How can you tell whether a WordPress developer is any good?
Look at how they work, not at the portfolio. Two developers can ship sites that look identical on launch day, and only one of them leaves you a site you can update, secure and hand to someone else next year.
- Ask where their changes live: in a child theme or a small custom plugin, never edited into a theme or plugin that updates
- Ask how they test: on a staging copy, with the code in version control, before anything touches the live site
- Ask what you get at the end: admin access, the code, the plugin licences in your name and a note of what was customised
What changed since this was first written
The 2022 version of this article listed six flattering traits, from good communication to time management. Every freelancer and agency claims those, so they cannot help you choose between two of them. This version replaces them with six things you can actually check, most of them in one call or by looking at a site the developer has already built.
If you are hiring a whole company rather than one person, what to settle before hiring a WordPress web design company covers build methods, licences and updates at that level. If the site is not on WordPress, or the hard part is the interface itself, what to check before hiring a front-end developer applies the same idea to that role.
Six things to check before you hire
1. Their changes survive an update
WordPress core, themes and plugins all update, and an update overwrites anything someone edited inside them. The WordPress theme handbook describes child themes for exactly this reason: they let the parent theme be updated without losing your modifications.
Ask where custom code goes. A good answer is a child theme for design changes and a small site-specific plugin for features. The answer to worry about is "I just edit the theme".
If you are still choosing a theme, how to choose a WordPress theme covers the checks to run before you buy, which a good developer will run with you.
2. They test on a copy, not on your live site
Changes should be made on a local or staging copy first, with the code tracked in version control such as Git, so every change can be seen and undone. WordPress's own debugging guide says its debug tools are meant for local and staging installs, not live sites.
Ask what happens when an update breaks something. "We restore the backup and reproduce the problem on staging" is a process. "It never happens" is not.
3. They choose plugins on purpose
A site's plugins decide much of its security and speed. A careful developer reads each plugin's WordPress.org page before installing it: when it was last updated, which WordPress version it has been tested up to, and how many sites run it.
Ask why each plugin on their last site is there. Twelve plugins with a reason each beat five with none, and three plugins from different vendors doing the same job is a warning sign.
4. Their code treats every input as untrusted
Custom code that trusts whatever a visitor typed is behind many WordPress security problems. The WordPress security handbook asks developers to sanitize data on the way in, to escape it as late as possible on the way out, and to use nonces to check that a form submission is genuine.
You do not need to read the code to test this. Ask how they protect a custom form, and listen for sanitizing, escaping and nonces, or the WordPress functions that do them. A vague "WordPress handles that" is the answer to worry about.
5. They write to the WordPress coding standards
WordPress publishes coding standards for PHP, HTML, CSS and JavaScript, so that whoever opens the code later can follow it. The same handbook commits WordPress to the Web Content Accessibility Guidelines at level AA for all new and updated code.
Code written to a shared standard is code the next developer can maintain, which is what protects you if this one moves on. Ask whether they follow it, and whether they test accessibility with a keyboard as well as by eye.
6. You own everything at the end
The project should leave everything in your name: the hosting account, the domain, an administrator login, the code and every paid plugin licence. A developer who keeps any of these is holding your site, whether they mean to or not.
Ask for a short handover note as well, listing what was customised, which plugins carry licences and what renews when. It is a few minutes of work for them and the first thing a new developer will ask for.
| Question | A good answer | An answer to worry about |
|---|---|---|
| Where do your customisations go? | A child theme, or a small site-specific plugin | Edited straight into the theme |
| How do you test an update? | On a staging copy, with the code in version control | On the live site, late at night |
| Why is each plugin on your last site there? | A reason for each one, and when it was last updated | "It is the one I always use" |
| How do you secure a custom form? | Sanitizing, escaping and a nonce check | "WordPress handles that" |
| Who owns the hosting, domain and licences? | You do, from the first day | "We look after all that", with no access for you |
| What do I get at handover? | Admin access, the code and a note of what was customised | A login and nothing else |
The handbook pages linked above were all checked on 18 October 2026.
The part a portfolio never shows: where the enquiry goes
A business website earns its keep when someone fills in the form. That submission has to reach a CRM or an inbox every time, and the costly failure is a form that still says "thank you" while the enquiry goes nowhere.
Ask the developer how they will prove the form works end to end, and who is told if it stops. The WordPress website launch checklist sets out the tests to run before launch, and connecting WordPress to a CRM covers the three ways to wire the form in.
Sites also change underneath you. When the host moves to a newer PHP version, the same tests are worth running again, and what a host PHP upgrade can break on WordPress lists them.
What AI changes about hiring a WordPress developer
Most developers now use AI coding assistants, and that is fine: they write routine code quickly and catch some mistakes. What matters is that a person reviews every line before it ships, because generated code can skip sanitizing and escaping as easily as a rushed human can.
Ask how they review code an assistant wrote, and whether it goes through the same staging and testing as everything else. A developer who answers that clearly is using AI to go faster; one who cannot is using it to skip steps.
AI also changes what a site can do once a visitor arrives, from answering questions to qualifying an enquiry before it reaches you. That is the kind of feature our AI web and app development team builds alongside a site.
Common questions
What should I ask a WordPress developer before hiring?
Ask where their customisations go, how they test updates, why each plugin is there, how they secure custom forms, and who owns the accounts at the end. The answers show how they work far better than a portfolio does.
What is a child theme, and why does it matter?
A child theme holds your design changes separately from the theme it is based on. That lets the parent theme update without wiping out your changes, which is why a good developer uses one instead of editing the theme directly.
Should a WordPress developer work on my live site?
Not for anything beyond small content edits. Changes belong on a local or staging copy first, and WordPress's own guidance says its debugging tools are meant for local and staging installs rather than live sites.
Who should own the plugin licences and hosting?
You should, from the first day. A developer can be given access to your accounts, but if the licences and hosting sit in their name, you cannot easily move the site or change who looks after it.
How much does it cost to hire a WordPress developer?
It depends on what is being built, how much custom code it needs and who looks after it afterwards, so a single figure would mislead. What a WordPress website really costs shows where the money goes. We quote each project once the scope is clear (our answers page explains why), and if the site needs its enquiries wired into a CRM, that is part of our CRM setup and management work, so tell us what you are building.
