A 500 euro website is not a cheap website. It is a deposit on a more expensive one, paid eighteen months later, usually in a hurry, usually after something breaks. That is arithmetic, not a sales line: nobody delivers design, content, build, security, performance, accessibility and handover for a few hundred euro. The question is not whether corners were cut but which ones, and whether you find out before they matter.
To be fair, sometimes a cheap site is the right call. A one-page holding site for an idea being tested is fine. The trap is buying one while believing you bought a real site.
Where 500 euro actually goes
At that price you are buying hours, and there are very few of them. A competent small business site typically takes somewhere between forty and a hundred hours once you count discovery, content, build, testing, security setup and handover. Divide 500 euro across that and the implied rate falls below any European or North African market rate.
So the money buys assembly: a purchased theme, stock images, filler text lightly edited, and a launch. Everything invisible on launch day gets skipped, because invisible work is where a fixed price gets protected. That is not dishonesty, it is how the number works.
- ▸Discovery is skipped. Nobody asks what the site is for or what a conversion looks like.
- ▸Content is templated. Your differentiation is replaced by whatever the theme demo said.
- ▸Testing is one browser on one laptop, usually the builder's.
- ▸Handover is a login emailed to you, if you are lucky, documenting nothing.
What gets cut first: security and the maintenance nobody bought
Security is cut first because it is invisible, ongoing, and outside the fixed price. The typical cheap build lands on a mainstream CMS with a stack of third-party plugins, automatic updates disabled so nothing breaks, no tested backups, no monitoring, and nobody responsible after launch. Then it sits there for years.
The mechanism matters more than any scare statistic. Large plugin ecosystems are a supply chain: you run code from many independent authors, some of whom stop maintaining their work. Vulnerability disclosures are public by design, handing attackers a searchable list of installations to try, and automated scanning does the rest at internet scale. Small sites get hit because nobody is watching.
What we find repeatedly:
- ▸Abandoned plugins. A component last updated years ago stays installed because removing it breaks a page nobody understands.
- ▸Nulled or pirated themes. Cheap builds sometimes use cracked commercial themes, a category specifically known for injected code. Ask directly.
- ▸Shared hosting with no isolation. One compromised neighbour and your site is collateral.
- ▸Backups on the same server, which is the same as no backups when the host account is compromised.
- ▸A contact form with no processor agreement. You are collecting personal data under GDPR with no documented basis and no agreement with your host.
That is the default state of an unmaintained site. The 2026 SME Cybersecurity Checklist for GDPR, NIS2 and DORA covers the baseline any business site should meet.
The performance budget nobody wrote
Cheap sites are slow structurally, not accidentally. Themes are built to demo well for every possible buyer, so they ship every feature, font, slider and script whether your site uses them or not. Add a page builder on top and it grows again. Nobody sets a budget, so nobody notices the page weight climbing.
Speed is not vanity. Google measures page experience through Core Web Vitals: Largest Contentful Paint (how fast main content appears), Interaction to Next Paint (how quickly the page responds), and Cumulative Layout Shift (whether content jumps while loading). A heavy theme fails all three predictably: oversized hero image, render-blocking scripts, images with no dimensions set.
The commercial cost compounds: slow pages lose mobile visitors before they see anything, and those visitors usually arrived from search or an ad you already paid for. Set the limit before you build, using the discipline in Performance Budgets: Treat Speed as a Requirement, Not a Wish.
Accessibility is now a legal surface, not a nice-to-have
Accessibility stopped being optional for many EU businesses. The European Accessibility Act (Directive 2019/882) brought obligations applying from mid-2025 to a defined set of consumer-facing digital products and services, e-commerce among them, with exemptions for some microenterprises. Scope depends on what you sell, where, and your size, so verify against the national transposition rather than a blog post.
The engineering standard is not mysterious. Most conformance work reduces to things a cheap build never does:
- ▸Real text alternatives on images that carry meaning.
- ▸Colour contrast meeting WCAG AA thresholds rather than whatever looked good in the mockup.
- ▸Keyboard operability for menus, modals and forms, tested by unplugging the mouse.
- ▸Labelled form fields and error messages a screen reader can announce.
- ▸Semantic headings in the right order, which also helps search engines.
Retrofitting this into a finished theme costs multiples of doing it during the build, and an overlay widget will not fix it.
SEO fundamentals a template cannot fake
A theme can hand you a site that looks fine and is structurally invisible. Search fundamentals are build-time decisions: a crawlable URL structure, one clear title and meta description per page, correct heading hierarchy, canonical tags, an accurate sitemap, structured data, and pages targeting something a person actually searches for.
What cheap builds ship, over and over:
- ▸Every page titled with the company name, so nothing differentiates in results.
- ▸A staging site left indexable, or a live site still blocked by a launch-day robots directive.
- ▸No canonical tags, so parameter variations create duplicates.
- ▸Images at full camera resolution, filenames like serial numbers, no alt text.
- ▸No analytics or Search Console, so nobody can say whether any of it worked.
That last one is the quiet killer: without measurement you cannot tell a bad site from a bad market, so you keep buying ads to compensate.
Ownership: the code, the domain, the DNS and the accounts
This is the failure that actually strands businesses. Verify in writing that the domain is registered to your company as registrant, that you hold the registrar login, that you control DNS, that hosting is in your name and billed to you, and that you own the code and content outright.
The pattern is predictable. A builder registers the domain under their own account, hosts it in a reseller account, keeps the only administrator credentials, then becomes unreachable or raises the fee. You now hold a business asset you cannot move, and recovering a domain from an uncooperative registrant is slow and sometimes impossible.
Ask for these before final payment:
- ▸Registrar account access with your own email as registrant, plus registrar lock enabled.
- ▸DNS control, ideally at a provider you own.
- ▸A repository or full source export, not just a hosting login.
- ▸Analytics, Search Console and ad accounts created under your organisation, not the agency's.
- ▸A written licence or assignment covering theme, plugins, fonts and stock images. These are a genuine liability when a template gets resold.
The rebuild bill: paying twice for the same website
Rebuilding costs more than building well once, and it is not close. You pay for discovery a second time, migrate content out of a proprietary page builder that stores layout inside the database, untangle URLs so you do not lose whatever search visibility exists, and rebuild forms, tracking and integrations because nothing was documented.
The costs that never appear on a quote:
- ▸Redirect mapping. Change URLs without redirects and you discard your search history.
- ▸Content archaeology. Somebody must extract copy and images that exist only inside a builder's format.
- ▸Downtime and drift. Weeks where marketing pauses because the site is mid-migration.
This is the same shape of problem as The Hidden Costs of Cheap Software Development (and How to Avoid Them). The cheap version is not a discount, it is deferred payment with interest.
How to buy well on a modest budget
A modest budget is not the problem. Modest scope with honest engineering is a perfectly good purchase, and it beats an ambitious site built badly. Buy fewer pages built properly, insist on the invisible work, then grow the site once you know what converts. Trade scope for quality, never quality for scope.
Concretely, at the low end:
- ▸Buy five excellent pages, not twenty templated ones. Pages are cheap to add later; a bad foundation is not.
- ▸Write the content yourself if budget is tight. Your words beat generic copy, and content is the most expensive line to outsource well.
- ▸Insist on maintenance as a separate monthly line, covering updates, backups, monitoring and a restore test. No answer here tells you what you need to know.
- ▸Prefer boring, well-supported technology and the fewest plugins that do the job.
- ▸Make handover a deliverable, a written document rather than an email with a password.
Then ask the questions that expose a bad deal in five minutes. A good supplier answers instantly, a bad one changes the subject:
- ▸Who will be the registered owner of the domain, and can that be my company?
- ▸Do I get the source code, under what licence, including theme and stock assets?
- ▸What happens if I move to another provider next year?
- ▸Which third-party components will this site depend on, and who updates them?
- ▸Where are backups stored, how often, and have you ever restored one?
- ▸What performance and accessibility targets are you committing to before launch?
- ▸What is included after launch, for how long, and what does it cost afterwards?
For larger projects, How to Choose a Software Development Company in 2026: 12 Questions That Reveal Everything is the extended list, and Fixed Price vs Time and Materials: Which Contract Saves You Money? explains why the pricing model itself shapes what you receive.
How TuniCyberLabs helps
We build and rescue business websites from our engineering teams in Tunisia, under EU contracts and EU data handling: honest scoping, security and performance as requirements rather than upsells, full ownership of code and domain transferred to you, and documented handover.
If you have a site you cannot move, cannot update, or cannot trust, get in touch and we will tell you plainly whether it is worth fixing or worth replacing.