Vetting an ecommerce website development company means going beyond general web agency questions and asking specifically about platform experience, how they handle payment security compliance, and what support looks like during your highest-traffic periods — the moments when an ecommerce site actually can't afford to break. General web design vetting checklists miss these entirely, because they're not relevant to a standard business website the way they are to a store handling live transactions.
Does the Company Need Experience With Your Specific Platform?
Ideally, yes — meaningfully so. Shopify, WooCommerce, and Magento have genuinely different technical foundations, different plugin/app ecosystems, and different common pitfalls. A developer with deep Shopify experience isn't automatically equally skilled at a complex Magento build, and vice versa. Ask directly how many stores they've built on your specific platform, and ask to see at least one live example you can actually browse and test yourself.
How Do They Handle PCI Compliance?
PCI DSS (Payment Card Industry Data Security Standard) compliance governs how payment card data is handled, and it's a real legal and security obligation for any store processing card payments. A competent ecommerce developer should be able to explain, in plain terms, how their build keeps you compliant — typically by using a payment gateway that handles sensitive card data directly (so it never touches your own servers) rather than building custom payment handling that would put full PCI compliance burden on you. If a company can't explain this clearly, that's a legitimate concern, not a minor gap.
What Post-Launch Support Should an Ecommerce Site Have?
This matters more for ecommerce than almost any other type of site, because ecommerce sites face predictable high-stakes traffic events — holiday sales, product launches, promotional campaigns — where downtime or bugs directly cost revenue in real time. Ask specifically: what happens if the site goes down during a major sales event, what's the response time commitment, and is post-launch support included for a defined period or billed separately from day one. A company that hasn't thought through this scenario hasn't built enough ecommerce sites to have learned why it matters.
Questions Worth Asking Directly
- "How many stores have you built specifically on [your chosen platform], and can I see one live?"
- "How does your build keep us PCI compliant, and who's responsible for that ongoing?"
- "What's your response time if something breaks during a high-traffic sales event?"
- "Have you handled a store with a catalog size similar to ours, and what came up?"
- "What's included in post-launch support, and for how long?"
Red Flags Specific to Ecommerce Vendors
Beyond the general red flags that apply to any web project — vague timelines, no defined revision process — ecommerce-specific warning signs include a company that can't clearly explain their PCI compliance approach, no examples of live stores you can actually test the checkout flow on, and no mention of post-launch support specifically around high-traffic periods. Any of these individually is worth a follow-up question; several together are worth taking seriously before signing.
How This Fits Into Broader Vendor Vetting
These ecommerce-specific questions should layer on top of, not replace, the general vetting practices that apply to any website project. For the broader framework — contract clauses, reference-call questions, portfolio evaluation — see our general guide to vetting a website design company, and for the foundational platform and feature decisions that should happen before you're even shortlisting vendors, our complete ecommerce development guide covers that ground.
Frequently Asked Questions
What questions should I ask an ecommerce website development company?
Ask about their specific experience with your chosen platform, how they handle PCI compliance for payments, what post-launch support looks like — particularly during high-traffic sales events — and whether they can show you a live store similar in complexity to yours.
Does the company need experience with my specific ecommerce platform?
Ideally yes. Shopify, WooCommerce, and Magento have meaningfully different technical foundations and common pitfalls, so platform-specific experience genuinely matters more here than it might for a general business website.
How do ecommerce companies handle PCI compliance for payments?
Typically by using a payment gateway that handles sensitive card data directly, so it never touches your own servers — reducing your PCI compliance burden significantly compared to custom-built payment handling. A competent developer should be able to explain this clearly.
What kind of post-launch support should an ecommerce site have?
At minimum, a clear response-time commitment for issues during high-traffic events like holiday sales or product launches, since downtime during those periods directly costs revenue. Confirm whether this support is included for a defined period or billed separately.