Teknologi

How to Verify a Web Agency Portfolio: Five Checks You Can Run Yourself

TAB
Tim Editorial TAB
5 min read
Two desktop monitors on a studio desk showing a grid of finished website page layouts, the kind of portfolio a web agency presents to a prospective client

How to verify a web agency portfolio comes down to one instruction: stop looking at the screenshots and open the addresses. A screenshot can be five years old, it can be a design that never shipped, and it can be somebody else's work. A site that is live on its own domain cannot be invented. The five checks below are free, need no account, and take about twenty minutes for three projects.

Every tool named here was opened and exercised again on 19 October 2026. The point is not to catch an agency out. Most agencies are honest about what they built. The point is to make the story on the portfolio page match the story the internet tells.

Pick three projects, not forty

A portfolio wall of forty client logos looks convincing. Checking forty of them takes two days, and nobody does it.

Take three. The one closest to what you need, the most recent one, and the oldest one. The first tells you whether they have done your kind of work. The second tells you what their current output looks like. The third tells you whether their work survives after they walk away.

Ask for addresses rather than images. An agency that will not name a single live URL has already answered the question for you.

How to verify a web agency portfolio: five checks in order

They run cheapest first. If check one fails on all three samples, you can stop there.

  1. Open the address. Does the site still load, or has it turned into a parking page offering the domain for sale? One dead project means little โ€” clients close, budgets end. Three out of three is a pattern.
  2. Look up the domain age at pandi.id/whois. PANDI is the registry for Indonesian .id names. Type the domain into the search box and press Cari. For a .id or .co.id name the result shows Dibuat (created), Terakhir Diperbarui (last updated), Tanggal Kadaluarsa (expiry) and a Sponsor Registrar block naming the company that registered it. A name that was never registered comes back as Tidak Terdaftar.
  3. Read the site's history on web.archive.org. Paste the address into the Wayback Machine and you get a calendar of the years it was captured. This answers the question people skip: is the design in the portfolio still the one on the live site, or did somebody else replace it two years ago?
  4. View the page source. Right-click the page, choose View Page Source, then search for the word generator. Many sites announce their own platform on that line โ€” when we tested it on 19 October 2026, a reference site returned a meta tag naming WordPress and its version number. This is not a verdict on any platform. It is a check on whether the price story matches the method.
  5. Measure it on a phone at pagespeed.web.dev. Enter the address, choose Mobile, and read the LCP figure: how many seconds until the largest piece of the page appears. Google's own documentation puts a good value at 2.5 seconds or less.

None of those five asks for a paid account or a technical background.

One direction only
Domain age is not site age. The Dibuat line in a WHOIS result is the date the domain name was first registered, not the date the site was built. A domain registered in 2014 may have been given a brand new site this year, and that is ordinary. The check only works in one direction: if the domain was created AFTER the delivery date being claimed, the claim cannot be true. If the domain is older, WHOIS proves nothing and the Wayback Machine has to answer instead. One limit worth knowing before you try: PANDI administers .id names, so its form answers for .id and .co.id domains only. For a client on a .com, use your registrar's own WHOIS lookup and read the same two dates. Tested on 19 October 2026.

Two things no tool can tell you

First, who actually did the work. A polished site can be the output of one designer who resigned six months ago. The question is simple and almost nobody asks it: who was on that project team, and are those people still here?

Second, how the project ran. A finished site keeps no record of revision loops that went nowhere, a deadline that slipped by three months, or two weeks of unanswered messages.

For the second there is exactly one method, and it is not comfortable: ask for one client contact you may phone. Not a written testimonial โ€” testimonials are written by the agency. One phone number and a five-minute conversation.

While you wait for that, compare the scope of the quotes rather than their feature lists. A published breakdown such as our website package page works as a neutral yardstick: it shows what normally sits inside the price and what tends to be billed separately.

A thin portfolio is not the real problem

This is our opinion and not everyone shares it. Three projects is not a reason to walk away. A team two years old has three. If all three are live, load quickly, and are still in use by the client, that is stronger evidence than forty logos with half the domains dead.

The three things genuinely worth avoiding all show up in the five checks above.

  • A portfolio with no addresses. Screenshots only, no clickable links, and no client that may be named.
  • A project nobody can explain. The agency cannot recall which parts they built, or the answer changes when you ask again a week later.
  • Five projects that look identical. Same page structure, same typography, same menu order across every example. That is usually one ready-made theme reinstalled. Fine in itself, as long as the price is not a build-from-scratch price.

And one honest caveat: these checks can be unfair. Good agencies also have dead projects, because clients shut down, move to someone else, or forget to renew a domain. What matters is not the body count. What matters is whether the agency can account for each project without getting defensive.

In our experience the agencies most relaxed about discussing a project that went badly are the safest ones to hire.

What each of the five checks actually answers

CheckWhat it answersWhat it does not
Open the addressWhether the site is still liveWhy it died
pandi.id/whoisWhen a .id domain was registered and when it expiresWhen the site was built
web.archive.orgWhether the design shown is still the one installedWho replaced it
View Page SourceWhich platform runs the site, via the generator lineHow much was built from scratch
pagespeed.web.devToday's mobile LCP in secondsWhether the agency or the client caused it

Every tool in this table was opened and exercised again on 19 October 2026. All are free and none asks you to register. Not one of them can prove who wrote the code โ€” for that you still have to ask.

Questions that usually come next

The agency will not name clients because of an NDA. Is that reasonable?+
For some clients, yes. Listed companies, government bodies and internal projects are often genuinely under a non-disclosure agreement, and an agency that breaks one is telling you something about how it will treat your work. What is not reasonable is using that reason for the entire list. Ask for a sensible compromise: one project whose address you may open, even if it is not their biggest. A real track record always leaves at least one piece that can be shown.
Their portfolio has only three projects. Is that too few to trust?+
Not automatically. Three projects you can open, that are still live and still in use, tell you more than forty logos with no links. What you should adjust is the size of the job you hand them: a team with three projects should not be given something far more complex than those three. Pick work of a similar scale, and tie payment to delivery stages rather than paying up front.
The domain is much older than the delivery date they claim. Does that mean they are lying?+
No. A domain older than the delivery date is normal โ€” a client may have held the name for years before the site was rebuilt. The WHOIS check only disproves one thing: a delivery date that precedes the domain registration. For the opposite direction the Wayback Machine answers. If the archive shows the design on display first appearing last year, the work was done last year, not in 2019.

Once your shortlist is down to two or three names and you want a second opinion before signing, send us the three addresses. Reading them with a prospective client is something we do routinely through jasa pembuatan website Surabaya or konsultan IT Sidoarjo, at no cost and with no obligation to continue.

TAB
Tim Editorial TAB - CV Trengginas Alfath Berkarya

IT consultants helping Indonesian businesses choose and manage cloud infrastructure, develop software, and keep IT operations running smoothly. Based in Sidoarjo, serving clients across East Java and Indonesia.