A corporate website is often the first point of contact anyone has with a company. Prospective customers, business partners and job candidates look at your website before they ever speak to you. That is why it is not enough for a site simply to look good: it has to load quickly, make the information people are looking for easy to find, meet its legal obligations and run reliably for years.
Because website projects look simple from the outside, important topics are frequently overlooked at the proposal stage. In this article we have pulled together, as a checklist, the points you should clarify before commissioning a corporate website and the questions you should ask the agency.
Define goals and scope from the outset
The first question should be: "What is this website for?" Generating enquiries, showcasing products, supporting a dealer network, recruiting or informing investors all call for different page structures and different priorities. Design work that starts before the goal is clear usually ends up wasting time on later revisions.
- The primary purpose of the site and the conversion you will track (a contact form, a quote request or a job application, for example)
- Target audience: customers, business partners, job candidates, public-sector bodies
- A page list and a draft sitemap
- Language options: Turkish only, or English and other languages as well?
- Integrations: CRM, email marketing tool, ERP, booking or dealer systems
Putting this list in writing also makes it easier to compare proposals from different agencies against the same scope.
Content ownership and account access
Content is one of the most common causes of delay in website projects. Who will prepare the copy, images and project examples should be decided at the start. If content production is the agency's responsibility, that scope should be stated clearly in the proposal.
Ownership is not limited to the copy. Rights over the domain name, the hosting account, analytics tools and the source code should also be made explicit in the contract.
- The domain name should be registered in your company's name, in an account you can access.
- Your company should have administrator rights in Google Search Console and in the analytics accounts.
- Whether the source code and design files will be handed over at the end of the project should be set out in writing.
- The licensing status of the images, fonts and plugins used should be clear.
Performance and technical SEO
Speed and Core Web Vitals
A slow-loading site tests visitors' patience, and this is especially noticeable on mobile connections. Google uses a set of metrics it calls Core Web Vitals to assess page experience. These metrics measure how real users experience a page from three angles:
- LCP (Largest Contentful Paint): how long it takes for the largest main content element on the page to appear.
- INP (Interaction to Next Paint): how quickly the page responds to a click or tap.
- CLS (Cumulative Layout Shift): whether content shifts unexpectedly while the page is loading.
Ask the agency how it measures these metrics and what targets it sets. Techniques such as image optimisation, removing unnecessary scripts, caching and using a content delivery network (CDN) show that speed needs to be planned just as carefully as design.
Technical SEO fundamentals
Search engine optimisation (SEO) is not just something you do after launch; its foundations are laid in the site's architecture. Technical decisions that are hard to fix later need to be made correctly from the start.
- A meaningful, stable URL structure and, if there is an existing site, permanent (301) redirects from the old addresses to the new ones
- A unique title and meta description for every page
- A correct heading hierarchy (H1, H2, H3) and descriptive alternative text for images
- An automatically updated XML sitemap and a correctly configured robots.txt file
- Canonical tags to prevent duplicate content
- Structured data (schema) markup for organisation and contact details
- A mobile-friendly, accessible page structure whose content search engines can read
When redesigning an existing site, the redirect plan is particularly important. Without one, search visibility built up over the years can be lost the moment the new site goes live.
Data protection (KVKK) and cookie compliance
Türkiye's Personal Data Protection Law No. 6698 (KVKK), the country's counterpart to the EU's GDPR, applies to every company that processes personal data through its website. Contact forms, newsletter sign-ups, job applications and analytics cookies all fall within its scope.
- Every point where data is collected should offer an easily accessible privacy notice.
- Where processing requires explicit consent, that consent should be obtained separately from the privacy notice and in a way that lets users give it freely.
- In line with the Turkish Personal Data Protection Authority's guidance on cookies, non-essential cookies (such as analytics and marketing cookies) should not run until the user has given consent.
- It should be decided where data submitted through forms will be stored, for how long, and who will have access to it.
The content of legal texts should be prepared together with your company's legal adviser. The agency's job is to make sure those texts and the consent mechanisms work correctly from a technical point of view; for example, analytics scripts must not load before the user has given consent.
Security, hosting and maintenance
A corporate website carries the company's reputation; if it is hijacked or goes offline, the result is a direct loss of trust. When choosing hosting, the following points deserve as much attention as price:
- HTTPS on every page and a valid SSL/TLS certificate
- Security headers, bot and spam protection on forms, and restricted access to the admin panel
- Regular backups kept in an environment separate from the site, and tested restores
- Clarity on who is responsible for updating the software, plugins and server components
- Server location and KVKK compliance with regard to the processing of personal data
Statically generated or cache-served sites usually have a smaller attack surface. Whatever architecture you choose, however, security is not a one-off set-up but an ongoing responsibility.
That is why post-launch maintenance should also be part of the proposal. If updates, backup checks, minor content changes and response times for incidents are not defined in a maintenance agreement, the site will gradually become both outdated and insecure.
Off-the-shelf content management system or custom software?
A content management system (CMS) is an admin panel that lets you add pages, news or announcements without technical knowledge. Popular systems such as WordPress offer a quick start and a wide choice of plugins; on the other hand, they require regular updates and close attention to plugin security.
A custom-built solution gives you more control over performance, security and integrations. In that case, an admin interface that the content team can use comfortably has to be planned separately. The right choice depends on how often the content will be updated, who will update it and which systems the site will exchange data with. There is no single solution that is best for every company.
Questions to ask agencies when comparing proposals
Looking only at the total price when comparing proposals from different agencies can be misleading. A proposal that seems cheaper may leave items such as content entry, multilingual support, a redirect plan or maintenance out of scope. The soundest approach is to compare proposals against the same scope list. We recommend asking the following questions in your meetings:
- Which pages, features and how many rounds of revisions does the proposal cover, and what is out of scope?
- What stages does the project consist of, and what will you need from us at each stage?
- What are your performance targets, and how do you measure Core Web Vitals before launch?
- How do you prepare the SEO and redirect plan when moving from our current site to the new one?
- How will the KVKK privacy notices and the cookie consent infrastructure be implemented technically?
- Who will own the domain name, hosting, source code and design files?
- How do post-launch maintenance and support work, and what are your response times?
- Can we review work you have previously delivered at a similar scale?
How clearly these questions are answered is a decision criterion at least as important as price.
Conclusion
A good corporate website is the product of a clear purpose, content with defined ownership, a fast and secure infrastructure, legal compliance and regular maintenance. Putting these topics on the table at the proposal stage prevents most of the surprises that could otherwise arise later.
If you would like to work through this checklist together while planning your corporate website, the Linu Technology team can help from the scoping stage onwards.