Website development contract red flags decide who owns the code, who holds the domain, what happens when the project stalls, and how hard it is to leave. The clauses that cause trouble later rarely look dramatic on the page. They read as ordinary commercial terms until the day you need them.
This guide covers the clauses worth reading closely, what a red-flag version says, and what better wording looks like. It is written for business owners who are not lawyers and is not legal advice; have a qualified lawyer review any contract before you sign it.
The clauses that decide your leverage
Your control over the finished website comes down to four things: owning the code, holding the domain and accounts, having a way out, and knowing what you are paying for. Every clause below connects to one of them.
A proposal describes work; the contract allocates control. The guides to hiring a website development company and how to vet a website development company cover what to ask at that stage and the checks in between. The goal is not to win every point; it is to remove the clauses that would trap you.
Ownership of code, designs and content
This is the clause most often left vague, and it carries the largest consequences.
A red-flag version says the agency owns the code, or that ownership transfers only for “delivered components” while templates, frameworks and custom modules stay with the agency. Another assigns you the final output but keeps a broad licence to reuse your design and layouts for other clients.
Better wording names the artefacts explicitly and puts transfer on a trigger, usually final payment: source code, repository, theme and templates, database schema, design files, custom integrations, content and the media you supplied. It also grants you a perpetual licence for any third-party or open-source components the build depends on, so nothing on the site stops working when the relationship ends.
Payment schedules and milestones
Payment terms decide who carries the risk of a project that runs long.
A red-flag version asks for half or more before anything is built, with the balance due on a delivery date that depends on your content being ready. That means you pay for work that has not happened, then again for delays you did not cause.
Better wording sets a small deposit, then stages payment against named, checkable deliverables: approved design files, a working front end, a working back end, integration testing complete, launch. Each stage should end with something you can review, with a defined approval window and a written process for rejection. Hold back a final portion, commonly ten to fifteen percent, until launch and defect fixes are complete.
Scope definition and change requests
The scope section is where budget control lives.
A red-flag version describes deliverables in general terms, such as “a fully responsive e-commerce website with payment integration and product management”, with no functional detail and no exclusions. When the project lands and you want a specific tax treatment, a subscription flow, a particular shipping rule or a refund path, each one is treated as new work at an hourly rate.
Better wording lists features concretely and, just as importantly, lists what is out of scope. It defines a change request process: written description, an estimate of cost and time, a rate card, and a rule that work starts only once the change is approved in writing by both sides. That last point matters more than the estimate, because it stops informal requests accumulating without a price.
If the scope is large enough to want it written down properly, our website development cost guide explains how scope and pricing tiers relate, and why an under-specified brief produces a padded quote.
Hosting, domains and account ownership
This section is short and should be unambiguous, because agencies usually will not hand over accounts without a clause saying they must.
A red-flag version says the agency will host and manage the site as part of the retainer, with no statement of who owns the domain registration, the hosting account, the analytics property, the ad accounts or the registrar login. If the agency holds all of them, you have no independent way to change provider, publish a notice, or keep the site online if the relationship ends badly.
Better wording states that every account, domain and licence created for the project is registered in your name or in a company name you control, with the agency as a technical contact, and that credentials are provided at launch.
Third-party licences and intellectual property
Every modern build rests on licensed tools, and you need to know which ones.
A red-flag version has no section, so when a plugin subscription lapses and a function stops working, nobody knows who was supposed to pay. Another puts all ongoing licences in the agency’s name and charges you to use them, and the contract must say what happens to your data at the end.
Better wording lists every recurring third-party dependency: the platform the site runs on, the plugins or apps included, who holds each account, who pays the bill, and what happens if a price changes. Check for a portfolio clause too. Many contracts let the vendor show the project in case studies, which is fine. What you want to avoid is a clause where they publish your metrics or your name without review.
Warranty, liability and insurance
Warranty sets the period after launch when defects get fixed free. A red-flag version has no warranty at all, or offers thirty days on everything including parts that are clearly your responsibility, such as your own content edits and third-party platform changes.
Better wording gives a defect-fix window, commonly thirty to ninety days, covering the site not meeting the agreed specification. It separates that from ongoing maintenance, which is a paid subscription rather than a warranty, and it excludes what sits outside the vendor’s control: content you edited, platform changes, and issues caused by your hosting or your own integrations.
Liability clauses decide the financial downside if things go wrong. Watch for a cap so low it is meaningless, such as one limited to the monthly retainer. A reasonable position is a cap at the total contract value, with data loss and confidentiality breaches excluded from that cap. Ask whether the vendor carries professional indemnity and cyber liability cover, and ask for evidence.
Termination, handover and exit
Every contract ends eventually, and some end early. The exit clause decides whether that is manageable.
A red-flag version lets the vendor terminate at any time for any reason, or allows you to terminate but imposes heavy penalties and a long notice period. Another lets you walk away but says nothing about handover, which in practice means no source code, no documentation, no hosting access and no way to continue the site.
Better wording covers four things: termination for material breach with written notice and a cure period; what happens to fees paid and work in progress; a defined handover covering source code, repository access, documentation, credentials and a knowledge-transfer session; and the agency’s duty to keep the site running until handover completes.
Clauses worth asking for
Beyond fixing the red flags, a few clauses are worth requesting outright; they are ordinary in professional services contracts and usually agreed without friction.
- A written change order for anything outside the agreed scope, with cost and timeline stated before work starts.
- A defined review and approval process, including how many revision rounds are included.
- A maintenance and support schedule after launch, with response times and a named monthly retainer. Our web development engagements are usually structured this way, so the ongoing piece gets priced before you sign.
- An intellectual property and confidentiality clause covering your content, brand assets and business data, running in both directions.
- A performance commitment with a remedy, such as a stated Largest Contentful Paint target and Core Web Vitals baseline.
- A dispute-resolution route, specifying a named mediator or a defined jurisdiction and escalation path.
- A right to request proof of backup and recovery testing, which matters if your catalog and customer database live on the vendor’s infrastructure.
- A portfolio clause that requires review before your name or metrics are published, if that matters to you.
None of these are unusual asks; a supplier that resists them is telling you something. We treat that kind of resistance as one of the website development contract red flags to flag before signature, because it usually signals the harder problems on this list.
How to spot website development contract red flags before you sign
Work through this before you sign. If a line cannot be answered in plain English, that is the problem.
- Who owns the code, design files, templates and content, and when does that transfer happen?
- Who owns the domain, hosting, analytics and ad accounts, and have the credentials reached me?
- What is the payment schedule, what triggers each stage, and is a portion held back until launch and defect fixes are done?
- Does the scope describe features concretely, does it list exclusions, and does it have a written change request process?
- Which third-party licences are required, who pays, and what happens to them at the end?
- What is the defect warranty period, what is the liability cap, and do they carry professional indemnity insurance?
- How can either of us terminate, what does handover include, and how long does the agency keep the site running afterwards?
- Which clauses are absent that I wanted to see added?
For the selection side of vendor research, Clutch’s guide to choosing a web development company covers the earlier stage. To go through your own draft with us, get in touch with our team and we will walk the clauses one by one, flagging which website development contract red flags are present and which protective clauses are simply missing.
