ES Get a quote
Digital strategy

Red flags when hiring your website (2026): 12 warning signs and how to protect yourself

Hiring someone to build your website is one of those decisions where it is easy to go expensively wrong, because whoever hires is almost never an expert in what they are buying. It does not take an outright scam to end up paying too much, locked in, or with a site that does not perform. The good news is that the warning signs are predictable. This guide gathers the most common red flags when hiring your website in Latin America, grouped by theme: the money and contract ones (a budget with no scope, a verbal agreement, 100% upfront, a deadline with no penalty, choosing on price alone), the ownership ones (domain or hosting in the provider's name, no ownership of the code and credentials, the one who disappears after delivery), and the technical ones (an overloaded template sold as custom work, not explaining the technology choice, a portfolio of screenshots with no metrics). It adds two new 2026 signs almost no list includes —the provider not knowing whether your site will be readable and citable by AI, and not being able to show you the real PageSpeed of their own site— and closes with how to protect yourself in writing: scope, milestones, ownership and verifiable proof, not screenshots.

By Website Panama Team · · 17 min read
30–40% healthy deposit not 100% upfront
In your name domain and code or you get locked in
Metrics not screenshots demand verifiable proof
AI-readable? the 2026 question almost nobody asks

Hiring someone to build your website is one of those decisions where it is easy to go expensively wrong, because whoever hires is almost never an expert in what they are buying. That creates fertile ground for abuse: it does not take an outright scam to end up paying too much, locked in, or with a site that does not perform. The good news is that the warning signs are fairly predictable, and recognizing them protects you from most bad deals. This guide gathers the most common red flags when hiring your website in Latin America, what to do about each one, and two new 2026 signs almost nobody mentions yet.

We lay it out honestly on both sides, because there are also clients who set their own trap —chasing the cheapest, not reading what they sign, not asking what they should. The idea is not to distrust everyone, but to give you a handful of simple checks that separate a serious provider from one who will cost you money and headaches. If you are already clear on who to hire, this guide is the natural complement to our piece on how to choose a web design agency: that one tells you who to look for; this one, who to run from.

In one sentence: the most common red flags are a budget with no written scope, 100% upfront, the domain or code in the provider\'s name, a template sold as custom work, and a portfolio with no metrics; the golden rule that protects you from almost all of them is to demand in writing the scope, ownership of your code and credentials, and verifiable proof —not screenshots— that they build sites that work.

Money and contract flags

The first group of signs appears before a single line of code is written, in how the money and the agreement are discussed. The most basic is a budget with no clear scope: if it is not in writing what the work includes exactly —how many pages, what features, what deliverables, what is left out—, you lose any later argument. Tied to this is the verbal-only agreement: without a document detailing what was agreed, you have nothing to hold on to if something changes. And the most dangerous of all is being asked for 100% upfront, because it leaves you with no leverage; the healthy thing is a 30% to 40% deposit with the rest tied to milestones.

Two more join these, subtle but revealing. A deadline with no penalty for missing it is an empty promise: if falling behind has no consequence, the deadline does not really exist. And choosing on price alone, taking the cheapest offer without looking at the scope, usually ends in the double spend we will see below. None of these flags, on its own, proves bad faith; but several together sketch a provider who does not want to commit to anything concrete, and that is already enough information.

How payment should be structured: red flag vs healthy practice

A reasonable deposit covers the start of the work; milestone payments keep the incentive to progress and deliver. Whoever insists on charging it all upfront is asking you to carry all the project\'s risk alone.

Ownership flags: don't let them lock you in

The second group is the one most people discover late, when they already want to change provider and cannot. The central sign is your domain or hosting registered in the provider\'s name instead of yours. It may sound like a detail, but it turns you into a hostage: for any change, move or disagreement you depend on someone you no longer want on board, and getting back what is yours becomes a fight. The same applies to the code and credentials: if when the work ends they do not hand you the access and the ownership of what was built, you do not have your site, you have it on loan.

The third flag in this group is disappearance: the provider who delivers and vanishes, with no maintenance plan and nobody to turn to when something breaks. A website is not a painting you hang and forget; it needs updates, monitoring and fixes, and it is worth knowing from the start who takes care of that and under what terms. Ask from the beginning who will own the domain, the hosting, the code and the credentials, and what happens after delivery. A serious professional answers without dodging; whoever evades these questions is warning you.

Technical flags: architecture, AI and the test almost nobody asks for

The third group is the most technical, and it is where we add the signs almost no list includes. The first is the overloaded template sold as "custom" or "professional" work: there is nothing wrong with starting from a base if it is stated clearly, but charging you for your own development and handing you a heavy template full of features you do not use is both a price abuse and the seed of a slow, hard-to-maintain site. Tied to this is technical vagueness: a provider who does not explain why they chose their technology, or who justifies everything with "we use this because it is what we know," is probably not choosing what is best for you, but what is most comfortable for them.

The second technical sign is new in 2026 and almost nobody lists it yet: the provider not knowing whether your site will be readable and citable by artificial intelligence. More and more customers find businesses through AI answers, and a site heavy with JavaScript, where the content and structured data are assembled in the browser, can be invisible to the crawlers that feed those answers. If you ask about this and get hot air, it is a sign they are not up to date on how a business is found today. The third sign is verifiability, and it is the simplest, most powerful test: ask for the real metrics of their own site. A provider who builds fast sites has their own site fast and shows it gladly; if their own site loads slowly or they only show you pretty screenshots instead of a real PageSpeed, you already know what they will deliver. We develop these last two in our guides on WordPress slowness and AI-mediated commerce.

Choosing on price: what you end up paying when it has to be redone

Illustrative, not an exact figure. The idea is the double spend: when the cheap option does not perform or locks you in, you pay a second time to redo it right, and the initial "savings" ends up being the most expensive stretch of the project.

The green flags: what a good provider looks like

As useful as knowing who to run from is recognizing who is worth hiring, and the good signs are the exact reverse of the bad ones. A serious provider hands you a budget with detailed scope in writing, where it is clear what is included, what is not, and what happens if you ask for something extra midway. They propose a milestone payment structure without you having to ask, because they understand it is fair to both sides. And they talk about ownership naturally: they take for granted that the domain, the code and the credentials are yours, and put it in writing without you reminding them. When someone gets ahead of these things instead of dodging them, it is because they have nothing to hide.

There are also finer signs that mark a good professional. They explain why they chose their technology in terms you can understand, connect those decisions to your business —not to their convenience— and show you measurable results instead of just pretty screens: the speed of the sites they built, the effect on ranking or on leads. They ask questions about your business before talking about design, because they know a site serves a goal and not the other way around. And they tell you no when something does not suit you, even if that means selling you less: whoever is willing to lose a sale to keep you out of a project you do not need is, almost always, who you want to work with. A good provider does not ask you to trust their word; they give you the proof so you do not have to.

How to protect yourself, concretely

With all the above in mind, protecting yourself comes down to a few demands a good provider accepts without trouble. Ask for a contract with detailed scope, delivery milestones and some penalty for missing deadlines; structure the payment as deposit plus milestones, never the total upfront; and put in writing that the domain, the hosting, the code and the credentials are yours and are handed to you when the work ends. Those three things, alone, shield you against most bad deals, because no provider planning to take advantage of you readily commits to them.

To that, add verification, which costs you nothing: ask for the real PageSpeed of their site and their portfolio, open them on your phone and measure them yourself, and ask the 2026 question about AI readability. Ten minutes of checks tell you more than any promise. And if you want a reference for what a green flag looks like, look at our own site: it is built to pass these same tests, with its speed and its markup on display, because we believe the best way to sell a craft is to demonstrate it, not describe it. If you want to place all this in real price ranges, we cover it in our piece on how to choose a web design agency.

If you want to put it into practice right away, turn it into a short message you can send any candidate before deciding. Ask them, in a few lines, how they structure payments, who will own the domain and the code when the work ends, what their budget includes and what it does not, what happens with maintenance after delivery, and whether they can show you the PageSpeed of their own site and of a couple of their projects. It is not a hostile interrogation; it is the normal conversation any serious professional is glad to have. What is revealing will be twofold: the content of the answers and the way they are given. Whoever responds with clarity, speed and in writing is showing you, live, what working with them will be like. Whoever gets uncomfortable, stalls or answers with vagueness to such reasonable questions has already given you the most important answer, even if it is not the one you asked for.

Want to work with someone who puts the scope, the ownership and the metrics in writing from day one? That is how we work, and you can verify each of those green flags before hiring us.

See how we work

Frequently asked questions about hiring your website without getting it wrong

How do I know if I am going to get scammed on my website?
It is rarely an outright scam; the more common thing is something subtler: paying more for less, getting locked in unable to move your site, or receiving a generic template sold as custom work. The warning signs are fairly consistent: a budget with no written scope, being asked for 100% upfront, the domain and hosting registered in the provider's name, not explaining why they choose their technology, and a portfolio of pretty screenshots without a single metric. The golden rule that protects you from almost everything is to demand three things in writing before paying: the detailed scope of what is included, ownership of your code and credentials, and some verifiable proof that they build sites that actually work.
Should I pay everything upfront?
No, and being asked to is one of the clearest red flags. The healthy structure is a reasonable deposit —on the order of 30% to 40%— with the rest split into payments tied to concrete milestones: delivery of the design, of the working site, the launch. That structure protects you because it keeps an incentive for the work to progress and finish, and leaves you room to react if something goes wrong. Paying 100% upfront leaves you with no leverage: if the provider falls behind, disappears or delivers something different from what was agreed, they have already been paid and you have nothing left to negotiate with. A serious professional understands this logic and proposes milestones without being asked; whoever insists on charging it all upfront is asking you to carry all the risk alone.
Who owns my website, my domain and my code?
They should be yours, and it is worth putting in writing from the start, because one of the most frequent traps hides here. Your domain has to be registered in your name, in an account you control, not the provider's. The hosting, ideally, also in your name or at least with full access for you. And the site's code and credentials —the access to the dashboard, to the database if there is one, to the tools— must end up in your hands when the work is done. When all of this is in the provider's name, you become a hostage: for any change, move or disagreement you depend on them, and moving your site elsewhere becomes costly or impossible. Ask before signing; the answer tells you a lot about who you are dealing with.
Is a template sold as "custom" a red flag?
It is when they present it as something it is not. There is nothing wrong with using a base or a theme as a starting point if it is stated clearly and the price reflects it; the problem is charging you for custom work and handing you a template loaded with features you do not use, slow and hard to maintain. That difference matters because an overloaded template drags along the weight and complexity that later translate into a slow site and maintenance bills. The sign to watch is vagueness: if they do not explain which part is a base and which is their own work, nor why they chose that technology, the answer is probably that most of it is template. A provider who knows their craft explains their technical decisions without you having to pull them out with a corkscrew.
What do I ask a provider about artificial intelligence?
This is the question almost nobody asks yet and that in 2026 is worth including: "will my site be readable and citable by AI?" More and more customers find businesses through answers from ChatGPT, Perplexity or Google summaries, and to appear there your site has to deliver its content in a way machines can read. A provider who builds sites heavy with JavaScript, where the content and structured data are assembled in the browser, may be making you invisible to those systems without knowing it. If you ask about this and they look at you blankly, or answer with hot air, it is a sign they are not up to date. We develop it in our guides on <a href="/en/blog/aeo-geo-latam-cite-ai-2026/">AEO and GEO</a> and on <a href="/en/blog/ai-commerce-shopping-agents-2026/">AI-mediated commerce</a>.
What do I do if the designer disappears without delivering?
The first thing is to prevent it, which is why we insist so much on the milestone contract and on not paying everything upfront: if you paid in stages, your loss is limited to what was done, not everything. If it already happened, gather everything you have in writing —the agreement, the messages, the payment receipts— because it defines what you can claim. Regain control of whatever is yours: if the domain is in your name, secure it; if you have access, change it. From there, a serious new provider can assess what can be salvaged from what was delivered and what is better redone, and sometimes starting clean is cheaper than fighting with a half-finished, poorly documented job. The best defense, anyway, is still to choose well from the start and put everything in writing.
Does cheap always end up expensive?
Not always, but a suspiciously low price is a flag to take seriously. Building a website well takes work, and that work costs; when an offer is far below the rest, something is being cut, and it is almost always exactly what you cannot see: the performance, the ownership, the redirect map if there is a migration, the later maintenance. The typical result is the double spend: you pay cheap, the site does not perform or locks you in, and you end up paying again to redo it right. That does not mean the most expensive is the best; it means the price should correspond to a clear, verifiable scope. An honest quote explains what it includes and what it does not; a suspicious one just gives you an attractive number and silence about the rest.
How do I verify that an agency builds sites well?
With proof, not promises, and luckily today it is easy. Ask them to show you the real metrics of their own site and of the ones they have built: the mobile PageSpeed Insights score, not a pretty screenshot. A provider who builds fast sites will have their own site fast and will show it gladly; one whose own site loads slowly will hardly build you a fast one. Also check whether their portfolio talks about results —speed, ranking, conversion— or only aesthetics. And verify it yourself: open their portfolio sites on your phone and measure how long they take. This check takes ten minutes and filters out most of those who promise more than they deliver. Our own site is built to pass that test, and you can check it whenever you like.