This is deliberately advice that makes our own sales process harder. Ask us these questions too.
1. Whose name is the domain registered in?
It should be yours, on an account you can log into. A vendor holding your domain holds your entire business. This single question predicts more future pain than any other.
2. What happens if you disappear?
Ask specifically: where is the code, who else can access the server, and is there documentation. 'It's all in my head' is a real answer we hear, and it is a disqualifying one.
3. Who is responsible when it breaks at 2am?
Get the response time in writing. 'We'll look at it' is not a commitment. An SLA with hours in it is.
4. What is not included?
The important part of any quote is the exclusions. Hosting, SSL renewal, content, images, revisions, training and post-launch changes are the usual places a cheap quote becomes an expensive project.
5. Can I see something in week one?
Any competent team can put a staging URL in front of you early. A vendor who wants to disappear for six weeks and reveal the finished thing is managing your expectations, not your project.
6. Who will actually do the work?
Ask whether the person selling is the person building, and if not, who is. Subcontracting is fine — undisclosed subcontracting is not.
7. What would you tell me not to buy?
The best answer to this question is a specific one. Anyone who says everything in their proposal is essential is either not listening or not being straight with you.