Questions to ask a web developer before you hire them

Updated October 22, 2026 · 5 min read

Ask about five things before you sign: exactly what is included and what it costs, who will own the code, design and domain, how and when you pay, how the site and your customers’ data will be kept secure, and what happens after launch. Get every answer into a written quote and contract. An accepted quote is a binding contract, and unless the contract says otherwise, the developer owns what they build.

Basic checks first

• Check their ABN. Look it up on ABN Lookup, which shows whether it is active and registered for GST. If a supplier doesn’t give you an ABN and the payment is more than A$75 before GST, you generally have to withhold tax at the top rate, 47%, and pay it to the ATO, according to the ATO.
• Get written quotes. A quote should show the developer’s ABN, the work, itemised costs including GST, payment terms, dates and an expiry date, says business.gov.au. An accepted quote is a legally binding contract, but an estimate isn’t, according to Business Queensland, and the Queensland Government suggests getting at least three written quotes for anything expensive.
• Put it in writing. It’s much safer to have the contract in writing than to rely on someone’s word, says business.gov.au.

The questions to ask

Price and scope

1. What exactly is included, and what costs extra? Design, content, testing, launch, training and a warranty period are often priced separately. Ask for the scope in writing.
2. Is this a fixed quote or an estimate? A quote binds the price; an estimate doesn’t.
3. How do changes work? Changes should be agreed by both of you in writing. Don’t agree to a clause that lets only one party change the work, advises business.gov.au.
4. Can we pay against milestones? Tie progress payments to finished work and define what “finished” means, such as no defects, as the same guidance suggests.

Ownership

1. Will the contract assign the code, design and content to my business? Intellectual property created by a contractor belongs to the contractor unless the contract says otherwise, according to IP Australia. A copyright assignment only works if it is in writing and signed, under the Copyright Act, which also allows it to be agreed before the work exists.
2. Will the domain be registered in my business’s name? Under auDA’s licensing rules, someone registering a domain for you must record you as the registrant. If a developer uses their own details, it can cause eligibility problems and leaves you relying on them staying in business, warns auDA.
3. Whose name will the hosting and other accounts be in, and will I have admin logins? Ask for both from the start.

Security and data

1. How will you keep the site secure and up to date? Admin accounts need multi-factor authentication, and the site needs HTTPS, backups and regular updates, says the Australian Cyber Security Centre. In July 2026 it issued a critical alert about a large campaign exploiting website content-management systems and plugins, with many small and medium Australian businesses affected, and advised patching quickly and turning off vulnerable plugins, according to the alert. Ask who will do that, and how often.
2. Where will customers’ data be stored, and who can see it? If your business is covered by the Privacy Act, sending personal information to an overseas contractor is usually a disclosure that you remain responsible for, under the OAIC’s guidance on cross-border disclosure. In June 2026, the Privacy Commissioner found that websites using tracking pixels to collect sensitive information need consent, according to the OAIC. Ask what tracking the site will use.
3. Will it meet WCAG 2.2 at Level AA? The Australian Human Rights Commission recommends it, and says organisations can contract out a digital service but not their responsibility for equal access, so put accessibility in the contract. W3C maintains the standard.

After launch

1. What happens if something is wrong after launch? Ask for a defects period, a way to resolve disputes, and a clause covering how either of you can end the contract, as business.gov.au suggests.
2. What will support and updates cost each month, and what’s included?

Why the security questions matter

In 2024–25, 21% of Australian businesses had a cyber security incident and 28% had no measures in place to prevent one, according to the ABS. Payment redirection scams, where a criminal swaps the bank details on an invoice, cost Australians A$166.8 million in 2025, according to the National Anti-Scam Centre’s Targeting Scams report. If a developer’s bank details change, confirm them by phone on a number you already have before you pay.

Your rights if it goes wrong

• Consumer guarantees. A service your business buys for less than A$100,000 must be provided with due care and skill, be fit for the purpose you made known, and be finished within a reasonable time if no date was agreed, says the ACCC. For a major problem you can cancel and get a refund, less a reasonable amount for the work done; a minor problem must be fixed free, according to the ACCC’s guidance on remedies.
• Unfair terms. Since November 2023, unfair terms in standard form contracts are banned for small businesses with fewer than 100 employees or turnover under A$10 million, such as a term letting only one side change the contract or walk away, says the ACCC.
• Low-cost help. The Australian Small Business and Family Enterprise Ombudsman offers legal advice with a A$100 co-payment and subsidised mediation for A$250–500 per party. It received 8,623 requests for help in 2025–26, according to its data portal. State commissioners also mediate: A$330 per party for up to four hours in NSW, and A$300 for a half day in Victoria.

Sources

• ABN Lookup
• ATO: Withholding if ABN is not provided
• business.gov.au: Prepare quotes, Prepare a contract and Types of contracts
• Business Queensland: Preparing a business quote and Queensland Government: Getting quotes and signing contracts
• IP Australia: Who owns intellectual property?
• Federal Register of Legislation: Copyright Act 1968 (compilation of April 2026)
• auDA: .au Domain Administration Rules: Licensing (June 2026) and com.au domain names
• Australian Cyber Security Centre: Secure your website and CMS exploitation campaign alert (July 2026)
• OAIC: APP 8, cross-border disclosure and Tracking pixel investigation (June 2026)
• Australian Human Rights Commission: Standards and guidelines for digital accessibility and W3C: WCAG 2 overview (September 2026)
• ABS: Characteristics of Australian Business, 2024–25 (June 2026)
• National Anti-Scam Centre: Targeting Scams report 2025 (March 2026)
• ACCC: Consumer rights and guarantees (August 2026), Repair, replace, refund, cancel (September 2026) and Contracts (July 2026)
• ASBFEO: Low-cost advice, Subsidised dispute resolution and Small business population and key issues (2025–26)
• NSW Small Business Commission: How does mediation work? and Victorian Small Business Commission: FAQs

Rules and fees were checked in October 2026 and can change. General information, not legal or tax advice.