Website Contract Red Flags: What to Check Before You Sign With Any Agency

The website contract red flags that matter are about ownership and exit, not design. Before you sign with any agency, the contract should answer five questions: who owns the domain, where the site is hosted and in whose account, what you receive if you leave, who holds the Google accounts, and what happens at renewal. Silence on any of them is the red flag.

The clauses that hurt later are the quiet ones: whose name is on the domain, whose account holds the hosting, what you walk away with if the relationship ends. A beautiful site you cannot move is a rental. A plain site you fully control is an asset. Everything below is something you can check in the document in front of you. If the agency will not put it in writing, you have your answer.

Find the domain in the contract. If it says the agency will register it in their own name or account, or will "handle it for you" without giving you a registrar login, flag it before you sign.

The domain is your business address. It is on your signs, your invoices, your email and your Google listing. Every link anyone has ever pointed at you lands on it. If a vendor controls the registrar account, they control whether your site loads, whether your email works and whether you can leave. Getting a domain back from someone who holds it and does not want to give it up can take months.

What to ask for:

• The domain registered in your own registrar account, in your name or your company's name.
• You hold the login. The agency is listed as a technical contact at most.
• If the domain already sits in the agency's account, a transfer to yours before launch, not after.

If a vendor already has your domain and you want it back, we wrote the step-by-step for taking back your domain, DNS and hosting. It applies whether you stay with that vendor or not.

The next question is where the site physically lives. Watch for:

• Hosting only in the agency's account, with no option to host it yourself.
• A proprietary builder or platform you cannot export from. Some platforms have no export at all; others export the content but not the design.
• The phrase "you own the content but not the site". It means you keep the words and leave the website behind.
• A monthly hosting fee with no stated right to leave with the files.

These are all forms of lock-in, and lock-in is fine as long as you choose it with your eyes open. The problem is the owner who finds out years later that "their" website is a subscription that ends the day they stop paying.

What to ask for: hosting in your own account, with the agency given access to manage it. If the agency insists on hosting it themselves, a written clause that you receive the complete site files and database on cancellation, or the static files if the site is static.

That last point matters more than it sounds. A static site is a folder of files. It can be moved to another host without being rebuilt. The exit clause is built into the architecture, not just the contract. It is one reason we build the way we do, and it is why a WordPress-to-static migration is worth a look if you are already stuck on a platform you cannot leave.

If you check only one clause, check this one. It is the clause that decides whether you can leave. A contract can describe the start of the relationship in detail and say nothing about the end.

Find the clause that lists what you receive if you leave. It should name, specifically:

• The complete site files and the database, or the static files
• Your DNS records, so the next host can copy them exactly
• Owner access to Google Analytics and Google Search Console
• The written content, the images, and the original logo files in editable formats
• A reasonable window to collect all of it before anything is shut off

If the contract does not have this clause, the absence is the red flag. Ask for it to be added. An agency that intends to give you your files has no reason to refuse.

Analytics, Search Console, Business Profile and Ads hold your traffic history, your search data, your reviews and your ad history. They are also the keys to fixing things when something breaks.

The red flag: these properties get created under the agency's Google account, and you are given "user" access, or none. When the relationship ends, the history can go with them. Your Ads structure, your Analytics history, your Search Console data, your Business Profile and its reviews, all of it can sit under someone else's login.

What to ask for:

• Every property created under your own Google account, with you at owner level.
• The agency added at the level the work needs (for example, Manager on Business Profile, Full user in Search Console, Editor in Analytics), never as the owner in your place.
• For Google Business Profile, you are the primary owner. Not an owner. The primary owner.

You can check Search Console today: log in and look at who is listed under Users and permissions. If you are not listed as an owner of your website's property, that is a conversation to have this week, not at renewal.

The people matter as much as the accounts. If you are vetting an SEO vendor, we published what to ask before you hire an SEO company, and the questions apply anywhere.

"We will get you to page one." "Guaranteed rankings." "Number one, or your money back."

No honest agency can make that promise, and the reason is simple: nobody outside Google controls Google. Rankings depend on what competitors do, what the algorithm rewards this quarter, how AI answers reshape the results page, and how your market behaves. An agency can influence all of that. It cannot command any of it. Google's own guidance on hiring an SEO says the same thing: no one can guarantee a number one ranking on Google. A guarantee can hide a loophole (page one for a search term nobody uses), or it can be a promise nobody can keep.

What an honest proposal says instead: what will be done, what will be measured, and how often you see the data. That is the standard to hold any agency to, us included. Here is how we approach SEO work.

"Monthly maintenance." "Ongoing SEO." "Website care plan." Read the line that follows. If there is no list of what gets done, you are paying for a label.

What to ask for:

• A list of tasks, by name: updates, backups, uptime monitoring, content, link work, technical fixes, whatever applies.
• A monthly report you can actually read, with numbers you can check yourself in Analytics and Search Console.
• A right to cancel on reasonable notice, stated in the contract.

A retainer with deliverables is a service. A retainer without them is a bill you cannot check.

Term and renewal clauses are where small print does its work. Look for:

• Auto-renewal with a long notice window. You must cancel in writing by a specific date, well before the term ends, or the whole term renews. Find the date. Write it down.
• Multi-year terms for a small site. A handful of pages does not need a multi-year commitment. Ask why it is there.
• Cancellation fees. Some are reasonable, such as paying for work already delivered. Some are a penalty for leaving. The contract should say which.

None of these are automatically wrong. All of them should be visible, understood and agreed to before you sign, not discovered when you try to leave.

Plenty of contracts stop at "the site goes live". The clauses below protect your traffic and your users. Check whether yours includes them.

• A redirect map when URLs change. If any page address changes in the rebuild, every old address needs a redirect to its new one. Skip this and the rankings you built over years can drop soon after launch. We wrote about why traffic drops after a relaunch and how to recover it.
• A performance standard at launch. Ask for PageSpeed Insights scores, mobile and desktop, measured on the day it launches. It is a free, public tool. If the agency will not commit to a number, ask what number they expect.
• Mobile and accessibility. The site should work on a phone and be usable with a screen reader. Both are checkable, and both belong in writing. Ask which accessibility standard they build to. Ontario's accessibility rules reference WCAG 2.0 Level AA, and newer versions of WCAG build on it.
• Schema. Structured data tells Google what your business is and does. It is easiest to add at build time, so ask for it in the build. Here is the schema a service business actually needs.
• Who owns the photos and the copy. If the agency writes the words or shoots the photos, the contract should say you own them on payment. For stock images, the contract should say who holds the licence and whether it still covers your site after you leave.

Watch for these in the payment terms:

• Full payment before anything is shown. You should see work before the final payment.
• No milestone tied to a visible deliverable. "Design approved" and "site live on your domain" are milestones. "Phase two" is not.
• "Unlimited revisions" with no definition. Unlimited can mean unlimited until the agency decides it is done, and then it becomes a change order. Ask what counts as a revision and what counts as new work.

A good contract answers every row in the table above in plain words. If a row is missing, ask for it in writing before you sign.

This is not legal advice. Have a lawyer read anything you are unsure of, especially term, renewal and ownership language.

Ask us the same questions you ask anyone else, and judge our answers the same way. We have published how an owner takes back control of their domain, DNS and hosting, and the brands we build live on static files the owner can pick up and move.

Send the proposal questions you are stuck on, or tell us what you are building. One form. A real reply from the people who do the work, in-house in Mississauga. Not a sales rep.