A portfolio establishes what an agency has built. A proposal should establish what it will build for this firm, how content will be reviewed, and who will control the finished website.
Small World Marketing publishes this guide and sells law-firm website design, hosting and marketing services. That is a commercial interest. The criteria below should be applied to an SWM proposal in the same way they are applied to another provider. This is not a ranking of Canadian agencies, and no provider is named or scored.
The goal is a project-specific decision supported by live evidence, written scope and a usable exit path. A polished screenshot cannot establish who wrote the content, whether forms work, whether old URLs were redirected or whether the firm can move the site later.
For SWM's service scope, see law-firm website design. For a wider acquisition plan, see law-firm marketing and SEO.
Define the project before requesting proposals
Write a one-page project brief before comparing designers. Otherwise, each provider can quote a different project and the prices will look comparable when the work is not.
Identify:
- the services, jurisdictions and genuine locations the site must represent;
- the audiences and main client tasks for priority pages;
- the current website, domain, hosting, forms and connected systems;
- pages and URLs that must be preserved, combined, redirected or retired;
- who supplies source material and who performs legal review;
- approved contact routes and intake owners;
- accessibility, privacy and security requirements that apply to the firm;
- languages, integrations and content migration needs;
- the required launch window and any blackout dates; and
- the accounts, files and documentation the firm must receive.
Separate required outcomes from preferred features. 'Every existing priority URL has an approved destination and tested redirect' is an outcome. 'Use a particular page builder' is a preference unless the firm's operating model requires it.
Do not ask a provider to infer legal accuracy from public pages. Name the lawyer or internal reviewer who can approve practice descriptions, jurisdictions, credentials, disclaimers and intake language. The designer can manage workflow and surface inconsistencies, but the firm remains responsible for its approved legal statements.
Assess relevant portfolio work with live evidence
Choose examples that resemble the project in function, not only appearance. A law-firm website may need long-form service pages, lawyer profiles, location information, intake routing, accessible forms and a controlled migration. A one-page brochure can be attractive without proving those capabilities.
Ask the provider to identify its role on each example. 'Built by us' can mean design, development, copy, SEO, hosting, maintenance or only one part of the work. Record the public URL, provider role, launch period and date checked. If the provider has permission to share a reference, confirm the claim with the client rather than assuming a logo proves an active relationship.
Review the live site on phone and desktop. Check representative service pages, navigation, contact routes and current page behaviour. A current problem does not automatically prove the original work was poor because another party may have changed the site. Record that limitation and ask who has maintained it since launch.
| Portfolio claim | Evidence to request or inspect | Limit to record | Follow-up question |
|---|---|---|---|
| Relevant law-firm work | Live URL, provider role, launch period and approved reference | Public pages may have changed after handover | Which deliverables did your team own? |
| Original design | Project brief, design process and final implemented pages | A screenshot does not establish authorship | Which parts were custom and which used existing components? |
| Content experience | Example pages, source workflow and review record | Public copy does not reveal who approved legal accuracy | Who drafts, edits and routes content for lawyer approval? |
| Intake integration | Visible form or scheduler plus permitted test evidence | A visible form does not prove delivery or routing | How is a submission traced to the firm's intake queue? |
| Search migration | URL map, redirect method and launch report | Current rankings do not prove a particular migration caused them | How were old URLs and internal links reconciled? |
| Accessibility work | Test scope, findings, remediations and limits | An automated score is not comprehensive evaluation | Which manual and assistive-technology checks were performed? |
| Ongoing support | Written care scope, response process and offboarding terms | A support badge does not define included work | What happens when the firm leaves? |
W3C recommends evaluating accessibility early and throughout development. Its accessibility evaluation overview also distinguishes preliminary checks, tools and more complete conformance evaluation. Ask for the actual method and limits instead of treating one automated score as certification.
Compare the written scope line by line
A useful proposal names the deliverable, owner, dependencies, exclusions and acceptance test. 'SEO included' or 'fully optimized' is too broad to price or verify. The scope should say which pages, technical tasks, content tasks, integrations and post-launch checks are included.
Ask for an inventory of page types rather than only a total page count. A practice page, lawyer profile, location page, article template and contact flow have different research, review and testing needs. Confirm whether the provider is writing complete pages, migrating approved copy, creating templates for the firm, or leaving placeholders.
Track revisions by stage. Design revisions, content revisions and post-build corrections are different. A proposal should explain when the firm approves structure, visual direction, copy, staging and launch. It should also identify which late changes affect budget or schedule.
| Work area | Provider should specify | Firm should supply or approve | Acceptance evidence |
|---|---|---|---|
| Information architecture | Page inventory, navigation and URL plan | Services, jurisdictions, locations and priority tasks | Approved sitemap and old-to-new URL map |
| Design system | Templates, responsive states and reusable components | Brand assets, preferences and required disclosures | Signed-off phone, tablet and desktop layouts |
| Content | Research, drafting, migration, editing and upload scope | Source facts, lawyer review and final approval | Approved copy attached to the intended URL |
| Intake | Forms, phone links, routing and confirmation behaviour | Data fields, destinations, owners and privacy review | Labelled synthetic test traced through the approved chain |
| Accessibility | Target, test method, remediation and known limits | Applicable requirements and internal acceptance owner | Recorded keyboard, contrast, label, error and screen-reader checks |
| Analytics | Property, tag and event implementation scope | Measurement definitions and access approval | Events reconciled with real page actions and test receipts |
| Migration | Redirects, DNS plan, content freeze and rollback | Current access, legacy inventory and launch authority | Redirect sample, crawl comparison and rollback record |
| Training and handover | Sessions, documentation, files and credentials | Named administrators and attendance | Firm administrators complete agreed tasks without vendor credentials |
If a proposal includes a platform, plugin, theme, image library or paid service, record the licence holder, renewal cost, renewal date, transfer terms and behaviour after cancellation. Do not accept 'included forever' without a written explanation of who holds the licence and what survives the contract.
Confirm firm control of accounts and assets
The firm does not need to perform every technical task. It does need a documented way to administer, recover and transfer the assets on which the website depends.
For a .ca domain, CIRA's WHOIS service can show registry information such as the registrar and dates, subject to privacy protections. CIRA also explains that an authorization code is used in a registrar transfer. The practical procurement question is who the registrant is, who can access the registrar account and how the firm can recover access. Do not treat a public WHOIS privacy result as proof that the agency owns the domain.
Search Console distinguishes verified owners, delegated owners and users. Google's permissions documentation says owners have full control, including user management. The proposal should specify which firm-controlled account will remain a verified owner and how provider access will be added or removed.
Google Analytics and Tag Manager also have access-management systems. Google documents Analytics user management and Tag Manager permissions. Use named firm accounts and role-based access. Do not rely on a shared password or an agency employee's personal login as the only administrator.
Build an asset register before work begins:
- domain registrar and DNS;
- hosting or deployment account;
- source-code repository and deployment workflow;
- content-management administrator;
- form, email, CRM and scheduler integrations;
- Search Console, Analytics and Tag Manager;
- call tracking and advertising destinations, if used;
- fonts, photos, video and other licensed media;
- design source files and brand assets;
- backups, exports and recovery instructions; and
- vendor support contacts and renewal dates.
The contract should state which account owns each asset, who pays recurring charges and what the provider must deliver at handover. 'You own the website' is not enough if the firm cannot export the content, obtain source files, change DNS or remove vendor access.
Review privacy and third-party processing
Website vendors may handle form submissions, analytics identifiers, support records, backups or other personal information. Ask what information each system collects, where it goes, who can access it, how long it is retained and which subcontractors process it.
The Office of the Privacy Commissioner of Canada's September 2026 guidance on third-party service providers says third-party assessment is a due-diligence measure and explains that organizations subject to PIPEDA remain accountable for personal information transferred to a processor. Applicability and requirements vary. The firm's privacy lead or lawyer should approve the actual providers, terms, notices, safeguards and data flows.
A proposal should not claim that installing a privacy-policy template makes the website compliant. Require a data-flow inventory and clear responsibility for configuration. If the firm changes form fields, analytics, chat, call tracking or intake software after launch, the privacy review may need to change too.
Keep real prospective-client details out of design tickets and shared screenshots. Use labelled synthetic test records for permitted testing, then remove or exclude them according to the firm's approved process.
Require a migration and launch plan
A redesign can preserve the same domain while changing URLs, content, hosting and connected systems. Ask for a migration plan before development is nearly complete.
The plan should include:
- a crawl or inventory of existing public URLs;
- a decision for every material old URL;
- old-to-new redirects for moved or consolidated pages;
- updated navigation, internal links, canonicals and sitemap entries;
- staging controls that prevent accidental indexing;
- a content-freeze or change-reconciliation process;
- DNS, email and third-party dependency checks;
- backups and a documented rollback decision;
- permitted intake tests before and after launch; and
- post-launch checks with owners and timestamps.
Google's site-move guidance recommends mapping old URLs to new destinations and warns against redirecting many unrelated URLs to one irrelevant page. A provider should explain how redirects will be implemented and verified, not simply promise to 'preserve SEO.'
Review redirects as page-level decisions. An old family-law service page may have a direct new equivalent. An expired campaign page may require a different treatment. The firm should approve legal and editorial consolidation before a technical rule sends all traffic somewhere convenient.
The law-firm website migration guide covers URL mapping, DNS, intake and launch acceptance in more detail.
Follow a selection and handover path
The same evidence used to choose a provider should become the project's acceptance record.
- Define outcomes: agree on services, client tasks, page inventory and operating constraints.
- Verify evidence: inspect relevant live work and document the provider's actual role.
- Compare scope: align deliverables, owners, exclusions, dependencies and acceptance tests.
- Confirm control and risk: review accounts, rights, privacy, migration, support and exit terms.
- Accept and hand over: test the live site, reconcile the asset register and complete training.
Do not move to a final selection because one provider has the longest feature list. A shorter proposal with named owners and verifiable acceptance tests can be easier to operate than a larger package of undefined deliverables.
Compare support, maintenance and exit terms
Separate the project from the ongoing care agreement. The provider may build and host the site, build and hand it over, or support a platform controlled by the firm. Each model can work if the responsibilities and exit path are clear.
Ask what maintenance includes: platform updates, dependency review, backups, uptime response, content edits, form testing, accessibility remediation, analytics changes and security incidents are separate tasks. Record included quantities, response process, business hours, emergency contact, exclusions and rates for out-of-scope work.
Request a sample offboarding package before signing. It should identify the export format, source files, database or content export, media library, DNS records, redirect rules, environment settings that can be transferred safely, documentation and credential-transfer process. Secrets should be rotated through the relevant services, not pasted into a handover spreadsheet.
| Contract topic | Evidence before signing | Risk if undefined | Acceptance or exit check |
|---|---|---|---|
| Recurring care | Task list, included quantity, response process and exclusions | Routine work becomes an unexpected project | Submit a sample request and confirm how it is classified |
| Backups and recovery | Frequency, storage separation, retention and restore procedure | A backup exists but cannot be restored | Perform or observe an approved restore test |
| Security response | Reporting route, roles and escalation process | Incidents wait in a general support queue | Named contacts acknowledge a tabletop scenario |
| Content changes | Request channel, approvals and turnaround terms | Unreviewed legal copy reaches production | Trace one test change through approval and publication |
| Hosting departure | Export format, notice, fees and provider obligations | The firm must rebuild to leave | Review a sample handover package |
| Account removal | Access register and removal process | Former vendors keep unnecessary access | Firm administrator confirms remaining users after offboarding |
| Licence continuity | Holder, renewal and cancellation behaviour | Fonts, media or features stop working | Confirm the post-cancellation state in writing |
No generic checklist can decide which response time, backup design or security control is sufficient for a particular firm. Use the firm's requirements, provider documentation and appropriate technical, privacy and legal review.
Score proposals with evidence, not reputation alone
Create one row for each requirement, then ask every shortlisted provider to respond to the same row. Mark whether the item is required or preferred, what evidence was supplied, whether it is included, who owns it and how acceptance will be tested.
Download the blank law-firm web designer comparison worksheet. It contains no providers, rankings, scores, prices or market averages. The firm can add its own requirements and scoring rule before proposals are reviewed.
Keep subjective judgments visible. If visual direction matters, name the reviewers and approval stage. If sector experience matters, define the task that experience should support. Do not turn 'worked with law firms' into an automatic high score without relevant evidence.
A fair shortlist record includes the date checked, sources reviewed, known limitations and any commercial or referral relationship. If SWM is on the shortlist, label it as the publisher and a bidder. If a provider cannot disclose client-confidential material, allow another form of evidence rather than marking the claim as false.
Before signing, resolve these questions:
- Which exact pages, templates and migrations are included?
- Who writes the copy and who approves legal accuracy?
- Which integrations are configured and tested end to end?
- Which accessibility checks are manual, and what is outside scope?
- Who controls the domain, DNS, hosting, repository and data accounts?
- Which vendors and subprocessors handle inquiry information?
- What launches only after firm approval?
- What evidence closes each acceptance test?
- What recurring work and fees begin after launch?
- What can the firm export, and what happens when the relationship ends?
Sources and limits
This selection framework was reviewed on October 26, 2026 against:
- Google Search Central site-move guidance;
- Google Search Console users and permissions;
- Google Analytics access management;
- Google Tag Manager users and permissions;
- W3C's accessibility evaluation overview;
- CIRA's .ca WHOIS and domain-transfer guidance; and
- the Office of the Privacy Commissioner of Canada's guidance on assessing third-party service providers.
Platform interfaces, provider services and applicable professional, accessibility and privacy rules can change. Verify current documents and have the firm's lawyer, privacy lead and technical reviewer approve the requirements that fall within their roles. This guide does not report a completed provider study and does not establish that one Canadian agency is better than another.