How to choose a web development agency: 12 red flags

The fastest way to choose well is to disqualify badly. Most poor web projects were predictable at the proposal stage: no written copyright assignment, a domain in the agency's name, guaranteed rankings, a fixed price quoted before anyone asked what you needed. Here are twelve signals worth walking away from.

Who owns what you paid for?

1. There is no written assignment of copyright. The Intellectual Property Office's guidance on ownership of copyright works states that when you commission a copyright work, the first legal owner is the person or organisation that created it — "not you the commissioner, unless you otherwise agree it in writing". Paying the invoice does not transfer copyright. Courts may find an implied licence to use the work for its commissioned purpose, but the IPO is explicit that this need not transfer ownership.

2. Your staff are contributing and nobody has mentioned joint ownership. The same IPO guidance uses a website as its worked example: commission someone to build a site alongside one of your employees and both are likely to be joint first owners. Jointly owned work needs every owner's agreement to use.

3. The domain or hosting sits in the agency's name. Usually convenience, not malice. It still means the address your customers type into a browser belongs to someone else, and it becomes leverage the moment a relationship sours. Registrant, DNS and hosting accounts belong in your company's name.

Does the proposal show they understand the job?

4. A fixed price arrived before anyone asked what you need. A number produced without a scoping conversation is a guess wearing a suit, defended later through change requests.

5. You cannot find out who will actually build it. "Our team" is not an answer. Ask for names, ask whether those people will still be on it in week six, and ask what proportion of the quoted days is supervision rather than delivery. A good answer exists; the absence of one is the signal.

6. Nobody can describe how the work gets tested. If the only quality step is the developer checking their own work, you are the test team and you find out in production. That is our own standard rather than a legal requirement, but we would want to hear who reviews code and who signs off.

Are they handling your data lawfully?

7. There is no written data processing contract. If an agency hosts your site, runs your enquiry forms or can see customer records, they are processing personal data on your behalf. The ICO's guidance on contracts between controllers and processors is that every time a controller uses a processor there must be a written contract binding that processor, under Article 28(3) of the UK GDPR. Its required terms include processing only on your instructions, help with security and breach obligations, and deleting or returning the data at the end. This is your duty as the controller, not a courtesy the agency extends. (The ICO has flagged this guidance as under review following the Data (Use and Access) Act, so work from the live page.)

8. They will not name their sub-processors. Agencies subcontract, and there is nothing wrong with that — offshore developers, hosting, form handlers. But under Article 28(4) a processor engaging another processor must impose equivalent obligations by contract. You are entitled to know who is in the chain before your customer data is.

9. Accessibility never comes up. Section 29(7) of the Equality Act 2010 places a duty to make reasonable adjustments on service providers. The Act does not mention websites, and whether that duty bites on yours is a legal question we cannot answer for you. But WCAG 2.2, a W3C Recommendation as of 12 December 2024, is the benchmark the industry works to, and an agency with nothing to say on the subject is telling you how it builds.

What are they promising, and can anyone promise it?

10. Guaranteed rankings. Google's own guidance on hiring an SEO is blunt: "No one can guarantee a #1 ranking on Google," and it advises finding someone else if a supplier promises first place. A claimed special relationship with Google deserves the same treatment.

11. They want full administrative access on day one. Google's guidance suggests granting only read access to Search Console for an audit, not write access. Apply that instinct across DNS, CMS and payment provider: access should follow need, and be revocable by you.

12. There is no exit. Ask what happens if you leave in eighteen months. You want the code in a repository you own, the domain and hosting in your name, your content exported, and personal data deleted or returned as Article 28(3) provides. A supplier who has not thought about offboarding is planning on your staying.

What should you get in writing?

One red flag is a conversation, not a verdict. Three is a pattern. Almost everything above is cheap to fix before signature and close to impossible afterwards.

Get this in writing	Why it matters	Where it comes from
Assignment of copyright in code and design	Otherwise the creator owns it, whatever you paid	IPO, Ownership of copyright works
Domain, DNS and hosting in your company's name	Removes the commonest form of supplier leverage	Commercial practice
A processor contract with the Article 28(3) terms	Required when a supplier processes personal data for you	ICO, UK GDPR Art. 28(3)
An offboarding clause: code, data, deletion	Decides whether leaving is an inconvenience or a rebuild	ICO Art. 28(3)

Cost is a separate question: what a website costs in the UK in 2026 covers the price bands, and website or web app is the place to start if you are still deciding what you are buying. Why we build on Next.js sets out our own technical choice. You can see how we scope and staff projects on our about page, our web development practice and our website design and development page.

Frequently asked questions

Who owns the code and design when an agency builds your website?

By default, they do. The Intellectual Property Office's guidance is explicit that when you commission a copyright work, the first legal owner is whoever created it and not you the commissioner, unless you agree otherwise in writing. Paying the invoice does not transfer copyright. A court may find an implied licence to use the work for the purpose it was commissioned for, but that is a limited licence rather than ownership.

What should I ask a web development agency before signing?

Four questions do most of the work. Who specifically will build this, and will they still be on it in week six? Does the contract assign copyright in the code and design to us? Are the domain, DNS and hosting accounts in our company's name? And if we leave in eighteen months, what exactly do we walk away with?

Can a web development agency guarantee first-page Google rankings?

No, and Google says so directly in its own guidance on hiring an SEO: no one can guarantee a number one ranking on Google, and it advises finding someone else if a supplier promises first place. Claims of a special relationship with Google deserve the same scepticism.

Do I need a written data processing agreement with my web agency?

If they host your site, run your enquiry forms or can see customer records, then yes. The ICO's position is that every time a controller uses a processor to process personal data there must be a written contract binding that processor, with the terms Article 28(3) of the UK GDPR requires. This is your obligation as the controller, not a favour the agency does you.

Is asking for payment upfront a red flag?

A deposit is normal; the whole fee before any work starts is not. We would expect payments staged against milestones you can actually see, so what you have paid roughly tracks what has been delivered. That is our own commercial view rather than a survey figure, but the principle holds: money should follow progress.

Nothing here is legal advice; take advice from someone qualified where these obligations carry real commercial risk.

---

Easy Insight is a UK consultancy for AI, web, apps and data — senior specialists only, no juniors.