What to look for in a web design and development provider: a guide for decision-makers

Design still matters, but it is not enough for a site to look good. It is worth asking for proof that the company can check: that search engines and AI assistants can read the content, that people with disabilities can use the site, that it loads well for real visitors and that the accounts and data are in the company's name. A promise to "optimize for AI" without proof is a warning sign.

This guide is written for the people who decide or approve a budget, not for those who write code. Each criterion explains why it matters to the company, what to ask for, how to check it and which sign should raise doubt. Technical terms are explained in plain words and, when the detail is needed, it appears under the label "For the technical team", which can be passed directly to the IT department or to the provider.

It is worth stating where this is written from. CookingMetrics does not design or develop websites for third parties. It offers consulting and support to development teams, mainly audits for ecommerce and B2B and B2B2C companies that implement standards on websites, stores and web applications, and it also develops its own applications and platforms. This article is written from the position of someone who reviews what a provider delivers, not of someone who sells it.

In summary

• A provider is evaluated by deliverables with evidence and a date, not by promises. This guide proposes ten criteria, each with what to ask for, how to check it and which warning sign to look for.
• Google documents, on a page updated on December 10, 2025, that there are no additional requirements to appear in its AI answers and that no new files or tags are needed. That describes Google; it does not cover other systems.
• This guide presents no evidence that meeting the ten criteria increases rankings, visits, mentions in AI answers or sales. They are justified because they benefit people, search engines and the maintenance of the site.
• The acceptance test is agreed in writing before delivery: a dated initial measurement and the same tools to measure again afterwards.
• In its own measurement of September 4, 2026, CookingMetrics found that its site announced a map that did not exist, had a file that was written but not published, and loaded its main content in 6.15 seconds. What looked solved in the code was not solved on the live site.

What changed: it is not only people with browsers who visit

A site today receives visits from people with browsers, from search engine robots and from artificial intelligence assistants or agents: programs that read pages to answer a question or to perform a task on someone's behalf. That list already existed in part. What changes is how much of what is published depends on a machine being able to read it without help.

Three kinds of statement get mixed up on this subject, and it helps to separate them in order not to pay for promises:

• Documented by whoever operates the system. For example, Google explains how it processes pages and what it recommends. This is the most solid, as long as it is cited with its date.
• Common industry practice. Reviewing the code of a page or going through a purchase with a keyboard are widespread checks, even if the documentation cited in this guide does not present them as a requirement.
• Hypothesis. It is plausible that agents operating a page stumble where people using assistive technologies stumble, such as unlabeled forms or buttons without a name. It is a reasonable hypothesis; this guide does not prove it and does not use it as a sales argument.

Ten criteria, each with its test

The criteria are grouped into three blocks: that the site can be read and used, that it is fast and well communicated to search engines and robots, and that the company keeps control. Each has four parts: why it matters to the company, what to ask the provider for, how to check it without relying on their word and which warning sign should raise doubt.

Block A: the site can be read and used

1. The important content is in the page as the server delivers it

• Why it matters to the company: many modern sites assemble the page in the visitor's browser with a program called JavaScript. A robot or an assistant that does not run that program may receive an almost empty page. Google states that pages go through a queue before their JavaScript is run and recommends that the server deliver the page already assembled (what is called server-side rendering or pre-rendering), among other reasons because not all bots run JavaScript (JavaScript SEO basics, page updated March 4, 2026, consulted October 27, 2026).
• What to ask for: that the important texts, headings, links and prices be in the page as the server delivers it, without depending on a program that runs afterwards.
• How to check it: ask someone on the team to open a key page, right-click and choose "view page source", and search for a paragraph of the main text. If it does not appear there, it depends on a program that runs afterwards.
• For the technical team: the same check with curl on the URL. The browser inspector is not suitable, because it shows the content already processed.
• Warning sign: the demonstration is limited to browser screenshots, or the page source is an empty container.

2. Accessibility is agreed in writing and tested

• Why it matters to the company: accessibility means that people with visual, motor, hearing or cognitive disabilities can use the site. There is a reference standard, the Web Content Accessibility Guidelines 2.2 (WCAG 2.2), a W3C Recommendation published on December 12, 2024 and backwards compatible with version 2.1. It makes it possible to agree on a concrete level of compliance instead of an intention (WCAG 2.2).
• What to ask for: a conformance level written into the contract (for example, level AA) under WCAG 2.2, with the pages that will be evaluated.
• How to check it: ask for the report of tests carried out by people: going through the main flow using only a keyboard, doing it with a screen reader and reviewing color contrast, with the pages tested and the date. The result of an automated tool is a starting point, not the complete evidence.
• For the technical team: version 2.2 adds criteria such as minimum target size (2.5.8, level AA) and accessible authentication (3.3.8, level AA).
• Warning sign: an "overlay", that is, a plug-in installed on top of the site that promises to fix accessibility without modifying it, presented as a guarantee of compliance. On April 22, 2025, the United States Federal Trade Commission approved a final order against accessiBe that bars it from claiming, without evidence, that its automated products make any website WCAG-compliant or keep it compliant, and requires it to pay one million dollars (FTC press release). The order covers that company; it does not settle what applies to other providers or to the technology in general.

3. Forms, cart and payment can be completed

• Why it matters to the company: this is the stretch where the sale or the contact is made. If a person who uses assistive technologies cannot complete it, the company loses that transaction. Agents that operate a page would have to overcome the same obstacles; that is the hypothesis stated above and a separate topic. For this criterion it is enough that the journey works for people.
• What to ask for: that every field have its label, that the whole journey can be completed with the keyboard, that errors are explained in text and that signing in to an account does not depend solely on a cognitive test, in line with criterion 3.3.8 of WCAG 2.2.
• How to check it: make a test purchase using only the keyboard and then with a screen reader.
• Warning sign: elements that look like buttons but are not, pop-up windows that trap the user with no way out and options that only appear when the cursor hovers over them.

Block B: fast and well communicated to search engines and robots

4. Performance is measured with real visitors

• Why it matters to the company: Google publishes three metrics, called Core Web Vitals, to measure the experience: how long the main content takes to appear (LCP), how long the page takes to respond to a click or a tap (INP) and how much the content moves while loading (CLS).
• What to ask for: a written target: LCP of 2.5 seconds or less, INP of 200 milliseconds or less and CLS of 0.1 or less, measured so that at least three out of four visits meet the threshold (the 75th percentile), separately on mobile and on desktop (Web Vitals, page updated October 31, 2024, consulted October 27, 2026).
• How to check it: require field data, that is, measurements from real visitors, and not a single lab test. A one-off test is useful for debugging; it does not say how the site loads for the people who use it.
• Warning sign: a lab score presented as proof of delivery, with no field data and no date.

5. The sitemap, the addresses and the redirects work

• Why it matters to the company: the sitemap is a file that lists the pages that search engines are meant to discover. If it announces addresses that do not exist, it is an error that is simple to detect and that leaves doubts about the rest of the work. In a migration, redirects prevent the old addresses from ceasing to work.
• What to ask for: an existing sitemap declared in the robots rules file (robots.txt), a preferred address for each page (the canonical) and, if there is a migration, a table that indicates which new address each old address goes to.
• How to check it: open each announced address and confirm that it loads with response code 200 ("OK"). What a sitemap should contain is explained in XML sitemaps: best practices for Bing and Google.
• Warning sign: a robots.txt that announces a sitemap that responds 404 ("not found"). It is exactly what we found on our own site, as explained below.

6. Structured data describes what the page shows

• Why it matters to the company: structured data are tags, invisible to the visitor, that describe the content (a product, a price, a rating) in a format that machines read. If they say something different from what is seen, they breach Google's rules.
• What to ask for: tags only for content that a person can see on the page.
• How to check it: compare the tags with the visible text. Google's policies require structured data to describe content that is visible to people and to reflect what the page contains (structured data policies, page updated July 10, 2026, consulted October 27, 2026).
• Warning sign: tags generated by a template with data the page does not show, such as ratings or prices absent from the visible text. None of this guarantees highlighted results in search engines or mentions in AI answers.

7. The access rules for robots are defined with judgment

• Why it matters to the company: the robots.txt file is a public page that tells robots which areas of the site they may visit. Content Signals is an additional declaration that states what may be done with the content once it has been downloaded (search, answer or train models); it does not block access. Deciding how much of your content assistants can use is a business decision, not only a technical one. The topic is explained in Content Signals in robots.txt.
• What to ask for: a documented file, with explicit rules for AI robots and a decision on Content Signals approved by the company.
• How to check it: read the file at the site's public address (your-domain/robots.txt), not the one in the provider's repository, and test what happens with each robot. The method is in the bot accessibility test.
• Warning sign: a file copied from another template, with blocks that contradict each other, or a security filter that blocks robots that the file allows.

8. The distribution network and the cache are configured and documented

• Why it matters to the company: a CDN (content delivery network) keeps copies of the site on servers close to the visitor. With the cache active, the page does not need to be built again on every visit, whether from a person or a robot. Without it, every visit reaches the main server.
• What to ask for: an active cache for public pages and documented security filter (firewall) rules, with exceptions for legitimate robots.
• How to check it: ask the technical team to show the cache status of a key page.
• For the technical team: on Cloudflare, the cf-cache-status header set to DYNAMIC indicates that the response is not being served from the cache. The Cloudflare technical guide for SEO and GEO explains the configuration.
• Warning sign: every visit reaches the main server.

Block C: the company keeps control

9. The accounts stay in the company's name

• Why it matters to the company: the tools where you can see how the site behaves and who visits it (Google Search Console, Bing Webmaster Tools, Microsoft Clarity, analytics, the tag manager) and the services that sustain the site (the domain, the DNS, the CDN) are assets of the company. If an account is in the provider's name and the relationship ends, the data and the configuration stay on the provider's side.
• What to ask for: that all those accounts be in the company's name, with the provider as a user with permissions while they work.
• How to check it: that someone at the company can sign in to each tool, see who the owners are and receive a list of accesses in writing.
• Warning sign: accounts created with the provider's email, or a DNS the company cannot access.

Exclusive content

For signed-in readers

Hand over accounts and continuity

Prepare an ownership, role, and recovery inventory with checks, without sharing secrets.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

10. Measurement is documented and an initial measurement exists

• Why it matters to the company: without a prior measurement, nobody can show whether the delivery improved anything. And if the measurement is not documented, it depends on whoever installed it.
• What to ask for: a measurement plan with the key events (for example, a purchase or a submitted form) and the handling of visitor consent, and a dated initial measurement taken before delivery.
• How to check it: trigger the events in a test environment and compare them with the plan. After delivery, repeat the initial measurements with the same tools.
• Warning sign: "measurement installed" with no document, no list of events and no test.

Exclusive content

For signed-in readers

Compare proposals using the same evidence

Separate must-have requirements, pending answers, and demonstrations in an editable matrix.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

Where to start if time is short

If it is not possible to check all ten criteria, five are cheap to check and do not require knowing how to code: the source code of a key page (criterion 1), the accessibility report with tests by people (criterion 2), the sitemap and the announced addresses (criterion 5), who owns the accounts (criterion 9) and the initial measurement (criterion 10). This is a CookingMetrics criterion based on the cost of checking them; there is no evidence that they are the ones with the greatest impact.

What no provider should promise

• Rankings or mentions in AI answers. Nobody controls what a search engine ranks or what an assistant cites. Google's page on its AI features states that there are no additional requirements to appear in AI Overviews or AI Mode and that there is no need to create machine-readable files, AI text files or new tags (AI features and your website, page updated December 10, 2025, consulted October 27, 2026).
• An effect from llms.txt. It is a file proposed to guide language models. That Google page does not mention it and does not speak for other systems. Publishing it costs little; what the evidence in this guide does not support is promising an effect. In our case, the file was written and had not been published.
• "AI optimization" as a separate package. If a provider sells it, ask which concrete deliverable it includes and how it is verified. If the answer is a list of good intentions, that is a warning sign.

Agent protocols: when they are needed and when they are not

A proposal may include acronyms such as MCP, WebMCP, API catalog, OAuth discovery or commerce protocols. They are new standards so that AI agents do not only read a site but carry out actions on it. Cloudflare's announcement of its agent readiness score states that several of them are under development, that the MCP server card is a draft, that few sites adopt the newest standards and that the commerce checks run but do not count toward the score (Introducing the Agent Readiness score, published April 17, 2026, consulted October 27, 2026).

A reasonable criterion is that there is only a use case if the site offers something an agent can execute, such as an API, an action or a queryable catalog. When a proposal includes these protocols, it is worth asking who is going to use them, how they will be tested and who will maintain them. A list of protocols as a deliverable, with no use case, is a warning sign.

How to turn the list into an agreement

The acceptance test turns the ten criteria into a verifiable agreement. It should be set before delivery and in writing:

• Before: a dated initial measurement that includes the source code of the key pages, the status of the sitemap and of robots.txt, the field performance data, the accessibility report and the list of accounts with their owners.
• After: the same measurements, with the same tools and the same addresses, so that the comparison is meaningful.
• Who verifies: ideally, someone outside the team that built the site.
• What goes in the contract: each criterion with its threshold and verification method, the delivery date and what happens if it is not met.

A tool such as isitagentready.com works as a starting diagnosis, with limits explained in what isitagentready.com measures and what it leaves out.

Exclusive content

For signed-in readers

An operational scope and acceptance brief

Define the deliverable, test conditions, owners, and recovery in a sample form.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

Questions to bring to the meeting with the provider

• Which part of the content is assembled in the visitor's browser and which part does the server deliver already assembled?
• Which WCAG 2.2 level is being committed to, and who will carry out the tests with people?
• With which field data will performance be measured, and what is the written target?
• Who owns each account, the domain and the DNS?
• Which initial measurement is delivered before starting, and how will it be repeated afterwards?
• What exactly does "AI optimization" include, and with what proof is it verified?
• Which agent protocols are proposed, for which use case and who maintains them?
• What happens if an agreed criterion is not met at delivery?

Exclusive content

For signed-in readers

A meeting that ends with evidence

Probe sales answers and record promises, demonstrations, and open items by requirement.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

Our own case: what was not live

On September 4, 2026, we measured cookingmetrics.com against Cloudflare's public Agent Readiness criteria and published the complete result in What we learned from reviewing our site for AI agents. Each point was checked with an HTTP request on that date:

• /sitemap.xml, /sitemap_index.xml and /wp-sitemap.xml returned 404, although robots.txt announced one of them.
• llms.txt returned 404: the file was written and reviewed in the repository and was never published.
• The home page responded with cf-cache-status: DYNAMIC, that is, without cache.
• The field LCP was 6.15 s on desktop and 6.20 s on mobile, against a target of 2.5 s.

The lesson is not about any provider: it is about the distance between what is solved in the code and what is solved on the live site. It is the distance that an independent acceptance test seeks to close, and it is also the reason every criterion in this list is checked on the real site and not on the code.

Limits of this list

• It is not a set of guarantees. There is no evidence, in this guide, that meeting the ten criteria increases rankings, visits, mentions in AI answers or sales. They are justified by their value for people, search engines and maintenance.
• Scope of the sources. What is cited from Google describes Google. What is cited from Cloudflare describes a tool and a set of evolving standards.
• Not every criterion applies equally. A site with little dynamic content needs less of criterion 1; a site with no catalog or forms, less of criterion 3.
• Currency. Official documentation changes. Each item carries the update date of its page and the consultation date, and it is worth checking again before incorporating it into a contract.

What to do next

The next step is to take the initial measurement before accepting delivery: request the addresses, open the source code of the key pages, go through the main flow with a keyboard and review who owns each account. To know whether what was agreed was met, repeat the same measurements afterwards and record the differences with a date.

If you would like us to review what your provider delivered, you can learn about our technical SEO service and our SEO for AI search service. We review and support your development team; we do not develop the site.

Frequently asked questions

Do I need to redesign my site for AI assistants to find it?

This guide offers no evidence that a redesign is necessary for that. Google states that there are no additional requirements for its AI features. What is worth reviewing is the current state: whether the content depends on JavaScript, whether the site responds with the right codes and whether accessibility can be verified. That review may point to targeted adjustments or to a rebuild, depending on the case.

Is an accessibility overlay enough to comply with WCAG?

WCAG conformance is checked on the site, with tests, and is not guaranteed by installing a plug-in. The FTC order mentioned above bars one company from claiming otherwise without evidence; it does not cover other providers. Before relying on an overlay, ask for the test report on the real pages.

Is it necessary to publish llms.txt?

Google does not mention it among the requirements for its AI features, and that page does not cover other systems. Publishing it costs little, and promising an effect has no support in what this guide cites.

Who should own the Google Search Console and analytics accounts?

The company. The provider can hold user permissions while working, but ownership of the accounts, the domain and the DNS should be in the name of whoever owns the site.

Who should carry out these checks?

Ideally, someone outside the team that built the site. It can be an external auditor or a person at the company who follows the steps of each criterion; the simplest ones, such as opening the source code or reviewing who owns the accounts, do not require knowing how to code.