Hiring help for website security? Ask these 7 questions

Why compare vendors with questions instead of quotes?

Because every vendor uses different words and bundles the work differently, so quotes are hard to line up. Ask everyone the same questions, and you can compare the shape of their answers.

Economists call this "the market for lemons." When you buy a used car, "the buyer of a car does not know beforehand whether it is a peach or a lemon," while "sellers know whether they hold a peach or a lemon."¹ Website work is the same: what the vendor does, and how, is hard to see from your side. The easiest way to close that gap is to ask questions that demand answers you can check.

1. Before the work: 1 scope · 2 backups
2. During the work: 3 rollback · 4 staging site
3. After the work: 5 checks and report · 6 ongoing care and the next bill
4. Start to finish: 7 ownership, accounts and personal data

Phrase all seven to get "how, where and when" answers, not yes or no.

Same questions, different answers.

Jeensuk's takeAsking isn't distrust; it's how you compare. Send every vendor the same questions, and nobody has reason to be offended.

What should you ask before the work starts? (Scope and backups)

Ask what they will and won't do, and where they'll keep backups before they start, and how many. Get those two answers in writing, and most misunderstandings later go away.

1. Question 1. What will you do, and what won't you do? Is it just the PHP version change, or also plugin updates and fixing errors? Even hosts draw this line: Kinsta's support scope excludes "any code editing," and while it will help find and disable a plugin causing a fatal error, "fixing the code to resolve the error is up to the developer."² The FTC also says that "when hiring a web host, small businesses should pay close attention to the security features" such as SSL/TLS and email authentication,³ so ask whether those are in scope too.
2. Question 2. Where will you keep backups before the work, and how many? Can we get a copy? WordPress.org recommends backing up files and database together, always before an upgrade, and keeping 3–5 recent backups in different places.⁴ A backup that only lives on the vendor's server disappears with them if you ever lose touch.

Jeensuk's take"We'll take care of everything" isn't a scope. A vendor who tells you what they won't do is a vendor who knows the scope.

What should you ask about the work itself? (Rollback and testing)

Ask how, and how quickly, they can roll back if something goes wrong, and whether they test on a staging site before changing your live site.

1. Question 3. If something breaks, how do you roll back, and how long do you have? WordPress.org's own guide ends there too: if something breaks, ask your host to restore the previous PHP version.⁵ And rolling back isn't always open-ended: at WP Engine, you can switch back temporarily only if the previous version is still on the server.⁶
2. Question 4. Do you test on a staging site before changing the live site? DreamHost says "a safe way to test the new PHP version is to create a staging website," and to upgrade the live site only if no errors turn up.⁷

Jeensuk's takeDon't hire anyone for work that has no way back. Everyone makes mistakes, but the way back can be built in advance.

What should you ask about after the work? (Checks and ongoing care)

Ask what they'll check afterward and what report you'll get, then who looks after the site once they're done and what the next version will cost.

1. Question 5. What will you check afterward, and what report will we get? Ask for it in writing: that they checked the home page, key pages, a real contact-form message and admin login, and which PHP version you were on before and after.
2. Question 6. Who looks after the site afterward, and what will the next version cost? Each PHP version gets two years of full support, then two years of security fixes only.⁸ This job isn't the last one. Ask up front what the next upgrade will cost, and whether there's monthly care in between.

Jeensuk's takeDon't just look at this quote; look at five years. Some options are cheap once and expensive every year after.

How should you ask about ownership and personal data?

Ask whether the domain and hosting accounts and an admin login stay in your company's name, and, if your site holds customer information, how they'll handle it.

1. Question 7. Do the accounts stay in our name? How will you handle customer information? Even if you lend access for the work, keep the domain and hosting in your company's name, and keep at least one admin account your own. If ownership moves to the vendor, it's hard to get back if you lose touch.

If your site stores personal information, like form submissions or member details, the FTC's advice is to "make sure your service providers implement reasonable security measures": "insist that appropriate security standards are part of your contracts," and remember that "security can't be a 'take our word for it' thing."⁹ Every state also has a breach notification law,¹⁰ so a vendor's mistake with that data can become your problem. Whether specific rules apply to you is a legal question; check with an attorney.

Insist that appropriate security standards are part of your contracts. — FTC, "Start with Security: A Guide for Business"

Jeensuk's takeYou can lend out the keys, but you never sign over the deed. The accounts stay yours from start to finish.

How do you compare the answers you get?

Put the answers side by side in a table and look for "how, where and when." The vendor with more specific answers is the one that has already pictured the work.

These seven questions are a checklist ATATAKAI Digital built from how the work actually goes. They are not an official standard from any government or industry group, and they're not a scorecard of good and bad vendors. They're a tool for comparing everyone on the same terms.

Jeensuk's takeDon't pick the cheapest; pick the one with the clearest answers. Clear answers lead to clear work.