1. Who is alerted when the site goes down, and how fast do they respond?
A practice website can be down for hours before anyone on staff notices, often because a patient mentions it. Ask who monitors the site, how they are alerted, and what response time they commit to.
A good answer: continuous uptime monitoring, a named person or team who is alerted automatically, and a stated response target.
A red flag: "just call us if something looks wrong." That means nobody is watching.
2. Are updates tested before they reach the live site?
WordPress core, themes and plugins need regular updates for security. Untested updates are a common cause of broken layouts, scheduling tools and forms.
A good answer: updates are applied to a staging copy first, checked, and only then released, with a way to roll back.
A red flag: updates go straight to the live site, or they are never applied because "it might break something."
3. How do you know our consultation request form still works?
A form can show a success message while the email never arrives, so inquiries disappear without any error. For many practices this is the single most expensive hidden failure. See our guide to forms that submit but send no email.
A good answer: forms are checked after every update, and email delivery is set up through an authenticated service.
A red flag: "the form is fine, we haven't heard otherwise." Silence is exactly how this failure looks.
4. What happens if the site is hacked?
Outdated plugins are a common way in. Ask how the provider detects a problem, who cleans it up, how fast, and who pays. Our guide on what to do when WordPress is hacked covers the steps.
A good answer: security monitoring, current backups, a defined cleanup process, and a clear statement of what is included.
A red flag: no backups, no monitoring, or a cleanup billed as a surprise project.
5. Where is the site hosted, and who maintains the server?
Hosting is part of the risk. A site on cheap shared hosting shares resources with unrelated sites, and no one may be responsible for keeping the server itself patched.
A good answer: a named hosting environment, a team responsible for maintaining it, and protection such as a CDN and a firewall.
A red flag: the provider does not know, or says hosting is "your responsibility."
6. What does it cost each month, and what triggers extra charges?
Hourly billing makes surprise invoices likely, because problems appear when they appear. Ask what is included in the monthly price and what falls outside it.
A good answer: a flat monthly price that includes updates, security, monitoring and support, with clear limits on what counts as extra work.
A red flag: "we bill hourly as needed," with no estimate of a typical month.
7. Can we leave, and do we keep our site?
You should own your domain, your content and your hosting account details. A provider that locks you into a long contract or a proprietary setup is a risk in itself.
A good answer: month-to-month terms, and full ownership and access to your site and domain.
A red flag: long contracts, early-termination fees, or a site that cannot be moved.
A note on HIPAA and patient information
No website provider can make a site HIPAA compliant by hosting alone. Compliance depends on what information your forms and tools collect and how your practice handles it. If your forms go beyond a basic consultation request, ask the provider to review the specific setup before launch. Our WordPress HIPAA checklist for practices explains what to check.
How to use the answers
You do not need to understand WordPress to judge the answers. Clear, specific answers from a named person mean someone owns the site. Vague answers mean you probably have no one accountable. If you would like a second opinion, see how CriticalWP runs WordPress operations for orthodontic practices.
