Hiring a WordPress Developer in Singapore: What to Check

First decide: does your site need WordPress at all?

WordPress is flexible and has a large plugin ecosystem; the plugin directory lists more than 76,000 free plugins. That flexibility comes with upkeep: core, theme and plugin updates, security and hosting. A five-page brochure site or a small shop may be cheaper to run on a hosted platform.

Our WordPress vs Shopify vs Wix comparison covers that decision. If WordPress is the right choice, the checks below separate a developer who builds something you can maintain from one who builds something only they can touch.

Ownership: domain, hosting and admin accounts

The most expensive WordPress problems start with ownership, not code. Agencies close, freelancers move on, and businesses discover the domain, hosting and admin login were all in someone else's name.

If you are already locked out by a previous agency, our guide to getting website and domain access back explains the steps.

Theme and page-builder lock-in

Many developers build on a commercial theme plus a page builder. That is fine, but it affects how easy the site is to change later and who can work on it.

Ask the developer to name the theme and builder in the quote, explain how you would edit a page yourself, and confirm that another developer could take over. A custom theme should come with its source files and a short readme.

Plugins: how many, which licences, who pays

The plugin count is less important than what each plugin does and who maintains it. A site with 30 well-maintained plugins can be safer than one with 10 abandoned ones.

• Ask for the full plugin list in the quote, with which are free and which are paid.
• For each paid plugin or theme, ask the yearly renewal price and whose card pays it.
• Check each free plugin's page on WordPress.org for recent updates and compatibility with your WordPress version.
• Avoid "nulled" or pirated premium plugins; WordPress's hardening guide warns against plugins and themes from untrusted sources.
• Ask what happens if a paid licence lapses: the plugin usually keeps working but stops getting updates.

Hosting, PHP version, staging and security

WordPress's requirements page recommends PHP 8.3 or greater, MariaDB 10.11 or MySQL 8.0, and HTTPS support. It notes that PHP 7.4 and MySQL 5.5.5 still work but have reached end of life and may expose the site to vulnerabilities. Ask which PHP version the hosting runs and whether the theme and plugins support it.

The WordPress hardening guide covers the basics a good developer should already do: keep core, themes and plugins updated, use strong passwords, set tight file permissions, disable the built-in file editor, get plugins only from trusted sources, and keep regular backups.

1. 1

   Ask about staging

   A staging site is a private copy for testing updates and changes before they hit the live site. Ask whether the host provides one and whether the developer uses it.

2. 2

   Ask about backups

   Where are backups stored, how often, and has a restore been tested? Backups on the same server do not help if the server is compromised.

3. 3

   Ask about login security

   Two-factor authentication for administrators, limited login attempts and no shared admin accounts.

4. 4

   Ask about a firewall

   A web application firewall at the host or as a service, plus HTTPS enforced.

5. 5

   Ask who is told when something breaks

   Uptime and SSL monitoring should alert someone, ideally both you and the developer.

Sites without these basics are the ones that end up in our website hacked guide.

Updates and support after launch

WordPress has supported automatic updates since version 3.7, but plugin and theme updates still break sites, as our guide on fixing a WordPress update that broke the site shows. Decide who is responsible before launch.

Questions to ask, and when to get help

Put these questions in writing and compare the answers side by side: Who owns the domain, hosting and admin accounts? Which theme and builder? Which plugins and licences, and who pays renewals? Which PHP version? Is there a staging site? What is the backup and update routine, and what does it cost per month? What do I receive at handover?

Our Business Website (S$1,490) is built with the domain, hosting and admin accounts in your name, and you can edit text and images yourself. For an existing WordPress site, Website Security Hardening (S$290) handles updates, 2FA, firewall and off-site backups, and Care (S$129 a month) keeps it updated and backed up after that.