Checking a web agency's work after launch

Flaws that get past the launch walkthrough

These percentages cover about 20 to 30 websites we audited between August 14, 2026 and September 24, 2026. Each one counts only the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.

None of these flaws stops a page from loading. At launch, people check what they can see: pages open, the form sends, the menu expands on a phone. A site can pass that walkthrough and still have every one of these:

• Trackers that load before the visitor chooses. The cookie banner is in place, the setup behind it is wrong: analytics or the ad pixel fire as soon as the page opens.
• Placeholder text left on the live site: lorem ipsum, a theme message, an "[insert name]" note, often on a secondary page nobody opens again.
• The working copy of the site, left open: a staging site indexed by Google can show up in results next to the real one.
• Stacked redirects. The http address, or the old address of a page, reaches the right page after several hops, and a redirect chain goes unnoticed while you browse.
• A legal notice that is missing, incomplete, or published on a page nothing links to.

A site built by an agency, a freelancer or an AI website builder carries these flaws the same way. The guide to checking an AI-built website covers what those tools miss most often.

Your domain and logins, before the final invoice

The time to get what is yours is while the contract still covers fixes: before you sign off on the project and pay the final invoice. Once the project is closed, every request is up for negotiation.

None of the items below takes technical skill to ask for. Get them in writing before you treat the site as delivered:

• The domain registered to your company, in an account you can log into. Registered to the agency, it stays in the agency's hands if you part ways; the guide to domain expiration covers what stops when a domain isn't renewed.
• Your own logins: the site's admin, the hosting account, analytics and Search Console. The agency is invited into your accounts, not you into theirs.
• A legal notice that names your company as the publisher, names the host and is linked from every page. EU law requires one for a business website, and the guide to what an EU legal notice must include lists the items.
• A cookie banner set up so nothing loads before the visitor chooses, and a cookie policy that describes what the site actually does.
• The working copy closed, or behind a password, as soon as the site goes live.
• If the new site replaces an old one, the list of old URLs with the page each one redirects to, in a single redirect.

If the agency also handles your SEO, keep ownership of Search Console: the guide to telling whether an SEO agency is doing its job explains why.

A second look from someone who built none of it

An agency checking its own work checks it with the same assumptions that produced it. The right reviewer didn't build the site and has nothing to defend in the result. They review the live site, as your visitors receive it, in four steps:

1. At launch, have the published site reviewed.
2. Send the findings to the agency, and agree on what gets fixed, in what order and by when.
3. Once the fixes are in, ask for a second review: it shows what was fixed and what remains.
4. Sign off when that second review is back.

Talk to the agency in findings, not impressions

"The site has a cookie problem" starts a debate. "The ad pixel fires as soon as the home page opens, before the visitor chooses" starts a fix. Describe each flaw by what it does, and on which page.

A precise question gets an answer you can check. These fit in one email sent on launch day:

• Who is the domain registered to, and in which account?
• Which third-party services does the site load, and which ones wait for the visitor's consent?
• Is the staging copy still online, and who can open it?
• Was every page reviewed with its final content, including the error page and the legal pages?
• Who fixes what an outside review finds, and how fast?

As for the order of fixes, start with what falls on the site's publisher: trackers that load without consent, a legal notice that is missing or doesn't name you. Those obligations sit with the publisher, whichever contractor set things up.

Template flaws come next, since one fix covers every page that shares the template, such as a footer link to a missing page. Rank the rest by the pages affected: placeholder text on the home page comes before the same text on a page nobody visits.

A cookie policy the site contradicts five times

In the sample report on a B2B business website we publish, the cookie and privacy policy describes a setup that is not the site's own. The text was read in full, then checked against what the site loads in three separate sessions: with no answer to the banner, after trying to refuse, and after accepting. It found five gaps:

• The policy promises that refusing is as easy as accepting. The first screen of the banner shows only "Customize" and "Allow all"; a "Refuse" button exists, but it is hidden at that level.
• It says advertising cookies activate only with explicit consent. The Meta Pixel, LinkedIn Insight and Google Ads fire on first load.
• It puts persistent cookies at typically up to 13 months. The two analytics cookies last 400 days.
• It states that all personal data stays in the European Union. A few lines above, the same page says the site is hosted on servers in San Francisco, and the site sends visitor IP addresses to Google, Meta and LinkedIn.
• It names three tracking services. Four others, active from the first page load, are missing: Meta, Google Ads, HubSpot and Apollo.io.

The fix is in the consent manager and tag manager settings, followed by a policy rewritten from the site as it actually runs.

The same report records what holds up: only TLS 1.2 and TLS 1.3 are accepted, nothing loads over plain http, and the code served contains no vulnerable library and no secret. An agency that receives it sees what it is asked to fix, page by page, and what it is not.

One report for you and for the agency

The review covers all 9 pillars, with no access to the site's admin, the hosting or the agency. Every page analyzed is opened in a browser without answering the cookie banner, and the trackers that load anyway are recorded. The legal notice is read, along with the pages that link to it. Redirects are followed from the http and https versions of the address. Each piece of placeholder text is reread before it counts, and the most common staging subdomains are checked.

The agency gets the same documents you do: the audit report, to decide what comes first; the detailed page analysis, which becomes its working document; and the methodology note, which explains how each point was checked. The criteria follow a published method your developer can read and discuss with you.

Every limit of the review is stated in the report. A point we could not verify is never presented as compliant. The report doesn't say whether the contract was met: it says what the delivered site does, and anyone can then hold that up against what was agreed. Ordered right after launch, it pins down the state of the site on a given date, and a second audit after the fixes is measured against the same criteria.

Plans start at €200 excl. VAT; only the number of pages analyzed and the price change. They are listed on the pricing page. Delivery takes 5 working days up to 60 pages, and payment is collected on delivery. The samples page also has the report on an online store, if you want to compare with a site that sells.