Pick by how much help you want after launch. Strottner Designs is the plain choice for a school, clinic or small company that wants a published starting price and named support plans; Texas Creative is built for utilities, agencies and nonprofits that need accessible, secure CMS work; Funnel Boost Media suits local businesses that want the site and its SEO and ad spend run together; and Sharkmatic fits companies that buy web design as part of a wider advertising program. Whichever you hire, three running issues deserve a line in the contract, answered below: plugin security updates, the domain’s renewal price and how the contact form sends its email.
How often does a WordPress site need security updates?
More often than most owners expect. Patchstack, a company that tracks WordPress security flaws, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% jump from 2024; 91% were in plugins, 9% in themes and only six in WordPress core, and 46% had no fix from the developer by the time they were made public. A care plan should therefore say who applies plugin updates and how fast, keep the plugin list short, and include a way to switch off or shield a vulnerable plugin when no patch exists yet.
Why does renewing a .com domain cost more each year?
Because the wholesale price keeps climbing. Verisign, which runs the .com registry, held its fee at $7.85 a year until 2021, then raised it to $8.39 in 2021, $8.97 in 2022, $9.59 in 2023 and $10.26 in 2024, skipped 2025 and moved to $10.97 on November 1, 2026, under agreements that allow increases of up to 7% in four of every six years. ICANN adds 20 cents per domain-year, up from 18 cents since July 1, 2025, and each registrar sets its own markup on top, so hold the domain in an account your business owns, at a registrar you control, with auto-renew switched on instead of leaving renewals to the designer.
Could the site’s contact form stop sending email?
It could if the form sends through Microsoft 365 with a plain username and password. Microsoft had planned to start rejecting basic-authentication logins for SMTP AUTH, the method many WordPress mail plugins and form tools use, in March 2026, but in January 2026 it postponed the change: nothing happens through December 2026, at the end of that month basic auth is turned off by default for existing tenants, though administrators can switch it back on, and a final removal date is due in the second half of 2027. Microsoft points customers to OAuth, or to Azure Communication Services Email for mail to outside recipients, and Google Workspace has already ended password-only sign-ins for less secure apps, so ask your developer to move the site’s mail to OAuth or a transactional email service before the default changes.
