Most WordPress projects that go wrong do so for reasons visible before the contract is signed. The questions below surface them.
Who owns the code and the hosting?
Ask directly whether you will hold the hosting account, the domain registrar login and the full codebase at the end of the build. Agencies that keep these create a dependency that is expensive to unwind later, and it rarely comes up until you want to leave.
What is the page builder situation?
Elementor, Divi, WPBakery and similar tools speed up a build and slow down the site. They also create lock-in: content authored in one builder is not portable to another, and disabling the plugin can leave a page unreadable.
That may still be the right trade for a marketing site an in-house team will edit weekly. It is worth making as a decision rather than inheriting it.
How do they treat performance?
Ask what a finished site is expected to weigh, and how many plugins it will run. A typical underperforming WordPress build is not slow because WordPress is slow — it is slow because it loads six plugins that each add their own CSS and JavaScript to every page, whether that page uses them or not.
Reasonable answers involve image formats and sizing, caching, limiting plugin count, and loading assets only where needed.
What is their security practice?
WordPress vulnerabilities are overwhelmingly plugin vulnerabilities, and they are overwhelmingly in outdated plugins. Ask who applies updates after launch, how often, and whether staging exists to test them. "The client handles updates" with no process behind it is how sites get compromised.
What happens after launch?
Get maintenance in writing: update cadence, backup frequency, where backups are stored, restore testing, uptime monitoring, and response time when something breaks. Backups nobody has ever restored are not backups.
Can you see comparable work?
Ask for live sites of similar scope, then check them yourself — load one on a phone on mobile data, view the source, see how it is built. A portfolio screenshot tells you what the design looked like on launch day and nothing about what was delivered.
How is content migration handled?
For a rebuild, migration is where SEO is usually lost. Confirm that URLs are preserved or redirected one-to-one, that metadata carries over, and that someone crawls the site after launch to catch what broke. A redesign that silently 404s a few hundred indexed URLs can undo years of accumulated search visibility in a week.
