Web Design Agencies near you

For a private business the obligation is set by the ADA rather than by a named version of a technical standard, and DOJ's guidance says businesses can currently choose how they ensure what they offer online is accessible. In practice teams build to the Web Content Accessibility Guidelines because it is the standard everyone else measures against, and because a documented conformance target is far easier to defend than a claim that the site seems fine.

Two other standards matter depending on who you serve. The Revised Section 508 Standards, which apply to federal agencies developing, procuring, maintaining or using information technology, incorporate WCAG 2.0, and they reach vendors through procurement. DOJ's 2024 rule under Title II of the ADA sets WCAG 2.1 Level AA as the technical standard for state and local government web content and mobile apps, with compliance dates that depend on population size: 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller ones and special district governments. If you sell to government, those dates are your deadlines too.

Register the domain yourself, in the business name, with billing on a company card and the login held by someone who will still be there in three years. A domain held in a contractor's personal registrar account is the most common way a small business loses its website, its email and its search rankings at once.

Hosting, the content management login, the payment gateway, the analytics property and any third-party subscriptions should be listed in the contract with named owners. The code and design should be assigned to you on payment, with any open-source components and commercial plugin licences identified. If the agency uses a proprietary platform of its own, ask exactly what you can export and what stops working when you leave, and get that in writing before signing.

A website is software, and unmaintained software gets compromised. Hacked content is one of the behaviours Google names in its spam policies, and a compromised site can lose its search visibility as well as its visitors. Someone has to apply platform and plugin updates, renew certificates, take backups that are tested by restoring them, and watch for defacement.

Decide at contract stage whether that is the agency on a support plan, an in-house person, or a separate maintenance provider. Whoever it is, agree the response time for an outage, who holds the backups and where, and how a restore is triggered outside business hours. A maintenance plan that only covers updates and not incidents is not the cover most owners think they bought.