Hiring a WordPress Developer in 2026: The Pre-Hire Checklist

Most people looking to hire a WordPress developer start by browsing portfolios, comparing designs and asking about timelines. That is fine, but the problems business owners actually run into tend to show up after launch: you want to switch hosts but have no password, you cannot renew the domain because it is registered to the developer, the theme starts nagging about an expired licence, or the developer simply stops replying.

This article is not about what WordPress is. It is a checklist of things to ask and agree in writing before you hire, grouped by topic. Use it with a freelancer, a small team or any provider. If you get clear answers to everything here, your odds of post-launch headaches drop a lot.

1. Ownership: Domain, Hosting and Admin Accounts

The most important point, and the one most often overlooked, is who actually owns the site’s assets.

Domain

Register the domain in the name of your business or yourself, not the developer.
The domain contact email should be an address your business controls, because transfer confirmations and renewal reminders go there.
Ask for the login to the registrar account, or at least have your own account added as a manager.

Hosting

The hosting account should be opened in your business’s name, or you should have proof that you own it.
If the developer offers “our own hosting”, ask whether you can move out later and whether you get the complete files and database.
Ask about the server specs, PHP version, backups and SSL.

WordPress admin account

You need your own Administrator account, not just an Editor login.
Do not share one account with the developer. Separate accounts let you revoke access later.
The username should not be “admin”, and two-factor authentication should be on.

2. Themes and Plugins: Whose Licence Is It?

WordPress itself is free, but many premium themes and plugins charge an annual licence. Ask:

Which theme is used? Free or premium? If premium, whose name is the licence registered to?
Which premium plugins are installed, when do they expire, and who renews them?
If the developer uses their own multi-site licence, will updates still work after you stop working with them?
Are there any pirated (“nulled”) themes or plugins on the site?

Point 4 matters a lot. Nulled plugins are a common way for malicious code to sneak onto a site. If someone offers you a “free premium theme”, ask exactly where it came from.

3. The Checklist Table to Use Before You Sign

Run through this table while you discuss the project and keep the answers on record.

Area	Question to ask	Answer you want
Domain	Whose name is it registered in?	Your business / you
Hosting	Who owns the account? Can I move out?	You do, with full files and database
Admin	What access level do I get?	Administrator, separate account
Themes/plugins	Whose licences, and when do they expire?	A list with expiry dates
Content/images	Are the images properly licensed?	Your own photos or licensed stock
Backups	Are automatic backups set? Where are they stored?	Yes, stored off the server
Security	What is done before handover?	Everything updated, 2FA, login limits
Basic SEO	What gets configured?	Titles/meta, sitemap, Search Console
Handover	Which documents do I receive?	Credentials list, guide, backup files
After launch	How long is free bug fixing? What about ongoing care?	Stated clearly in writing

4. Scope and Content: Agree Before Work Starts

WordPress projects that drag on usually fail because the scope was vague, not because of skill. Before starting, have a short document that states:

How many pages and which ones (home, about, services, contact, blog, and so on)
Who writes the copy and who sources the images, and your deadlines if you supply them
How many languages are needed
Any special features, such as room booking, quote request forms or an online shop with WooCommerce
How many revision rounds are included at each stage
How out-of-scope requests will be handled

Businesses in Southern Thailand that sell to tourists, such as resorts, tour operators and clinics, often need multiple languages and a booking system from day one. If you do not say so up front, adding them later can mean rebuilding the structure.

5. Minimum Security You Should Get at Handover

A WordPress site that is launched and then left alone is exactly what bots look for. Before you accept the work, check or ask whether these have been done:

WordPress core, theme and plugins are all on the latest versions
Unused themes and plugins are deleted, not just deactivated
HTTPS is used on every page
Failed login attempts are limited and 2FA is on for admin accounts
Automatic backups are scheduled and a restore has actually been tested
File editing from the admin dashboard is disabled (if not needed)

6. Basic SEO You Should Not Have to Pay Extra For Later

A new site does not need a full SEO campaign on day one, but some basics are much harder to fix later if they are skipped during the build.

Clean, readable URLs, not ?p=123
A unique title and meta description for each page
H1 to H3 headings in the right order
Compressed images with alt text
A sitemap.xml connected to Google Search Console
The “discourage search engines from indexing this site” setting is not left on after launch (this is very common)
Acceptable loading speed on mobile

Check point 6 yourself once the site is live: go to Settings > Reading and make sure the search engine visibility box is unticked. For speed, see our WordPress speed optimization guide.

7. Handover Documents: What You Should Hold on Launch Day

Handover should not end with “the site is live”. You should receive a set of documents that lets someone else take over if you ever change who looks after the site.

Accounts and credentials list: domain, hosting, WordPress admin, email, database, FTP/SFTP (sent through a secure channel, and change the passwords once received)
Theme and plugin list, with the reason each is used and licence expiry dates
The latest backup, both files and database
A short user guide on adding posts, editing text and swapping images. A screen recording works fine.
Third-party services, such as Google Analytics, Search Console, email and any connected LINE OA. These accounts should belong to you.

If a developer hesitates to hand any of this over, treat it as a warning sign.

8. After Launch: Who Maintains What

WordPress needs regular updates. If nobody looks after it, one day plugins may conflict and break the site. Agree on this before you hire:

Task	Do it yourself	Hire someone
Plugin/theme updates	Possible, but back up first every time	Tested before updating live
Backups	Set automatic and check periodically	Checked, with test restores
Editing text/images	Fine with a guide	No need to hire
Fixing downtime/hacks	Hard, needs technical skills	Best left to a specialist
Domain/hosting renewal	Should be done by the owner	Can send reminders

Ask exactly how many days of post-launch bug fixing are included, and what counts as a bug versus extra work. Our website maintenance checklist shows what ongoing care usually covers.

9. Red Flags During the Conversation

Will not say which theme or plugins they use
Insists on registering the domain in their own name “for convenience”
No live portfolio sites you can open, only screenshots
Promises “guaranteed first page on Google” (nobody can guarantee rankings)
No written scope at all, only verbal agreements
Cannot answer questions about backups and security

How the Southern Whale Team Works

Southern Whale is a freelance team that builds websites and does SEO for businesses in Southern Thailand. We make sure you own everything from day one, including the domain, hosting and admin accounts, and we hand over a plugin list and user guide. If you would like to talk about our WordPress service, or just want a second opinion on whether a quote you received covers everything, message us on LINE OA.

Frequently Asked Questions

Whose name should the domain be in when I hire a WordPress developer?

Your business or you as the owner, using an email address you control. The developer can register it on your behalf, but the owner details must be yours.

Do premium themes need renewing every year?

Most sites keep working after a licence expires, but you stop receiving updates and security patches. You should know whose name the licence is in and when it expires.

Which logins should I ask for at handover?

At minimum: domain, hosting, WordPress admin, database and connected services such as Analytics and Search Console. Change the passwords as soon as you receive them.

What if I cannot reach my original developer?

If you have hosting and admin access, a new developer can take over immediately. If not, you will need to contact the domain registrar and host with proof of ownership, which takes much longer.

How often does a WordPress site need maintenance?

Check updates and backups regularly. How often depends on the number of plugins and how critical the site is. Sites with bookings or a shop need closer care than a simple business brochure site.

Can a new site start SEO straight away?

Yes, the basics can be done from day one: URLs, titles, a sitemap and Search Console. Content and links are ongoing work after launch.