Most “questions to ask your web agency” lists are written by agencies. No surprise they are built to make the agency look trustworthy rather than to protect you. This one flips that. What matters is what the answer reveals. The length of your question list counts for little. Two questions get dodged by exactly the providers that turn expensive later, and that is where you learn fastest who you are dealing with.
Which question reveals the most about a provider?
The single question that separates good from bad: who is responsible for this website in month 13? A project provider answers honestly with “you are, or a separate maintenance contract”. That is the trap. The relationship ends at launch, the site ages, and at some point you pay a second time for a redesign. Who stays responsible after launch is the best single filter you have.
Everything else in this piece hangs off that question. Cost, ownership, maintenance, legal: each one comes down to who takes care of things once the agency is long gone. If you are still weighing the models themselves, the comparison of builder, agency, and subscription settles that first. This piece starts after it: you have decided to pay someone, and you do not want to get burned.
What does the site cost me over five years, not on launch day?
The quote is the launch price, not the five-year price. A typical small-agency project runs roughly € 5.000 to € 15.000 upfront (small-agency range; Clutch’s 2025/2026 data puts most web projects under $10,000, on a $2,000 to $100,000 spread). What that number hides: maintenance, security, legal upkeep, and for most businesses a redesign within the five years. The gap between the quote and the real cost is the whole point.
The price anchors for the three models are solid. The five-year figures below are a model and do not work as a fixed quote you can cite. Keep the two layers apart as you read.
| Model | 5-year cost (60 months) | What it includes and what stays hidden |
|---|---|---|
| Builder | € 900 to € 3.000 (platform only) | Cheapest in euros. Not included: your time, roughly 170 to 330 hours over five years. You are the maintenance. |
| Agency (project) | Launch € 5.000 to € 15.000 | The visible price is launch only. Over five years, add maintenance, security, legal upkeep, and usually a redesign, in the project model as your work or a separate retainer. |
| Subscription | € 17.700 to € 33.000 (€ 295 to € 550 x 60) | Build, EU hosting, maintenance, and ongoing legal upkeep in one predictable fee. Higher headline, but visible from day one. |
Carry the agency model forward realistically, meaning launch plus ongoing maintenance through a retainer (roughly € 50 to € 150 per month) plus a redesign within the term, and a properly maintained agency site lands somewhere around € 11.000 to € 32.000 over five years. Those are assumptions without sourced figures behind them, but the order of magnitude holds. It sits in the same zone as the subscription’s € 17.700 to € 33.000. The difference is that with the project you only ever saw the launch price. The subscription costs about the same, it just shows the five-year cost openly from the start. Most businesses refresh their site within a few years anyway, so that line item shows up either way.
Who actually owns the site, and what do you need in writing?
In Austria, the contract decides who owns a website. Paying the invoice on its own does not settle it. This is the most misunderstood point, and an evasive answer here is a concrete red flag. Four things need to be settled separately:
- Domain. An .at domain belongs to whoever is registered as the domain holder at nic.at. Ask: is the domain registered in my name from day one? A provider that sets your domain up under its own account is building in a real dependency.
- Source code. Copyright stays with the creator, meaning the developer. What you receive is a right of use agreed in writing, and only as far as it is agreed. Without that agreement you may not even be entitled to a copy of the code. Ask: do I get the source code and a written right to use it independently of you?
- Content. Text, images, and design follow the same logic. The rights stay with the creator until a written usage agreement transfers them to you. Ask: do I get written usage rights to all content, including if we part ways?
- Analytics. Unlike the three above, this one is about access. An analytics account belongs, in practice, to whoever set it up under their login. Ask: is the analytics account under my ownership, and do I keep the data if I leave? Analytics is one of ten accounts here, and the full register of accounts has its own post.
A good provider answers all four clearly and in writing. Anyone who talks around it tells you more than any reference list would. For what it looks like when ownership sits with you from the start, see who owns your website on a subscription.
Who handles maintenance and security after launch?
After launch, the work nobody sees in the quote begins, and deferred updates are a real risk. A concrete example: in early April 2026, an attacker activated a backdoor planted months earlier through around 30 acquired WordPress plugins, writing malicious code into hundreds of thousands of sites. The full story is in the post on the 30-plugin attack.
That is not an argument against WordPress as such. WordPress with someone actively behind it, updating promptly, is a solid option. What the attacker counted on was the other version: a site that runs but that no one is responsible for after launch. So the question is: who handles updates and security after launch, and how quickly? A good answer names a responsible person and a rhythm. A bad one leaves it open that it ends up on you.
Who carries the legal responsibility for the site?
Legal responsibility for the live site sits with the operator, meaning your business. The agency does not carry it. Under GDPR you are the controller for the data the site processes. An agency that builds and hosts on your instructions is usually a processor and needs a written data processing agreement for that. Ask: who signs the processing agreement, and do I get it without having to ask?
On top of that come the ongoing duties like the Impressum, the privacy policy, and cookie consent. After launch those belong to someone, or they quietly go stale. The details are in the post on the legal requirements for a business website. For the vetting question this is enough: a good provider makes compliance easy and hands you the processing agreement. A provider who flounders on “who carries the responsibility here” has not thought about it.
The checklist: question, good answer, red flag
Take this table into your next conversation. What decides is how specific the answer is.
| What you ask | What a good answer sounds like | Red flag |
|---|---|---|
| Who is responsible in month 13? | A named ongoing service, set out in the contract | “Just get in touch if something comes up” |
| What does it cost over five years? | An open reckoning including maintenance and a likely redesign | Launch price only, the rest stays vague |
| Is the domain in my name? | Yes, you are the registered domain holder at nic.at from day one | Domain runs through the agency account |
| Do I get code and content in writing? | Written rights of use to code, text, and images | “You do not really need that” or a dodge |
| Who does updates and security? | A named person and a clear rhythm | Updates are your problem after launch |
| Who signs the processing agreement? | The provider offers the data processing agreement unprompted | “A what agreement?” |
When a builder or a freelancer is the right call
If you need one landing page and nothing else, all of this is overkill. Then a builder or a good freelancer is the right call, and you should not pay for ongoing service you do not need. The questions in this piece pay off the moment your website is more than a digital business card: when customers judge you by it, when legal duties run alongside it, and when nobody in the business has time to handle maintenance themselves.
The thread through all six questions is the same: who stays responsible once the launch is over? The project model has no structural answer to that. The subscription does, because someone stays responsible and the price is predictable. If you want to see how that is split out, the plans and the frequently asked questions cover the details you want pinned down before you sign.