How to Vet a Website Service Provider: the 12-Point Checklist

Published by SpeedSolid, website hosting, maintenance and support for small businesses nationwide. See plans and pricing.

Whether you are hiring someone to host your website, maintain it, clean up a hack or build a new one, the same checklist applies. Most bad experiences with a website service provider come from skipping three or four of these questions up front. Print this, ask every question, and the right provider will be happy to answer.

1. Who owns what?

Before any work starts, confirm in writing that you own the domain name, the hosting account, the website files, the database and every login. The provider works in your accounts, not the other way around. If a provider wants to register your domain under their name or host you under a login you cannot access, walk away.

2. What exactly is included each month?

“Maintenance” means different things to different companies. Ask for the list: WordPress core updates, theme and plugin updates, security scanning and cleanup, backups and how many are kept, uptime monitoring, form testing, content edits and how many hours. Then ask what is billed extra and at what rate.

3. How do they handle an outage?

Ask what happens at 9 pm on a Friday when the site is down. Who finds out first, them or you? Is there a phone number? What is the response commitment for a site-down versus a routine request? A provider with real monitoring will tell you they usually know before you do.

4. Where are the backups, and have they ever restored one?

A backup that has never been restored is a hope, not a backup. Ask how often backups run, where they are stored (it should not be only on the same server), how long they are kept and what a restore costs. Ask them to describe the last restore they did for a client.

5. What is the security setup?

Firewall, malware scanning, login protection, two-factor authentication on admin accounts, SSL certificate and renewal, and a plan for what happens if the site is hacked anyway. If the answer is “we install a security plugin,” ask who reads its alerts.

6. Will my contact forms actually deliver?

Form notifications that land in spam are the most common silent failure on small business websites. Ask how form email is sent (it should be through an authenticated service, not the shared server), whether SPF, DKIM and DMARC records are set up for your domain, and whether anyone tests the form regularly.

7. What does the infrastructure actually run on?

Ask which hosting companies or cloud providers sit underneath the service and what uptime guarantees and audits those providers publish. A good provider will tell you plainly what the infrastructure is certified for and what that buys you. A vague answer usually means the cheapest shared server available.

8. Is the contract month to month, and what does leaving look like?

Avoid long contracts for maintenance. Ask how you cancel, how quickly you get a full copy of your site and database when you leave, and whether there is an exit fee. Providers confident in their service do not need to lock you in.

9. Who will I actually talk to?

Ask who handles your account day to day, whether support is in your time zone, whether you can call, and whether the person answering has ever seen your website. Ticket systems are fine. Ticket systems staffed by people who know nothing about your site are not.

10. Can I see proof?

Ask for three current clients in a similar industry you can look up, not testimonials on their own website. Load those sites on your phone. Check that they are fast, secure and that the forms work. That is the service you are buying.

11. Do they understand accessibility and privacy rules?

Website accessibility demand letters and state privacy laws now reach small businesses. Ask whether accessibility fixes, an accessibility statement, cookie consent and a privacy policy are part of the service or extra, and what they do when a client receives a demand letter.

12. What does the first 30 days look like?

A provider who has done this before will describe a sequence: collect logins, copy the site, run a security and speed check, switch the domain with no downtime, test every page and form, then start the monthly routine. If they cannot describe it, they have not done it often.

How SpeedSolid answers this checklist

You own everything, always. Every plan lists exactly what is included, from $99.99 a month, month to month. Site-down issues are handled first and monitoring runs 24/7/365. Monthly backups plus a copy before every update round, restore for $50. Form delivery through authenticated email, tested daily. Enterprise infrastructure with published certifications and uptime guarantees. Accessibility and cookie tools included on Core Plus and Core Pro. Headquartered in California with teams and clients in Texas, New York, Florida and Hawaii. Compare plans or request a free site health check and we will run the first five items on this list for your current site at no charge.