The short answer
Ask who owns the code and accounts, how updates are applied and how fast, how access is controlled, where backups live, and what happens during an incident. A good agency answers in specifics and puts it in writing. If your site will hold customer data, also ask how personal information is stored and who can see it.
- You should own the domain, hosting account and code repository.
- Ask for their patch timeframe for critical vulnerabilities.
- Every person with access should use their own account with two-factor.
- Get the handover and incident process in the contract.
Ownership first
The domain should be registered to your business, hosting should be in an account you control, and the code should be in a repository you own. Agencies can be added as users and removed later. This alone prevents most painful break-ups.
Maintenance questions
How often do you update dependencies or plugins? How fast do you apply critical security fixes? Do you test updates before they go live? Who watches vulnerability alerts? Sources: CISA Known Exploited Vulnerabilities
Access and accounts
Does each staff member have their own login with two-factor? How do you remove a leaver’s access? Do contractors or offshore staff have access, and under what controls?
Data and incidents
Where are form submissions stored? Are backups kept separately and tested? If something goes wrong, who calls us, how fast, and who helps assess breach notification? Sources: OAIC Notifiable Data Breaches
Red flags
Shared admin passwords, the agency holding your domain, no written update schedule, plugin-heavy builds with no maintenance plan, and vague answers about where data lives.
Our verdict
The best agencies welcome these questions. Put the answers in the contract.
Questions people ask
Should the agency own our hosting?
No. Hosting should be in your account with the agency as a user.
Is offshore development a security risk?
Not inherently. Ask about individual accounts, two-factor and least-privilege access.
What should a maintenance plan include?
Updates, monitoring, backups, a patch timeframe and an incident contact.
No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.
