Every web agency homepage runs the same playbook: a hero animation that loops in a 60-second highlight reel, three or four logo-strip rows of past clients, a testimonial slider with two or three pull-quotes, and a CTA that pushes a discovery call. The homepage tells you the agency exists, that it has reached a baseline of design polish, and that it has worked with at least a few brands you might recognize. It does not tell you whether the work was good, whether the team that did the work is still there, or whether the engagements actually shipped.
The case-study page is where the audit starts. A great web agency publishes individual case studies at named URLs, one per engagement, with the brand name in the title and the live URL of the launched site embedded in the page. A weaker agency publishes "selected work" carousels with anonymized headlines, short paragraph blocks, and no live URLs. The shape of the case-study section tells you the agency's confidence in its own work: the more open and named the work, the more honest the engagement.
The order to audit a portfolio is consistent across project types. Open the portfolio index. Pick three case studies that match your project type and revenue tier (a $5M DTC brand evaluating an agency should pick three case studies in the $1M-$20M DTC range, not the agency's largest-ever Fortune-500 deck). Open each in a tab. Move through them with the five questions in the next section, in order. Don't read the agency's commentary on the homepage about itself - read the case studies, then form your own opinion about the agency.
One operational note. If a case study you click on doesn't include the brand name, the live URL, the metric movement, the team named, and the work disclosed clearly, that case study is failing the basic publishing standard for the genre. It's not necessarily a dealbreaker - some agencies under NDA can't disclose certain engagements - but the proportion of NDA'd to fully-disclosed work matters. If 8 of 10 case studies are anonymized, the agency is either NDA-heavy by client mix (which is a tier signal in its own right) or the work is harder to verify than the volume suggests.