Is Your Web Designer Ripping You Off? 9 Checks Against Real 2026 Numbers

How do you tell if your web designer is ripping you off?

You test the numbers against what things actually cost, and you test whether you can log into your own accounts. Everything else is a feeling.

Most people asking already have the feeling. What they lack is a benchmark, so they either pay quietly for years or fire someone who was doing decent work.

Here are nine checks. Each one has a symptom, a number to test it against, and the exact message to send. Run them in order. The first six take about twenty minutes.

The 9 checks

1. You cannot log in to your own domain registrar today

Do this one first. Go to whatever service the domain is registered with and log in as the owner. Not "my designer handles that". You.

The benchmark: the domain is your property, not a deliverable. Whoever is listed as the registrant controls where your site and your email point. If it is registered in the agency's name, they can switch off your business at any time, and some do exactly that when a relationship ends badly.

Send this: "Can you confirm which registrar my domain is with, and that I am listed as the registrant? I would like the login for my own records."

A straight answer arrives in a day. A vague one is the answer.

2. Your hosting is billed at $100 a month or more

The benchmark: shared hosting for a small-business site is $5 to $15 a month. Good managed WordPress hosting is $20 to $35. A serious VPS is $20 to $80. Static hosting on Netlify, Vercel or Cloudflare Pages is often free at small-business traffic.

So a $100 to $250 monthly "hosting" line on a brochure site is not hosting. It is a retainer with the word hosting on it. Plenty of shops bundle support in there, which is fine, as long as it is labelled honestly and you are actually getting support.

Send this: "What is on the hosting plan besides hosting? Please split the invoice into the server cost and the service cost."

3. You are being billed $150 to $300 a year for an SSL certificate

The benchmark: a standard domain-validated certificate costs nothing. Let's Encrypt issues them free, and every mainstream host installs and renews them automatically with one click. Paid certificates exist for extended-validation and multi-domain cases, and almost no small business needs one.

This line is close to a pure markup test. If it is on your invoice at $200 a year, ask what type it is. If the answer is "the standard one", you have your result.

4. "Monthly maintenance" arrives with no change log

The benchmark: a care plan should produce a dated list. Plugin and core updates applied, backups verified, uptime, forms tested, and any content edits you asked for. One page, once a month.

Can you name a single thing that changed on your site in the last three months? If you cannot, and nobody sent you a list, you are paying a subscription to nothing. Fair care plans for a small site run roughly $50 to $200 a month, and they come with evidence.

Send this: "Please send the change log for the last three months: what was updated, when, and what content edits were made."

5. A five-page brochure site was quoted at $15,000

The benchmark: in 2026 a five-page marketing site is a few hundred to a few thousand dollars, depending on whether you are buying a template fit-out or a designed build with real copy and photography. Our own fixed prices start at $399, which tells you where the floor is.

Five figures is not automatically a ripoff. Custom design, original photography, ecommerce, integrations and large migrations can all justify it. What cannot justify it is a template, five pages of your own text, and a stock photo of a handshake.

Send this: "Can you break the quote into design, build, copy, photography and third-party costs?" A fair shop has that breakdown ready. If the number cannot survive being itemised, it was never built from parts. Our small business website cost guide has the full range.

6. Analytics and Search Console are in their account, not yours

The benchmark: Google Analytics, Google Search Console and your Google Business Profile should be owned by an email address you control, with the agency added as a user. That is how it is designed to work, and it costs nothing to do it that way.

When the agency owns the property, you lose every year of historical data the day you leave. That data is often worth more than the site, which is the quiet reason some set it up that way.

Send this: "Please make [your email] an Owner on the Analytics property, the Search Console property and the Google Business Profile."

7. They will not hand over source files or the repository

The benchmark: if you paid for a custom build, you should be able to get the code. On WordPress that is a full site export plus the custom theme and plugin files. On a coded site it is the Git repository. On Shopify it is the theme export and store admin.

Check your contract before you shout. Some agreements licence the site rather than sell it, and some shops build on a proprietary platform they will never hand over. That is a legitimate model. It is only a ripoff when nobody told you, which is why who owns your website is worth reading.

8. Every change is a new invoice and nobody will state the rate

The benchmark: a text edit is minutes of work. A new page on an existing template is under an hour. If a phone-number change becomes a $250 invoice, you are not paying for the work, you are paying for the fact that only they can do it.

The test is not the price of one change, it is whether anyone will state the hourly rate. A shop with a published rate is doing arithmetic. A shop that prices every small job separately, with no rate, is doing something else.

Send this: "What is your hourly rate for small changes, and how many minutes did this one take?"

9. The price moved after you said yes

The benchmark: scope creep is real and change orders are legitimate. A quote that grows without a written change to the scope is not.

Go back to the original proposal. If the deliverables were never written down, that is on both of you, and the fix is a written scope from here on. If they were written down and the invoice does not match, quote the original line back and ask which item changed.

Send this: "The original scope said X for $Y. This invoice is $Z. Which items changed, and when was that agreed?"

What should these things actually cost in 2026?

Print this and hold your invoice next to it. Ranges are typical list prices for a small business, not the cheapest thing on the internet.

Item	Fair 2026 range	Ripoff signal
.com registration or renewal	$10 to $20 a year	$75 a year, or you cannot see the registrar
Shared or managed hosting	$5 to $35 a month	$100 to $250 a month with no support named
SSL certificate	$0 (Let's Encrypt, included by host)	$150 to $300 a year for a standard certificate
Business email (per mailbox)	$3 to $8 a month	$25 a month, or it is on their account
Care plan, small site	$50 to $200 a month	Any amount with no dated change log
Five-page brochure site	A few hundred to a few thousand	$15,000 for a template and your own text
Shopify store build	From about $1,500	Five figures with no custom app or integration
Small content edit	Minutes, or included	$250 to change a phone number
Copywriting	A real line item, priced	Not mentioned anywhere, then billed later

Two of those rows explain most of the anger in this cluster: hosting and the care plan. They repeat every month, they are invisible, and nobody audits them.

What do I do if my web designer is holding my website hostage?

You ask once, in writing, for seven specific things, with a deadline. Most "hostage" situations are not malice, they are a disorganised freelancer who never set the accounts up in your name and is now embarrassed. A calm dated request resolves most of them inside a week.

Do not threaten first, and do not cancel the hosting payment first. That takes your site down and hands them leverage. Ask, then escalate.

The recovery playbook

1. Write down what you are missing. The seven assets are: domain registrar login, DNS control, hosting account, source files or repository, CMS admin (with an Administrator account in your name), Google Analytics and Search Console ownership, and your email accounts.
2. Send the email below from the address you want everything transferred to. Give a real deadline, seven business days is reasonable and defensible.
3. Keep paying anything you genuinely owe until the handover is done. An unpaid invoice is the one card that gives them a defensible reason to hold on.
4. Screenshot everything you can still reach today: analytics history, the live site, the CMS, any invoices and emails. Do this before you send the request, not after.
5. Escalate if the deadline passes. The steps are below, and they work in a specific order.

The email to send

Subject: Handover of website assets for [yourdomain.com]

Hi [Name],

I am moving the management of our website in-house. This is not a
complaint about the work, it is an ownership and continuity issue,
and I need the accounts in our name.

Please send the following by [date, 7 business days out]:

1. Domain registrar: which registrar, confirmation that [Your
   Company] is the listed registrant, and the account login or an
   authorisation (EPP/AuthInfo) code with the domain unlocked.
2. DNS: where the DNS is managed, and access to that account.
3. Hosting: the hosting provider, the account, and either the login
   or a full backup of the site files and database.
4. Source files: the theme, custom plugins and any design files, or
   the Git repository, transferred to [your GitHub/GitLab account].
5. CMS: an Administrator account for [your email] on the site.
6. Analytics: Owner access for [your email] on the Google Analytics
   property, the Search Console property and the Google Business
   Profile.
7. Email: admin access to the mailboxes on our domain.

If anything is outstanding on our account, send the invoice today
and I will settle it alongside the handover.

If any of these are held on your own accounts rather than ours,
tell me which, and I will set up replacements and take the transfer
from there.

Thanks,
[Your name]
[Your company] | [phone]

Send it as an email, not a WhatsApp message. You want a timestamped record you can point at later.

What if they refuse?

Take the domain back through the registrar. This is the strongest lever you have, because it is governed by rules rather than by goodwill. Under ICANN's Transfer Policy, a registrar that does not give you self-service tools for it must hand the registered name holder the AuthInfo code and remove the "ClientTransferProhibited" lock within five calendar days of the request. If a transfer is already in motion, a losing registrar that does not respond to the registry within five calendar days defaults to approving it. And a transfer may not be denied for nonpayment of a pending or future registration period, because you did not reply, or over a payment default between the registrar and its own partners when you have paid for the registration.

Know the two legitimate holds. A domain cannot be transferred within 60 days of being created, or within 60 days of a previous registrar transfer. If you are inside either window, wait it out, and in the meantime change the nameservers, which is not blocked by the transfer lock.

If your designer resells through a registrar and will not release it, contact the registrar directly as the business named on the domain, with your incorporation documents and invoices. Registrars have a documented process for this. If a transfer was made away from you improperly, ICANN's Transfer Dispute Resolution Policy is the formal route.

Rebuild rather than negotiate, when the maths says so. If the site is five pages and the standoff has run two weeks, a new site on a domain you control is faster and cheaper than the fight. Keep the domain, drop the rest.

The chargeback window is shorter than you think. In the US, the Fair Credit Billing Act gives you 60 days from the date the first bill showing the error was sent to you, and your written dispute has to reach the card issuer inside that window. Charges for something that was not delivered as agreed are a listed billing error. The FTC's guidance on disputing charges spells out the letter and the deadlines. Card networks sometimes allow longer, and your issuer decides. Do not let the negotiation drift past that window while you wait for someone to be reasonable.

When it is not a ripoff

Custom design costs more than a template, and it should. Senior people cost more than juniors. A site with real copywriting, real photography and a booking flow that works on a phone is worth several times a five-page template, and from the outside it still looks like "just a website". Retainers that produce work are not a scam. A shop that will not hand over a proprietary platform it licences to you is not stealing, as long as it said so in writing before you paid.

The line is disclosure. A fair price you understood is fine. A cheap price that quietly turned into a $2,400-a-year hosting bill is not.

What an honest quote looks like

Here is how we do it at DappaSol, with numbers, because a page about pricing honesty that hides its own prices would be funny in the wrong way.

Fixed price up front, not hourly. Overnight Site at $399, live in 24 hours or it is free. Engine from $699 for a multi-page site, live in two to four days. Shopify and D2C from $1,500. Payments split 40/30/30 with a working demo before each one. Every account, the domain, the hosting, the analytics, the repository, opened in your name from day one, plus a 30-day warranty. Full list on the pricing page, and what is included on business websites.

If you are about to hire someone new, what to have ready before you hire a web designer is the other half of this. A clear brief is the cheapest protection there is.