like after two years of somebody else's edits.

The Archive publishes a machine-readable index, so you do not have to click through a calendar. Requesting web.archive.org/cdx/search/cdx?url=example.com&output=json returns one row per capture with the date and the HTTP status. Two patterns are worth catching. A portfolio site whose archived version from the launch year looks nothing like the case study means the client has since replaced the work, which is information, not an accusation. No captures at all before the stated delivery date mean the site did not exist when the work was supposedly finished.

The same index makes a quieter check possible on the agency's own site. Ask when their portfolio page first appeared and how much of it has survived. A studio that quietly deletes half its case studies every year is telling you something about how those relationships ended.

Check three, their own site measured, and the promise to stop accepting

If an agency promises you a performance score, ask which run. We tested our own homepage twice with Google's PageSpeed Insights on 19 August 2026, changing nothing between the two tests. At 2:55:09 PM it scored 96. Seventy-four seconds later, at 2:56:23 PM, the same URL scored 86. Largest Contentful Paint was 1.7 seconds on the first run and 4.1 seconds on the second, which is not a small wobble: those two numbers sit on opposite sides of both thresholds Google publishes, one comfortably good and one squarely poor.

The direction of the other metrics makes the point sharper. Total Blocking Time actually improved between the runs, from 130 milliseconds to zero, and Speed Index improved too. The score still fell ten points, because Largest Contentful Paint, which carries a quarter of the weight on its own, went from good to poor.

Two things follow from that chart. Total Blocking Time is the heaviest single input at 30% and it is not a Core Web Vital, while Interaction to Next Paint is a Core Web Vital and carries no weight in this score at all. So a performance score is not a measurement of the three things Google says it uses. It is a related lab test with its own recipe.

The scale is worth knowing too, because it explains why 90 sounds so impressive. Google documents that each metric's scoring curve is fitted to real HTTP Archive data, with the 25th percentile of sites mapped to a score of 50 and the 8th percentile mapped to 90. So a green metric means that page was in roughly the fastest tenth of the web on that measurement, on that run, which is a genuine achievement and also a moving target.

None of this makes the tool useless. We use it constantly, and the diagnostics under the score are some of the most useful free diagnostics available for a specific page. It makes the promise useless. A firm that guarantees a number is guaranteeing the outcome of a test that varies by ten points on an unchanged page.

Check four, the numbers Google actually uses, and why yours may not exist

The measurements that feed Google's page experience signal come from real visitors, not from a test anybody runs on demand. Three metrics matter, each has a published boundary, and a page passes only when it meets all three targets at the 75th percentile of real page loads, counted separately for mobile and desktop.

Largest Contentful Paint should arrive at 2.5 s or less and counts as poor above 4.0 s. Interaction to Next Paint should be 200 ms or less and is poor above 500 ms. Cumulative Layout Shift should be 0.1 or less and is poor above 0.25. Those are the whole standard, and any agency proposing to improve your page experience should be able to say which of the three your site is failing.

Google set those boundaries against a stated achievability rule: a good threshold has to be reachable by at least 10% of origins. When the current thresholds were fixed, 27% of phone origins were meeting the Largest Contentful Paint target, 56% were meeting the interactivity target and 60% were meeting the layout target. These are not aspirational numbers invented by an agency; they were pitched at levels a real share of the web was already hitting. Loading was the target most sites were failing then, and it is the one that failed our own homepage on the second run above.

This next part catches out most small businesses, and it caught us. Field data needs enough real traffic before Google will report it. The top row of both of our reports above says No Data, because our own site does not have the visitor volume to produce a reading. Absence is not failure here, and it means the only performance number available for a small or brand new site is the volatile lab one. Anyone showing you a Core Web Vitals pass for a site that has not launched is showing you a simulation.

Check five, the platform, which moves your odds before anyone writes code

Ask what they build on and why, because the answer shifts your starting position measurably. The Web Almanac measures Core Web Vitals across the whole crawlable web by platform, and in 2025 the spread between the best and worst mainstream systems was 40 percentage points.

Between the two ends the order runs TYPO3 at 79%, Squarespace at 69%, Drupal at 61%, Joomla at 55%, 1C-Bitrix at 54%, and Tilda and Weebly level at 47%. Duda leads the table on 85% and WordPress, the platform most agencies will propose to you, comes last on 45%.

Read this as defaults, not destiny. The tightly managed hosted builders score well because they control the hosting, the image pipeline and the theme, and their customers cannot install the plugin that breaks it. The extensible platforms score worse because their averages include every abandoned site running eleven plugins on cheap shared hosting. A carefully built WordPress site will beat a neglected Squarespace one every time, and a bad custom build will lose to both.

What the chart is genuinely good for is calibrating a promise. If a firm proposes the platform sitting at 45% and also guarantees you a fast site, they are proposing to beat their own tooling's odds, which is possible and is exactly the thing to ask them how they do. We have written separately on the wider builder versus designer decision, which is the version of this question you face before you shortlist anyone.

Check six, the questions Google publishes and nobody quotes

Google maintains a page on hiring this kind of help, last updated on 5 June 2026, and it is the single most useful document in this entire search result. It is written about hiring an SEO, but every question on it applies to anyone who will touch your site, because the risk it describes is the same one: work done on your behalf that damages your visibility.

The interview list is short and specific. Can they show previous work and success stories. Do they follow Google Search Essentials. What results do they expect and in what timeframe, and how will they measure success. What is their experience in your industry, your country and your city. How long have they been in business. How will you communicate, and will they share every change they make to your site.

The warnings are blunter than anything an agency would write. Google states that nobody can guarantee a number one ranking, and says to be wary of firms that claim guaranteed rankings, a special relationship with Google, or a priority submission. It says to be skeptical of agencies that email you out of the blue, and it compares that mail to the offers you already delete. It notes that Google does not evaluate or endorse third-party SEO tools and that those tools have no access to its internal ranking data, which is worth remembering the next time somebody shows you an authority score as though it were a fact about Google.

It also puts the liability where it lands. Google's page says the responsibility is yours: you answer for the actions of any company you hire, and deceptive content created on your behalf can get a site removed from the index entirely. That single line should change how you read a proposal offering hundreds of backlinks. Google's spam policies name buying links, excessive exchanges, automated link building, and paid guest posts or press releases carrying optimized anchor text. They also name scaled content abuse, which covers generating large volumes of pages with AI tools without adding value, and that is a fair description of several content packages being sold this year.

Check seven, the access they ask for, which is the one to get right first

Watch what permissions a firm requests and when, because the wrong grant is far harder to reverse than a bad invoice. Google's guidance is explicit on the audit stage: grant read access to Search Console at that point, and do not grant write access.

Search Console has three permission levels for people. An owner has full control and can add and remove other users. A full user sees all data and can take some actions. A restricted user gets simple view rights on most data. That ladder is not the trap. The trap is that there are two kinds of owner. A delegated owner can be removed by any owner from the user management screen. A verified owner proved ownership with a token, such as a file or a tag on the site, and removing that person means finding and removing their token from your own site. A property must keep at least one verified owner or nobody has access at all.

So the sequence matters more than the policy. Verify the property yourself, with your own token, before anyone else touches it. Add the agency as a full user, or a restricted one while they are still pitching. You can then remove them in ten seconds when the engagement ends, without going hunting through your own markup. The same reasoning applies to the registrar account, the hosting account and the analytics property, and we have set out the ownership half of that argument in detail in who owns your website.

Check eight, reviews, which are claims governed by a rule

Read testimonials as marketing copy that happens to be regulated, and check them the way Google suggests, by asking for business references and actually calling past clients. Since 21 October 2024, the FTC's rule on the use of consumer reviews and testimonials, 16 CFR Part 465, published at 89 FR 68034, has banned fake and insider reviews, undisclosed material connections, compensation conditioned on a particular sentiment, suppressing negative reviews through legal threats, and buying fake indicators of social media influence.

This is not an abstract risk in our industry, and the clearest example involves a website vendor. In an order finalized in April 2025, the FTC required accessiBe, which sells an automated web accessibility widget, to pay $1 million. Its product could not make any website conform to the accessibility guidelines, the complaint alleged, despite claims that it could, and the company also formatted third-party articles and reviews so they read as independent opinion while failing to disclose its connections to those reviewers. The second allegation is the one worth carrying into your shortlist. Paid coverage dressed as independent opinion is something a regulator has alleged and settled against a vendor in this market, not a thing we are inventing to make a point.

Two practical moves follow. Check whether the glowing third-party review of an agency is on a site the agency has any relationship with, and check whether an accessibility or compliance promise is being made about an automated product. We have written on both sides of this: what you can and cannot publish in the testimonial rules, and what actually reduces legal exposure in accessibility compliance.

The eight checks, and what a bad result actually means

Everything above condenses into one page. Nothing in this table requires the agency's cooperation, and none of it costs money.

The two questions the records cannot answer

Two things stay invisible until you read the paperwork, and both decide what you are left with when the relationship ends. The first is ownership. A website is not automatically yours because you paid for it, the domain and hosting accounts should be in your company's name before anything is built, and the transfer of copyright is a specific clause rather than a general assumption. We have taken that apart properly in what to check before you sign, and it is the piece to read next if a contract is already in front of you.

The second is what happens after launch. Hosting, platform updates, somebody being responsible when a form stops sending, and the cost of changes are four separate purchases that usually arrive as one vague monthly figure. Ask for them itemized before you sign, not after the first invoice, and see the four bills behind one number for what each of them tends to cost.

What we sell, and the readers we would turn down

Two shapes of work are set out on our offer page: a build you own outright, paid once, and a monthly partnership for businesses with continuing work. What it costs depends on what already exists, so the number gets agreed on a call rather than guessed here. A focused build typically goes from kickoff to live in about two weeks. Any partnership inquiry gets a reply within 48 hours. Out of more than 200 shipped projects the outcome we point at most often is a treatment center rebuild, after which Cornerstone Healing Center saw 20% more website conversions. We work across local service businesses and fourteen other fields, and the industry pages set out how.

Plenty of readers should not hire us, and being specific about that is more useful than a disclaimer. A site that already converts, whose only fault is looking dated, does not need us, and that money is better spent closer to revenue. If the checks above are new to you because this is a first website for a business that has not yet proven demand, a hosted builder will get you trading faster and cheaper, and you can hire properly once you know what the site has to do. If what you actually want is somebody to run paid ads and post to social every week, that is a different trade with different specialists, and we would be an expensive way to buy it.

Where we earn the money is when the site itself is the constraint. A practice whose phone rings but whose online booking never gets used. A company whose old vendor holds the domain. A business selling something considered and expensive, where the website has to do the arguing before anyone will book a call.

We ran all eight checks on ourselves

A method you will not turn on yourself is a sales tactic. Here is our row, filled in on 19 August 2026, in the same order as the table, so you have a completed example to hold the others against. Two of the eight come back badly.

One, domain registration. khanwork.com was registered on 11 November 2022 through GoDaddy, IANA registrar ID 146, and it expires on 11 November 2026. All four client-side locks are set, covering transfer, update, renew and delete. The zone is not signed with DNSSEC, which is a gap rather than a crisis and is on our list. So we are a young domain, and nothing on our site claims otherwise. If it did, that record is where you would start.

Two, portfolio, live. This one we fail. Our case study pages name the client and the outcome, but they do not currently link out to the live sites, which by the rule we set out above is the weaker format. Hold that against us; it is exactly the gap this check is designed to surface. Ask us for the URLs and you will get them, and the pages should carry them without being asked.

Three, portfolio, historic. The Internet Archive holds 47 captures of our own root URL, the first from 17 March 2023, about four months after the domain was registered, which is what you would expect from a site that was being built during that gap.

Four, our own speed. Published above, including the run we would rather not have shown you. Mobile performance came back at 96 and then 86 within 74 seconds, with Largest Contentful Paint at 1.7 seconds and then 4.1 seconds. Accessibility scored 97, best practices and SEO both scored 100. A run landing at 4.1 seconds means a real visitor on a throttled connection can wait that long for our main image, so it is a defect on our side rather than a quirk of the tool, and it is the kind of thing you should expect a candidate to name rather than explain away. The field data row says No Data on both runs, because the site does not yet get enough traffic for Google to report real-user measurements. Any agency claiming a verified Core Web Vitals pass for a site this size is describing a lab test.

Five, platform. This site is a statically generated build rather than a CMS, which is why it does not appear in the chart above. That is a deliberate trade and it costs us something real: editing content here needs a developer in a way that a Squarespace site does not.

Six, guarantees. We do not guarantee rankings, positions or scores, for the reasons set out in this article. The two-week figure above is what a focused build typically runs to, not a promise, and projects with unsettled scope run longer.

Seven, account access. We ask clients to verify their own Search Console property and add us as a user on it. Where a previous vendor already holds verified owner status, untangling that is usually the first hour of the engagement.

Eight, reviews. The testimonials on our site are from named clients on named projects rather than anonymous praise. Ask for references and we will give you names and numbers to call, which is the check Google recommends and the only one on this list that needs us to do anything.

Run the same eight rows for every firm on your shortlist, including the one you are already leaning towards. The firm that comes back with the fewest gaps between its claims and its records is not automatically the best designer in the pile, but it is the one whose proposal you can read at face value. That is worth more than a page of adjectives about process.