The questions to ask a Magento agency, the red flags to walk away from, and the version, licensing and patching facts you can verify yourself before signing.
On this page
Search for a Magento development agency and you will mostly find articles titled “Top 10 Magento Development Companies”. Open a few and a pattern appears: nearly all of them are published by agencies, and the agency that published the list is somewhere near the top of it. That is not a scandal, it is just how the category markets itself. It does mean the pages ranking for your search are usually sales assets rather than buying advice.
This guide is the other thing. It sets out what actually separates a competent Magento partner from an expensive lesson: the questions to ask, the answers that should worry you, and the technical facts you can check yourself before signing anything. We build and maintain Magento stores for a living, so we have an interest here too. We have tried to write it so it is useful even if you hire someone else.
Executive Summary
What you will learn: how to evaluate a Magento agency on evidence rather than portfolio gloss, covering platform version and lifecycle, licensing, performance, security and patching, front end architecture, code quality, commercials, and ownership of what you pay for.
Who should read it: business owners, eCommerce managers and IT leads about to appoint a Magento or Adobe Commerce partner, or reviewing one they already have.
Why it matters: Magento rewards good engineering and punishes bad engineering harder than most platforms. The wrong partner does not usually produce an obviously broken store. It produces a slow, fragile one that cannot be upgraded, which is a far more expensive problem to discover two years in.
Effort: around two hours of reading, comparing and question-asking across your shortlist. That is a small investment against a build that will run into serious money and years of dependency.
Key Takeaways
- Most “top agency” listicles are published by agencies who rank themselves first, so treat them as advertising rather than research.
- Ask which Magento version they would put you on and why. Support end dates are published facts, and a vague answer here is disqualifying.
- A good partner volunteers the difference between Magento Open Source and Adobe Commerce before you ask, because it changes what your project costs.
- Performance and security are not add-ons on Magento. If they are separate line items at the end of a proposal, that tells you where they sit in the agency’s thinking.
- Ask what happens after launch. Patching cadence and upgrade planning matter more over five years than anything in the build phase.
- Confirm in writing that you own the code, the data and every account before work starts, not at the point the relationship ends.
- The best signal of expertise is an agency willing to tell you that you do not need what you asked for.
Start With Fit, Not With Vendors
The most expensive mistake in this process happens before you speak to anyone: deciding you need Magento because a competitor uses it. Magento is a powerful, self-hosted platform built for genuine complexity, meaning large catalogues, intricate pricing, multi-store setups and B2B mechanics. That power comes with real responsibility for hosting, performance and security.
If your catalogue is modest and your requirements are conventional, a hosted platform such as Shopify will cost less to run and demand less of you. Our complete Magento guide works through where the platform genuinely fits.
Bring that question to your shortlist rather than resolving it alone, and watch what happens. An agency that immediately confirms Magento is perfect for you, before understanding your catalogue or your team, has told you something useful about how it sells.
Ask each agency: “Under what circumstances would you tell us not to use Magento?” A partner who can answer that clearly and specifically understands the platform’s trade-offs. A partner who cannot is selling, not advising.
The Version Question, And Why It Is Urgent Right Now
Adobe publishes release and support dates for every Magento version. These are facts you can verify, which makes them an unusually good test of whether an agency is current.
The dates that matter as things stand: Magento 2.4.6 was released in March 2023 and its regular support ends on 11 August 2026. Version 2.4.7 arrived in April 2024 with support until 31 May 2027. Version 2.4.8 followed in April 2025 with support until 31 May 2028. The current release, 2.4.9, arrived on 12 May 2026 with support into May 2029.
Once a version passes its end of support date, newly discovered vulnerabilities are never patched for it. Your store keeps running and quietly accumulates permanent exposure. If you are on 2.4.6 today, that is a matter of weeks, not a next-year problem, and our Magento upgrade service exists for exactly this situation.
Version 2.4.9 also moved the supported stack substantially: PHP 8.5, MySQL 8.4 or MariaDB 12.3, OpenSearch 3, Valkey 9, RabbitMQ 4.3, Varnish 8 and nginx 1.30. Two changes catch people out. Elasticsearch no longer appears in the supported matrix at all, and Redis has been replaced by Valkey. An agency quoting an upgrade should be talking about server work, not just a Composer command, and our step-by-step upgrade walkthrough covers what that involves.
Open Source Or Adobe Commerce? A Good Partner Raises This First
Magento comes in two editions and the difference has a direct effect on your budget. Magento Open Source is free to download and self-host. Adobe Commerce is licensed, and adds Adobe-hosted capabilities that Open Source does not include: Live Search, Product Recommendations, and B2B features such as company accounts, shared catalogues, requisition lists and negotiated quotes.
Both receive the same core security fixes, so this is a feature and cost decision rather than a safety one. It matters because a proposal that promises B2B account hierarchies or AI-powered search without mentioning a licence is either assuming a cost you have not been told about or planning to build something custom that Adobe already sells. Either way you need to know which, particularly for B2B operations where those features are often the reason Magento was chosen. We cover the distinction further in our guide to Magento for B2B businesses.
If a proposal lists Adobe Commerce features but quotes an Open Source project, ask directly whether a licence is included and who pays for it. This is one of the most common ways a fixed price stops being fixed.
Performance Is Not A Phase Two Item
Magento can be genuinely fast, but only when the caching architecture is used properly: a full page cache such as Varnish in front, a correctly sized cache backend, OPcache tuned for a large codebase, a CDN for static assets, and a theme that does not ship excessive JavaScript. None of this can be bolted on convincingly at the end.
The targets are public. Google’s Core Web Vitals thresholds are a Largest Contentful Paint of 2.5 seconds or less, an Interaction to Next Paint of 200 milliseconds or less, and a Cumulative Layout Shift of 0.1 or less, each measured at the 75th percentile of real visits. Interaction to Next Paint replaced First Input Delay in March 2024 and is considerably harder to pass.
The commercial case is well documented. Google and Deloitte’s Milliseconds Make Millions study found that a 0.1 second improvement in mobile site speed produced an 8.4 percent increase in retail conversions and a 9.2 percent increase in average order value. Portent’s analysis found conversion rates falling around 4.42 percent for each additional second of load time. Those are cross-site averages rather than promises, but they point consistently in one direction, which is why Magento speed optimisation is treated as core work rather than a nice-to-have.
Ask a prospective partner to show you field data, meaning real-user measurements, for stores they have built. A lab score from a testing tool on a homepage is easy to produce and tells you very little about a category page under real traffic.
Security, Patching, And The Question Most Buyers Forget
This is where Magento ownership is genuinely different from a hosted platform, and where agencies vary most. Security patches arrive on a schedule and someone has to assess and apply them.
The industry’s track record is poor. Security firm Sansec found that roughly 75 percent of Magento and Adobe Commerce stores were still unpatched a week after the fix for the vulnerability known as CosmicSting, tracked as CVE-2024-34102, and thousands were subsequently breached. The exploit was not exotic. The gap between a patch being published and being applied is what attackers rely on.
Three questions worth asking: how quickly do you assess a new Adobe security bulletin, who decides whether to apply it, and is that included in our retainer or billed separately? Vague answers here are the most reliable predictor of an unpatched store.
Ask about admin hardening too: a non-default admin URL, two-factor authentication on every account, access restricted by IP or VPN, and a process for removing people who leave. Most compromises that start at the admin panel start with a credential that should not still have existed.
Front End Architecture: Where Outdated Advice Persists
Magento front end advice ages badly, which makes it a good test of whether an agency is current or repeating what it learned in 2021.
Adobe’s PWA Studio is now in maintenance rather than active development, with its last significant release in February 2025, and Adobe’s investment has moved to Edge Delivery Services. Meanwhile Hyvä, a commercial theme that replaces Luma’s heavy JavaScript with a lean Tailwind and Alpine.js front end, became the pragmatic middle path for a large share of merchants. It delivers most of the performance benefit of a headless build without splitting your store into two applications with two deployment pipelines.
So if an agency proposes a full headless rebuild, ask what specifically requires it. Serving several distinct channels from one backend, or a native app sharing the same APIs, are real reasons. Wanting a faster site usually is not, because caching, image work and a lighter theme get you there for a fraction of the cost and ongoing maintenance.
Code Quality And Extension Discipline
You cannot read the code, but you can ask questions whose answers reveal how it will be written.
Ask how they handle customisation. Magento provides supported extension points, and custom work that uses them survives upgrades. Custom work that modifies core files does not, and it is the single most common reason a store becomes stuck on an old version. If you are commissioning significant Magento customisation, this question decides what your upgrades cost for years.
Ask about extensions. Every third-party module is a dependency that can block your next upgrade, and stores carrying forty of them upgrade slowly and expensively. A partner who limits extensions, and who checks a vendor’s release history against recent Magento versions before recommending anything, understands what keeps a store healthy. Our article on Magento features and UI improvements covers what the platform handles natively before you reach for a module.
Finally, ask whether they use version control, a staging environment and a rehearsed deployment process. These are unremarkable in professional software delivery and their absence is a genuine warning sign. Containerised environments make rehearsing a deployment cheap, as our guide to Magento development in Docker sets out.
Reading The Commercials Honestly
Any firm quoting a fixed price before seeing your data and integrations is guessing, and the guess will be corrected later at your expense. A credible proposal breaks out the things that actually drive cost: how much product data cleaning is needed, how many systems must be integrated, how much of the design is bespoke, whether B2B features imply a licence, and what ongoing maintenance covers.
Integration is usually the largest and most underestimated line. Connecting an ERP, accounting system or shipping provider looks small in a proposal and expands on contact with undocumented legacy behaviour. Ask how they scope integrations and what happens when one turns out to be worse than expected.
Be equally careful with the cheapest quote. Magento work that is priced well below the market is usually achieved by skipping the things you cannot see immediately: performance architecture, upgrade-safe code, testing and documentation. Those absences surface eighteen months later as a store nobody can upgrade.
Comparing agencies on hourly rate alone is how buyers end up paying twice. A team that is half the rate and takes three times as long, then leaves you unable to upgrade, was never the cheaper option. Compare on scope, evidence and what happens after launch.
Ownership, Access And Exit
Settle this before work starts, not when the relationship is ending. You should own the code, the data, the domain and every hosting, repository and third-party account. You should have administrative access to all of them throughout, not on request.
It is a fair question to ask directly: if we part ways, what exactly do we walk away with, and how long does handover take? A confident partner has a straightforward answer. Reluctance here is worth taking seriously, because an agency that holds your accounts holds your store.
Red Flags Worth Walking Away From
- Guaranteed rankings or a promised conversion uplift. Nobody can guarantee these, and offering them signals either inexperience or a willingness to say what closes the deal.
- No questions about your data. An agency that quotes without asking about catalogue size, data quality or integrations has not understood the project.
- The same architecture recommended to everyone. If every client gets headless, or every client gets the same theme, you are buying their default rather than your solution.
- Vagueness about versions and patching. These are published facts, and imprecision here is not modesty.
- Portfolio work that will not load. Open their showcased stores on a phone. Slow reference sites are a direct demonstration of priorities.
- No named references. Ask to speak to a client who has been with them more than two years, which tests retention rather than sales ability.
Your Evaluation Checklist
How We Approach This
We would rather lose a project at the fit stage than deliver one that was wrong from the start, so our first conversation is usually about whether Magento is the right platform at all. Where it is, we build with performance and upgrade safety as structural decisions rather than later phases, keep extensions lean, and treat patching and upgrades as part of owning the store rather than an optional retainer.
That work spans Magento development, migration from older versions or other platforms, upgrades, and speed optimisation, across retail, B2B and fashion operations. Where you need capacity inside your own team instead of an agency engagement, you can also hire Magento developers directly.
You are welcome to use this checklist on us. If you would like a straight assessment of your current store, including which version you are on and what it would take to get current, talk to us. You can also read more about how we work or look through our client work.
Related Reading
- Magento: The Complete Guide to Building and Scaling a Store That Performs
- How to Update Magento 2 to the Latest Version
- What the Magento 2.4.9 Release Means for Your Store
- Why Magento 2 Works for B2B Businesses
- Magento for Industrial and Equipment Sellers
- Performance Optimisation for Magento 2
- Magento 2 Development in Docker
- Magento 2 Features Worth Using
Frequently Asked Questions
Answers to the questions we hear most often.
How much does it cost to hire a Magento development agency?
There is no honest single figure, and any agency quoting one before seeing your data and integrations is guessing. Cost is driven by how much product data needs cleaning or migrating, how many systems must be integrated, how much of the design is bespoke, whether you need Adobe Commerce licensed features, and what ongoing maintenance covers. Integration is consistently the most underestimated line, because undocumented legacy behaviour only reveals itself on contact. A credible proposal breaks these out as separate items rather than presenting one number, which also lets you compare shortlisted agencies on something real.
What questions should I ask a Magento agency before hiring?
Six carry most of the weight. Which Magento version would you put us on and when does its support end. Do we need Magento Open Source or Adobe Commerce, and who pays for the licence. How do you architect for performance, and can you show field data from real users. How quickly do you assess and apply Adobe security patches, and is that in the retainer. What front end do you recommend and what specifically requires it. And what exactly do we own if we part ways. Specific answers indicate expertise, vague ones indicate sales.
Are the "top 10 Magento companies" lists trustworthy?
Treat them as advertising. Search that phrase and you will find that most results are published by agencies rather than independent reviewers, and the publishing agency usually appears at or near the top of its own ranking. That is not fraud, it is content marketing, but it means the pages ranking for your search are sales assets. Directories with verified client reviews are more useful, and a reference call with a client who has been with the agency more than two years is more useful still, because it tests retention rather than pitching ability.
Which Magento version should my store be on?
Ideally 2.4.9, released 12 May 2026 with regular support into May 2029. The dates matter because once a version passes end of support, newly discovered vulnerabilities are never patched for it. Magento 2.4.6 reaches end of regular support on 11 August 2026, 2.4.7 runs to 31 May 2027, and 2.4.8 to 31 May 2028. If you are on 2.4.6 today, upgrading is a current priority rather than a future project. Any agency maintaining your store should be able to tell you your version and its expiry date without looking it up. Jumping straight to the newest line is not automatically the right call either, because extension vendors often lag a release behind. Confirm that the extensions your store genuinely depends on already support the target version before you commit to it.
What is the difference between Magento Open Source and Adobe Commerce?
Open Source is free to download and self-host and covers the full core commerce feature set. Adobe Commerce is licensed and adds Adobe-hosted capabilities that Open Source does not include, notably Live Search, Product Recommendations, and B2B features such as company accounts, shared catalogues, requisition lists and negotiated quotes. Both receive the same core security fixes, so it is a features and cost decision rather than a security one. The practical warning is that a proposal promising those features while quoting an Open Source project has either hidden a licence cost or plans to rebuild something Adobe already sells.
How do I know if an agency is actually good at Magento performance?
Ask for field data rather than lab scores. A testing tool run against a homepage is easy to produce and says little about a category page under real traffic, whereas real-user measurements show what customers experience. The targets are public: Largest Contentful Paint of 2.5 seconds or less, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, at the 75th percentile. Then ask where performance sits in their plan. If caching architecture and hosting appear as a later phase rather than a structural decision, that answers the question.
Should I choose an agency that recommends headless Magento?
Only if they can name the specific requirement that justifies it. Legitimate reasons include serving several distinct channels from one commerce backend or a native app sharing the same APIs. Wanting a faster site is usually not sufficient, because caching, image work and a lighter theme achieve that for a fraction of the cost and ongoing maintenance. Note also that Adobe's PWA Studio is now in maintenance rather than active development, with investment moved to Edge Delivery Services, while Hyvä became the pragmatic middle path. An agency still pitching PWA Studio as the future is working from outdated information.
How important is Magento security patching, really?
It is the main ongoing risk of owning a self-hosted store. Security firm Sansec found that roughly 75 percent of Magento and Adobe Commerce stores were still unpatched a week after the fix for CosmicSting, tracked as CVE-2024-34102, and thousands were subsequently breached. The vulnerability is rarely the problem, the delay is. So establish in writing how quickly your agency assesses each Adobe security bulletin, who decides whether to apply it, and whether that work is included in your retainer or billed separately. Vague answers here reliably predict an unpatched store.
Do I own the code and data an agency builds for me?
You should, and you should confirm it in writing before work starts rather than when the relationship is ending. That means the code, the data, the domain, and every hosting, repository and third-party account, with administrative access held by you throughout rather than granted on request. Ask directly what you would walk away with if you parted ways and how long handover takes. A confident partner answers straightforwardly. Reluctance is worth taking seriously, because an agency that controls your accounts effectively controls your store.
What are the biggest red flags when choosing a Magento agency?
Guaranteed rankings or promised conversion uplifts, since nobody can guarantee either. Quoting without asking about catalogue size, data quality or integrations. Recommending the same architecture to every client, which means you are buying their default rather than your solution. Vagueness about versions and patching, which are published facts. Showcased portfolio stores that load slowly on a phone, which is a direct demonstration of priorities. And no named reference you can actually speak to. Any one of these is worth a hard question, and two together usually settle the matter.
Is a cheaper Magento agency ever the right choice?
Sometimes, but rate alone is a poor comparison. Magento work priced well below the market is usually achieved by skipping what you cannot see at handover: performance architecture, upgrade-safe code, testing and documentation. Those absences surface eighteen months later as a store that cannot be upgraded, which costs far more to fix than the original saving. A team at half the rate that takes three times as long was never cheaper. Compare on scope, evidence and what happens after launch, and treat the very lowest quote as a prompt to ask what has been left out.
Should I hire an agency or hire Magento developers directly?
It depends on whether you have the capacity to direct the work. An agency brings its own project management, architecture decisions and continuity, which suits a defined build or a store without in-house technical leadership. Hiring developers into your own team gives you more control and usually better economics over the long run, but only if someone internal can set technical direction, review code and own the upgrade roadmap. A common middle path is an agency for the build and dedicated developers afterwards, so knowledge stays with you once the initial project ends.
