Is your web designer overcharging you for simple things?
Sometimes, and you can check it line by line. Start with three charges: a yearly SSL certificate fee when the host issues and renews one at no cost, an "advanced analytics" add-on that repackages reports Google Analytics 4 already produces, and a one-line text tweak that's minutes of work but is billed as hours or days and then waits days to go live. Each has a legitimate version. Your browser's certificate details, your host's plan page, GA4's standard reports and your site's revision history show which version you're paying for.
What it usually means
The innocent explanations come first, because they're common and honest when written down. Bundled pricing: a package is priced as a whole and then split into lines, so a line called SSL can be a label for hosting margin rather than a separate purchase. Minimum billing increments: a fifteen-minute or one-hour minimum per request is an ordinary term, and the switching, checking and publishing around a change take real time. A retainer that covers time rather than tasks: you're paying for someone to be available, and the hour logged against a text tweak is a draw-down, not a price for that tweak.
The pattern turns into overcharging when the platform does the work and the invoice bills it as labor. A host that issues and renews certificates automatically, an analytics tool that generates a report by itself, or a CMS that saves a one-sentence edit in a minute leaves the vendor little to do, so a large or recurring charge pays for something you already have. In each, the invoice names an outcome (security, analytics, a content update) rather than a task, and an outcome is hard to check.
A one-line edit is minutes of work, so when it sits for days past the turnaround a vendor reasonably needs, the time went to waiting, not working. The turnaround page diagnoses that delay; the checks below are about the price.
What it costs while it stays this way
A recurring line renews by default: an SSL fee or analytics add-on carries over with the agreement, so a charge for something the platform includes gets paid every year.
The certificate line has a second cost, and it's getting sharper. Certificates issued since March 15, 2026 can be valid for at most 200 days, and the industry's CA/Browser Forum has scheduled that to fall to 100 days in 2027 and 47 days in 2029. If the SSL line pays for a certificate someone installs by hand, that's now roughly a twice-a-year job, and when a renewal is missed, browsers show visitors a full-page security warning instead of your site. A certificate your host renews automatically is cheaper and less fragile.
The analytics add-on can hide a setup gap. GA4 only shows quote requests in the Key events column of its acquisition and landing-page reports if an event fires for them and someone has marked it as a key event, and an advanced analytics line doesn't say whether either was done.
How to confirm it yourself
- Read the certificate's issuer in your browser. In Chrome, click the site information icon to the left of your site's address, then Connection is secure, then Certificate is valid. Under Issued By, note the Organization: Let's Encrypt, Google Trust Services, or SSL Corporation (SSL.com's name in the viewer). Under Issued To, look for an Organization name. A domain-validated certificate carries none, only the domain, and it's the kind hosts issue automatically. Then read the validity dates: 90 days or shorter points to automated issuance. Let's Encrypt's certificates run 90 days by default, and it says anyone with a domain can get one "at zero cost."
- Check your host's plan page for SSL. Find the host's name on an invoice or your agreement, open its plan page and search for SSL. WP Engine lists "Auto-renewing SSL" on its Essential, Core and Enterprise plans. Squarespace says all domains correctly pointing to a Squarespace site are "automatically protected with free SSL certificates." A lookup at lookup.icann.org won't name the host, but nameservers ending in ns.cloudflare.com plus a step 1 issuer of Let's Encrypt, Google Trust Services or SSL Corporation most likely mean Cloudflare is issuing the certificate, which it does on every plan. The nameservers alone aren't proof, since Cloudflare's Universal SSL covers proxied hostnames only. If your vendor is the host, hosting is a line on their invoice with no plan page to read, and step 1's certificate check is your evidence.
- Open GA4's standard reports before paying for advanced ones. Sign in at analytics.google.com and open Reports, then Acquisition, then Traffic acquisition: visits by channel and source. Reports, then Engagement, then Landing page shows which pages people arrive on, with a key events column. Admin, then Data display, then Events shows which events are marked as key events. Explore, then Funnel exploration builds step-by-step drop-off views. Put the add-on's list of reports beside these, and what's left over is what the fee buys. If you can't sign in at all, that's a separate problem worth fixing first.
- Compare a billed edit with the page's revision history. Take the last invoice line for a small text change and open that page in your CMS. In WordPress, open the Settings sidebar, select the Page tab and click the number next to Revisions; the screen shows what changed in each saved version and when. Webflow keeps automatic site backups you can restore, and a custom or headless site's history lives in its code repository's commit log. Work done on staging can go live as one revision, so one revision doesn't prove one minute. If the history shows one short edit and the invoice shows hours or days, ask what the rest covered. Compare the revision's date with your request email's: if the time billed grows with the days the request sat, not with the edit, ask whether waiting was billed as work. If you can't open it because only the vendor has a login, that's a finding too, and it's the setup the turnaround page's self-serve test checks.
- Find the billing unit in the agreement. Search the contract or statement of work for minimum, increment, hours, included and turnaround. A written one-hour minimum explains an hour for a sentence; it doesn't explain hours or days for one. If the agreement sets a completion turnaround for small edits, not just a response time, step 4's dates should meet it. Note, too, whether a retainer's included hours should have covered the edit.
What the vendor's answers actually mean
Each of these replies can be true. Here's what each one commits to.
“The SSL renewal keeps your site secure.”
The security is real; the question is who renews it. If your host's plan page says the certificate renews automatically, it renews whether or not the invoice bills for it. Ask which certificate the fee paid for and compare it with your browser.
“We use a premium certificate with a higher level of trust.”
Paid organization-validated and extended-validation certificates do verify the company behind a domain, and some procurement or security policies ask for one. Chrome moved the EV company name out of the address bar in version 77, so a visitor only sees it if they open Page Info. Ask whether a customer or policy requires it. If not, it's a cost without a reader.
“Advanced analytics includes conversion tracking, traffic sources and custom dashboards.”
GA4 and Google's no-cost Data Studio (formerly Looker Studio) cover all three: key events, which is GA4's current name for conversions, the Traffic acquisition report, and dashboards. Marking key events and checking form tracking is real setup work, done once and re-checked when forms change. A monthly fee for it should buy someone reading the numbers and telling you what to change.
“There's a one-hour minimum on change requests.”
Often written into the agreement, and fair as a price for switching into your site and checking the result. A minimum sets a request's floor, though, not its total.
“It's all part of the package.”
Bundled pricing is legitimate. But when a package can't be itemized, the invoice's line names stop meaning anything.
What actually fixes it
On a healthy invoice, nothing the platform does by itself is billed as labor. Things the host or Google includes are either taken off or folded into a hosting or management fee, called that. Setup work, like marking key events or connecting a dashboard, is billed once, when it's done. A recurring analytics fee pays for someone reading the data and making recommendations, or for a maintained dashboard someone actually uses.
Ask before you assume. Many of these lines started as convenience, and a vendor asked plainly will often remove the line, relabel it, or explain work you didn't know about. A paid certificate you genuinely need, or a management fee for someone who watches the host's alerts and tests updates, is worth paying for under its real name. Call tracking, and connecting a form fill to closed business in your CRM, both take setup beyond GA4's standard reports, and that work can earn a fee, call tracking especially when most inquiries arrive by phone. A heatmap or session recordings are a real difference too, though Microsoft's Clarity offers both and describes itself as a free service.
For text changes, the hours should be explainable from two documents you hold: the revision history and the billing unit. If a one-line change shows up as hours or days and nothing in the agreement accounts for it, ask for the time to be itemized or corrected. The edit takes minutes, so it shouldn't wait past your agreement's turnaround, usually one to three business days through a vendor; longer is a turnaround problem with its own fix. A written service level agreement is where the billing unit, any included hours and a small-edit turnaround belong, so the next invoice can be checked against something.
The message to send
This asks for an itemized explanation, not a refund. Delete any item that isn't on your invoice, and fill in the brackets from the checks above.
Hi [name],
We're going through our vendor invoices line by line this quarter and want to make sure we understand three items on ours.
SSL: our certificate is issued by [issuer from the certificate details], and [host]'s plan lists SSL as included [or, if you host our site: it's a domain-validated certificate that renews automatically]. What does the SSL line cover beyond that?
Analytics: could you list the reports in the advanced analytics package that our own GA4 property and a Data Studio dashboard can't produce, and describe any setup or analysis the fee covers?
Content edits: for the last three edits we were billed for, could you send the hours alongside the dates the changes went live, and point us to the billing increment in our agreement?
If any of these no longer apply, we'd like them taken off the next invoice. Could you send this over by [date two weeks out]?
Common questions
Should I pay for an SSL certificate for my website?
Usually not separately. Let's Encrypt issues trusted certificates at no cost, Cloudflare includes one on all plans, and many hosts list auto-renewing SSL on every plan. A paid organization-validated or extended-validation certificate makes sense when a customer or a security policy requires one. Otherwise, check the certificate's issuer and your host's plan page before paying a separate fee.
Is Google Analytics 4 free?
The standard version is. Google describes Analytics as tools offered "free of charge." Analytics 360 is the paid enterprise tier, with higher limits: 50 key events per property instead of 30, for example. Dashboards built in Data Studio, Google's reporting tool, are also no-cost.
Can a maintenance fee charge for things the host does automatically?
It can include them, as long as it says what the fee pays for. Automatic certificate renewal is the host's work and standard reports are GA4's, so a line billing either one as vendor labor is billing a feature. Watching renewals and alerts is real work; issuing the certificate isn't. For the rest of a plan's scope, see what website maintenance plans should include.
How can I tell how long a billed text edit actually took?
You can't see time directly, but the revision history shows how many saved versions an edit took and when each was saved. Staging work can arrive as a single revision, so one revision against several hours isn't proof, but it's the gap to ask about. Asking for the hours next to the go-live dates puts both in writing.
What if the vendor won't itemize the invoice?
Then you can judge only the total. Compare it with what the same scope costs elsewhere, and treat the refusal as information: a vendor who can't say what each part of a package costs can't tell you what dropping any part of it would save.