Two quotes for “a business website on WordPress” can describe very different projects. One includes discovery, accessibility work, analytics, redirects and a proper handover. The other ends when the homepage loads. It shows months later, when you need the hosting login or notice the contact form stopped sending. Here is an itemised list to hold any quote against.
We build WordPress sites through our WordPress development service, so weigh that. Every fact below about WordPress, accessibility standards and Google Search was checked against WordPress.org, the W3C, Google’s own documentation and web.dev in October 2026.
Short answer: A professional WordPress build covers discovery and scope, design, development, SEO setup, content, security and handover. The items most often missing are the invisible ones: accessibility work, analytics with key events, redirects from the old site, agreed update and backup settings, and a handover that leaves you owning every account. Ask for each item by name in the written scope. If it isn’t written down, assume it isn’t included.
What WordPress, the W3C and Google Document
As of October 2026, from WordPress.org, the W3C, Google Search Central, web.dev and Google Analytics Help:
| Topic | What the documentation says |
|---|---|
| Hosting | PHP 8.3+, MySQL 8.0+ or MariaDB 10.11+, and HTTPS support |
| Core updates | New installs since WordPress 5.6 auto-update minor and major releases by default |
| Plugin and theme updates | Opt-in, one by one, since WordPress 5.5 |
| Backups | Two parts, database and files; you need both to restore |
| User roles | Six pre-defined roles, from Super Admin to Subscriber |
| Accessibility | WordPress core code is expected to meet WCAG 2.2 level AA |
| Text contrast | At least 4.5:1, or 3:1 for large text |
| Core Web Vitals | LCP 2.5 s or less, INP 200 ms or less, CLS 0.1 or less, at the 75th percentile |
| XML sitemaps | Up to 50MB or 50,000 URLs per file; submitting is a hint |
| robots.txt | Not a way to keep a page out of Google; use noindex |
| Rich results | Not guaranteed, even with valid structured data |
| GA4 key events | Up to 30 per standard property |
Sources: WordPress requirements, automatic background updates, plugin and theme auto-updates, WordPress backups, roles and capabilities, WordPress accessibility standards, WCAG 2.2, Core Web Vitals, build and submit a sitemap, robots.txt introduction, structured data policies, GA4 key events.
Discovery and Strategy Deliverables
Discovery defines what the site has to do before design starts. Skip it and you get a site that looks right in a mockup and misses at launch.
Project Brief and Scope Document
A written document that defines the pages, the functionality, who writes the content and sources the images, the schedule, the revision rounds and what success looks like. A quote without a written scope isn’t a project yet. It’s a handshake. The scope heads off the most common dispute: disagreement about what was included.
Sitemap: Page Architecture
This is the planning sitemap, not the XML file search engines read. It maps every page the site will have, the navigation and how pages relate: which pages, what they’re called and how they link. It comes before design, because design decisions depend on it.
Wireframes or Low-Fidelity Layout Plan
Wireframes are layouts without styling: boxes and placeholders showing where content, images, navigation and calls to action go. They settle layout before anyone spends time on colour and type, and they’re cheaper to change than finished designs. Agree the structure in wireframes, then move to visual design.
Keyword and Intent Mapping for Each Page
Each page should have a main topic and a clear idea of what the searcher wants from it: an answer, a specific page or a purchase. The mapping makes the structure follow how people search, not only how the business describes itself. Without it, pages often get merged or restructured later, which means more redirects.
Design Deliverables
Design is what you see first and remember longest.
Visual Design Mockups: Desktop and Mobile
High-fidelity mockups show how each distinct layout will look: typography, colour, imagery, spacing and components. You should see desktop and mobile versions of each. A distinct layout is a different page structure, such as the homepage, an inner page or a blog post, not every page. Desktop-only mockups mean mobile decisions get made during coding, with less room to iterate.
Brand Integration: Typography, Color, and Iconography
The design should apply your brand consistently: exact fonts, colour values, logo usage and icon style. If you don’t have a style guide, the designer should set one up now: heading and body sizes, button styles and spacing.
On a block theme, many of these choices live in theme.json, which WordPress calls a foundational piece of block theming (source). Users can adjust those global styles through the Styles interface (source). Ask which ones you’ll be able to change yourself.
Revision Rounds: Defined Scope
Know how many revision rounds are included and what counts as a revision. There’s no industry rule for the number. What matters is that it’s written down. “Unlimited revisions” usually means the scope is vague.
Style Guide or Component Library
At the end, the design system should be documented: type sizes, colour values, button states, form styles, cards and spacing. Then any designer or developer can add matching pages without reverse-engineering the code.
Development Deliverables
Development turns the design into a working site. Decisions here shape speed, maintainability and SEO for as long as the site runs.
Custom WordPress Theme: No Third-Party Page Builder
WordPress supports two main kinds of theme. Block themes are built entirely from blocks and edited in the Site Editor; WordPress calls them the modern method. Classic themes use PHP templates and are still supported (source).
Our view: a professional build uses a theme written for your site, block or classic, and edits content with the editor that ships with WordPress, not a page builder added on top. That means fewer plugins to update, fewer licences to renew and markup we control when tuning performance and accessibility. If your quote doesn’t say, ask: “Will this site use a page builder? If so, which one, and who maintains its licence?”
Mobile-Responsive Code Across All Breakpoints
Responsive means the site works at every width, not just one desktop and one phone size. Test across the range, on real devices as well as browser tools. Two WCAG 2.2 criteria make good test cases: content reflows at a width of 320 CSS pixels without scrolling in two directions, and tap targets are at least 24 by 24 CSS pixels, with some exceptions (source).
Contact Forms With Spam Protection
Every form needs spam protection, such as a honeypot field or a CAPTCHA. If you use a CAPTCHA, WCAG 2.2 expects alternative forms for people who can’t complete one type, and every field needs a label or instructions (source). Test each form end to end on the live site, from submission to inbox, before the project closes.
Performance Optimization: Caching, Images, CDN
The site should meet its performance targets at handover. Use Core Web Vitals: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of page loads on mobile and desktop (source).
In practice: page caching configured, images sized for where they’re shown and served in a modern format, lazy loading below the fold and a CDN where your audience is spread out. Record the measurements at handover as a baseline.
SSL Certificate Configuration
The site should serve over HTTPS everywhere. WordPress lists HTTPS support among its hosting requirements (source), and its Site Health screen shows whether the site uses it (source). Google’s page experience guidance also asks whether pages are served securely (source). Redirect all HTTP URLs to HTTPS, with no mixed content.
Accessibility Compliance: WCAG 2.2 AA Basics
The current version is WCAG 2.2, a W3C Recommendation since 5 October 2023 (updated 12 December 2024). Content that conforms to 2.2 also conforms to 2.1, and the W3C advises using 2.2 (source). WordPress expects code in its ecosystem, including core, to meet WCAG 2.2 level AA (source). Your theme should aim for the same. The basics to check, from WCAG 2.2:
- Text alternatives for meaningful images (1.1.1).
- Text contrast of at least 4.5:1, or 3:1 for large text (1.4.3).
- Everything works with a keyboard (2.1.1).
- Focused elements aren’t fully hidden by sticky headers or banners (2.4.11).
- Pointer targets of at least 24 by 24 CSS pixels (2.5.8).
- Labels or instructions on form fields (3.3.2).
Legal requirements depend on where you operate, so get advice for your own case.
SEO Setup Deliverables
SEO setup is the category most often left out. It’s invisible at launch and few clients know to ask. Ask for each item by name.
On-Page SEO: Meta Titles, Descriptions, Heading Hierarchy
Every page needs a written title, a meta description and a logical heading structure. Google says there’s no limit on title length, but title links are truncated as needed to fit the device (source). Meta descriptions have no limit either; Google mostly builds snippets from page content and may use the description when it describes the page better (source). Write them specific, with the important words early.
XML Sitemap: Generated and Submitted to Google Search Console
The XML sitemap lists the URLs you want crawled. Google allows 50MB uncompressed or 50,000 URLs per file. You can submit it in Search Console, through the API or in robots.txt, and submitting is a hint, not a guarantee (source).
Search Console needs a verified property. Google suggests adding more than one verification method, in case a template change drops a tag (source). Make sure you, not only your developer, are a verified owner, and submit the sitemap on launch day.
Schema Markup: Organization, LocalBusiness, or Appropriate Type
Structured data tells Google what a page describes: LocalBusiness for a local business, Organization for a firm, Article for blog posts. Google recommends JSON-LD in most cases, and a page needs the required properties to be eligible for rich results (source). Eligible isn’t guaranteed, and the markup must describe content visible on the page (source). Test it with the Rich Results Test before launch.
robots.txt Configuration
robots.txt tells crawlers which URLs they may access. Google says it’s mainly for avoiding overloading your site, not for keeping pages out of Google; use noindex or password protection for that (source). A noindexed page must not be blocked by robots.txt, or Google never sees the tag (source). A common launch mistake is carrying over staging settings that block the whole site.
301 Redirect Structure (If Replacing an Existing Site)
If any URL changes, the old one needs a permanent redirect to its new home. Google’s site-move guidance starts with a mapping from current to new URLs, then server-side redirects; content you remove on purpose should return a 404 or 410 (source). A 301 is for redirects you won’t revert (source). Build the map during the project, test it on staging and check it again live.
Google Analytics 4 Installation With Key Event Tracking
GA4 setup means creating a property, adding a data stream and adding the code to the site (source). Check it fires on every template, not just the homepage.
GA4 doesn’t use “goals”. Actions you care about, such as a form submission, a phone link click or a purchase, are events you mark as key events, up to 30 on a standard property (source). Without them you see traffic but can’t tell whether the site produces enquiries. If your market requires consent before analytics runs, that setup belongs in scope too.
Content Deliverables
Content scope varies more than anything else. Know what’s included before you sign.
Page Copywriting: If Included, Clarify Scope
Many website quotes don’t include copywriting; you’re expected to provide the text. If copy is included, confirm how many pages, roughly how long, how many rounds of edits and what research informs it. If it isn’t included, plan who will write it and when. Late copy is a common reason launches slip.
Image Sourcing and Optimization
Every image should come from a source you’re licensed to use: your own library, a stock subscription or commissioned work. Size it for where it’s shown, compress it and give meaningful images alt text. Purely decorative images should be marked up so screen readers skip them, as WCAG 2.2 allows under 1.1.1 (source). Optimise before upload, not after.
Content Migration From Existing Site
If pages, posts or products need to move from an existing site, migration should be explicitly in scope. It means copying content, reformatting it for the new structure, fixing internal links and updating references.
Security, Updates and Backups
These rarely appear as line items, but they decide how the site ages.
Hosting That Meets WordPress Requirements
WordPress recommends PHP 8.3 or later, MySQL 8.0 or later or MariaDB 10.11 or later, and HTTPS. It still runs on PHP 7.4, but WordPress notes such older versions have reached end of life and may expose the site to security risks (source). Ask what the site will run on, and whose name the hosting account is in.
Update Settings Agreed in Writing
Since WordPress 5.6, new installations auto-update minor and major core releases by default (source). Plugin and theme auto-updates are opt-in, one by one (source). The scope should say which updates run automatically, who applies the rest and what happens if one breaks something.
Backups You Have Tested
A WordPress backup has two parts, the database and the files, and you need both to restore a typical site. WordPress’s own guidance suggests keeping at least 3–5 recent backups in different locations (source). Ask where backups are stored, how often they run and whether a restore has been tested.
User Accounts and Roles
WordPress has six pre-defined roles. An Administrator can reach every admin feature on a single site; an Editor can publish and manage posts, including other people’s (source). Give each person their own account with the lowest role that fits. Shared logins hide who changed what.
Launch and Handover Deliverables
What happens at launch, and what you receive at the end, matters as much as the build.
Pre-Launch QA Checklist
The exact count matters less than having the checklist written down and shared with you. At a minimum it should cover:
- Every template on iPhone Safari, Android Chrome and desktop browsers.
- Every form submitting to the right inbox.
- No broken internal links.
- No stray noindex tags or staging blocks.
- Core Web Vitals measured against the targets above.
- Every redirect from the old site.
- Analytics and key events on every template.
- The Site Health screen reviewed, with no critical issues open (source).
- Keyboard and contrast checks on key pages.
- A backup taken before go-live.
Ask for the completed checklist at handover.
Staging to Production Migration
The site should be built on a staging server, a private copy that isn’t live, and moved to production at launch. You shouldn’t be asked to review a site being built live on your domain.
WordPress Admin Training
By handover you should be able to edit pages, add blog posts and manage everyday content without calling your developer. Training should cover editing a page, uploading images, publishing a post and finding the settings you’re allowed to change. Ask for a recorded walkthrough, because people forget and staff change.
Complete Documentation and Login Credentials
At handover you should hold your own Administrator account in WordPress, plus access in your own name to hosting, the domain registrar, Search Console and the GA4 property. You should also get a written guide to common tasks and documentation for any custom functionality. Without these, you can’t run the site yourself or move it to another developer without starting over.
For how these deliverables relate to cost, see our custom website cost breakdown. If you’re replacing a site, the website redesign checklist covers which of these matter most during a migration. Want a second opinion on a quote? Get in touch.
Related Posts
- Website launch checklist: what to check before going live
- Technical SEO starts at build: why SEO setup belongs in development
- Website accessibility requirements: accessibility for a business site
- WordPress maintenance for businesses: updates, backups and care after launch
Frequently Asked Questions
What should a professional WordPress website include?
A written scope, a planning sitemap, wireframes, desktop and mobile designs, a theme built for your site, responsive development, protected forms, HTTPS, performance and accessibility work, on-page SEO, an XML sitemap, structured data, redirects, GA4 with key events, agreed updates and backups, QA, training and a handover of every account. Check whether copywriting and images are included.
Does a custom WordPress build include SEO?
It should include technical SEO setup: titles and descriptions, an XML sitemap submitted in Search Console, structured data where it fits, a checked robots.txt and redirects if you’re replacing a site. Ongoing SEO, such as new content and earning links, is separate work that builds on that foundation.
What is the difference between a wireframe and a mockup?
A wireframe is a structural layout: boxes and placeholders with no styling. A mockup is a high-fidelity design with typography, colour and imagery that looks like the finished site. A professional process uses both: wireframes first, mockups once the structure is agreed.
Should a web developer set up Google Analytics for me?
Yes. GA4 and key events belong in a professional build, or you launch with no data. At minimum: the code on every template and at least one key event, such as a form submission. Make sure the property sits in an account you control, with your developer added as a user.
What is schema markup and should my website have it?
It’s structured data in your page code that tells Google what the page describes, such as your business, address or an article. Correct markup can make a page eligible for rich results, but Google doesn’t guarantee them. LocalBusiness or Organization markup fits most small business sites.
What documentation should I receive when my website launches?
A written guide to editing pages, uploading images and adding posts, ideally with a recorded walkthrough. Your own Administrator account and access in your name to hosting, the registrar, Search Console and GA4. Notes on custom functionality, updates and backups, plus the completed pre-launch checklist.